Privacy policy
1. Controller and contact
The controller under the GDPR is Rami Tanous, sole trader, trading as CFO Brain, Putlitzstraße 16, 10551 Berlin. Email: hello@getcfobrain.com.
We have not appointed a data protection officer. Write to the address above with any question about your data.
2. What stays on your device
The Cash Cliff simulator and the phone app collect nothing. They run in your browser. The numbers you enter are calculated on your device and are never sent to us or anyone else. The phone app can keep one saved scenario on your own device; that copy never reaches us.
3. What we process, why, and for how long
| When | Data | Why, and the legal basis | How long |
|---|---|---|---|
| Visiting this site | Server log data: IP address, date and time, page requested, browser and device details. | To deliver the pages and keep the site secure. Legitimate interest, Art. 6(1)(f) GDPR. | Kept by the hosting provider for as long as it needs them to run and secure the service. We do not keep our own copy. |
| Asking for the free starter by email | Email address; your country if the form asks for it; the source tag of the link you came from; the time of sign-up and of confirmation, and the technical details the email tool keeps as proof (for example the IP address). | To send you the starter and the emails you asked for, and to prove your consent. Consent, Art. 6(1)(a) GDPR (double opt-in). Keeping the proof of consent after you unsubscribe: legitimate interest, Art. 6(1)(f) GDPR. | Until you unsubscribe. Then your address and the proof stay on a suppression list for 3 years, so that we do not email you again and can show your consent. Sign-ups that are never confirmed are deleted after 30 days. |
| Downloading the free starter directly from the page | None. This download needs no data from you. | Not applicable. | Not applicable. |
| Buying the workbook | At checkout you give your name, email address, billing details and payment details to the checkout provider. We receive your name, email address, country, the product, the price, the date, the order number and the payment or refund status. | To deliver the file, give support and handle refunds: performing the contract, Art. 6(1)(b) GDPR. To keep tax and accounting records: legal obligation, Art. 6(1)(c) GDPR. | Accounting records: for the periods German tax and commercial law require, between 6 and 10 years depending on the document. Other order data: until it is no longer needed for support and refunds. |
| Opening the download page after paying | The payment reference that the checkout adds to the page address. | To check that the payment went through before the file is handed out. Performing the contract, Art. 6(1)(b) GDPR. | Used only for that check. |
| Writing to us: questions, support, refunds, withdrawals | Your email address, your message and the order details you give us. | To answer you and handle your request. Performing the contract, Art. 6(1)(b) GDPR, or our legitimate interest in answering enquiries, Art. 6(1)(f) GDPR. | Until the matter is closed, at the latest 2 years afterwards. Accounting records as above. |
You do not have to give us any of this data. Without your email address we cannot send you the starter by email, and without the order details we cannot deliver or support a purchase.
4. Free starter and emails
If you ask for the starter by email we use double opt-in: you first get an email asking you to confirm your address, and we keep the time of sign-up and of confirmation as proof of consent. After you confirm, you get the starter and a short series of about 6 emails over roughly two weeks. One of them tells you about the paid workbook. Every email has an unsubscribe link, and you can withdraw your consent at any time. Email service, as our processor: MailerLite Limited. We keep your address until you unsubscribe, then keep it with the proof of consent on a suppression list for 3 years. Unconfirmed sign-ups are deleted after 30 days.
5. Who receives data, and transfers outside the EEA
| Recipient | What it does | Where, and the transfer basis |
|---|---|---|
| Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA | Hosts and delivers this site (processor under Art. 28 GDPR). It receives the server log data, the payment reference when you open the download page. | In the USA. Vercel states that it is certified under the EU-U.S. Data Privacy Framework, which the European Commission has recognised as adequate (Art. 45 GDPR). The data processing agreement that Vercel offers also contains the EU standard contractual clauses (Art. 46 GDPR). |
| MailerLite Limited, 88 Harcourt Street, Dublin 2, D02 DK18, Ireland | Sends our emails and keeps the sign-up list (processor under Art. 28 GDPR). | In Ireland and the EU: MailerLite states that it stores subscriber data in a data centre in the EU. Its data processing agreement contains the EU standard contractual clauses for any transfer to a country without an adequacy decision, and its US group company states that it is certified under the EU-U.S. Data Privacy Framework. |
| Stripe (Stripe Payments Europe, Ltd. in Ireland and Stripe, Inc. in the USA) | Provides the payment account that this shop uses. The order records (the order, the amount, your name and email address, the payment and refund status) are kept in our Stripe account, and our server asks Stripe whether a payment went through when you open the download page, using the payment reference (processor under Art. 28 GDPR for the data in our account). | As stated in Stripe's data processing agreement, which Stripe makes available to its business customers. |
| Sold through Link, 354 Oyster Point Blvd, South San Francisco, CA 94080, United States | Takes your payment, works out and collects any VAT or sales tax, sends the receipt, handles payment problems and runs fraud checks. For the payment itself it decides on its own why and how it uses your data (it is a controller in its own right). It passes us the order details listed above. | See the privacy notice of the checkout provider, which you can reach from its checkout page. |
| Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | Runs our support mailbox: it receives and stores the emails you send us (processor under Art. 28 GDPR). | As stated in that provider's data processing agreement. |
| Tax authorities, and our tax adviser if we use one | Receive accounting data where the law requires it or for our tax returns. | In Germany. |
Where a recipient is certified under the EU-U.S. Data Privacy Framework we rely on the Commission's adequacy decision for it. Otherwise we rely on standard contractual clauses. Providers describe their certification themselves; the public list is at dataprivacyframework.gov.
6. Automated decisions
We do not use automated decision-making or profiling. The checkout provider may run fraud checks on its own account; its privacy notice describes them.
7. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where we process data because of our legitimate interests, you may object at any time on grounds relating to your particular situation (Art. 21). Where you gave consent, you can withdraw it at any time with effect for the future (Art. 7(3)); the unsubscribe link in each email does this. To use a right, write to hello@getcfobrain.com. Withdrawing consent does not affect what was lawful before.
8. Right to complain
You may complain to a data protection authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59-61, 10555 Berlin, Germany, www.datenschutz-berlin.de. You may also complain to the authority in the EU country where you live or work.
9. Cookies and storage in your browser
By default this site sets no cookies and loads no analytics, advertising pixel, web font service or third-party script.
Your browser may keep one small item: your currency choice for the simulator (local storage). If the link you came by carries a source tag (for example from an ad), the page keeps that tag for this browser tab only (session storage), so that it can be sent with your sign-up and added to the checkout link as an order reference; closing the tab removes it. Nothing else is stored on your device without your consent. If analytics or advertising tools are ever switched on, they load only after you accept in a banner, and you can withdraw your consent at any time under "Cookie settings".
10. Other sites
The checkout page belongs to the checkout provider and has its own privacy notice. We do not control other sites we link to.
11. Changes
We update this policy when the way we handle data changes. Last updated: 19 October 2026.