Privacy Policy

1. Controller

The controller responsible for data processing on this website and through the Stickerdrop WhatsApp service is:

oneninetynine labs
Robin Weissgerber
Hanna-Kirchner-Strasse 24
64823 Gross-Umstadt, Germany
Email: legal@199labs.tech

2. Data we collect

2.1 WhatsApp service

When you interact with Stickerdrop via WhatsApp, we collect:

• Phone number — your WhatsApp phone number in E.164 format, used as your identity
• Display name — your WhatsApp profile name (if available)
• Sticker images — images you send for printing
• Message content — text messages exchanged during the ordering conversation
• Shipping address — name, street, city, postal code, and country you provide for delivery
• Timestamps — when messages are sent and received

2.2 Payment data

Payment is processed by Stripe. We do not store your credit card details. We receive from Stripe: payment status, transaction ID, and the amount paid.

2.3 Website analytics (Umami)

We use a self-hosted instance of Umami, a cookieless, privacy-friendly analytics tool, to understand how the website is used (page views, referral source, device type, campaign parameters). Umami sets no cookies, collects no personal data, and does not track you across sites. Legal basis: Art. 6(1)(f) GDPR — legitimate interest in measuring and improving our website.

2.4 Marketing tags (consent only)

Only if you accept marketing cookies in our consent banner, we additionally use the Meta Pixel (Meta Platforms Ireland Ltd.) and the Google Ads conversion tag (Google Ireland Ltd.) to measure the effectiveness of our advertising. These services set cookies and may process your IP address and browsing events. For Google services we use Consent Mode v2: without your consent, all Google consent signals default to "denied" and no Google cookies are set. Legal basis: Art. 6(1)(a) GDPR — your consent, revocable at any time via "Cookie Settings" in the footer. Server-side measurement of orders placed via WhatsApp is described in section 2.6.

2.5 Consent banner and attribution

Your consent choice is stored in a first-party cookie ("sd_consent", 6 months). We also store how you reached us in a first-party cookie ("sd_attr", 90 days): the campaign parameters of an advertising link (UTM parameters, click IDs) if you arrive via one, and otherwise only a coarse category derived from the referring website — for example "search engine", the referring domain, or "direct". We keep both your first and your most recent such contact and attach them to your order so we know which marketing works. These values describe the route you took to us, not your identity, and are never used to build a profile or to track you across other websites.

2.6 WhatsApp order measurement (Meta Conversions API)

To measure whether our advertising leads to actual orders, we transmit the following to Meta Platforms Ireland Ltd. via its Conversions API when you interact with our WhatsApp service: the event type (conversation started, checkout started, purchase completed), a timestamp, the order value, and your phone number in hashed (pseudonymized) form — never the content of your messages or your stickers. Purpose: ad performance measurement. Legal basis: Art. 6(1)(f) GDPR (berechtigtes Interesse — legitimate interest in measuring advertising effectiveness).

Your right to object (Art. 21 GDPR): reply STOP TRACKING in the WhatsApp chat at any time. We will confirm and permanently stop all such transmissions for you — your orders are not affected in any way. Please note that hashed events already transmitted cannot be retracted; an objection stops all future transmission. You will be informed of this measurement by a one-time notice in the chat.

3. Purpose and legal basis

4. Third-party processors

We share your data with the following service providers, solely for the purposes described:

5. Data retention

• Order data (order details, invoices, shipping address) — 10 years, as required by German tax law (AO §147)
• Conversation data (message logs) — deleted after 90 days
• Sticker images — deleted 30 days after order completion
• Newsletter email — until you unsubscribe

6. Your rights

Under the GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate data
• Erasure — request deletion of your data (subject to legal retention requirements)
• Restriction — limit how we process your data
• Data portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interest
• Withdraw consent — where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, contact us at legal@199labs.tech.

7. Supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI)
Postfach 3163
65021 Wiesbaden, Germany
https://datenschutz.hessen.de

8. Automated decision-making

We do not use automated decision-making or profiling as defined by Art. 22 GDPR.

9. Changes to this policy

We may update this privacy policy from time to time. The latest version will always be available on this page with the “Last updated” date above.