Who runs this site, and what happens with the data you send us.
Information pursuant to § 5 DDG (German Digital Services Act).
Email: alex@compound-bio.com
Contact form: the form on the sprint page
The video footage on the sprint page is licensed stock footage from Pexels and shows the formats creators film. The people shown are not Compound creators or clients. Dashboards and lists on the page show sample data.
This notice explains which personal data we process when you visit this site, send us a brief, pay us, apply to one of our castings or get an email from us, why, and what rights you have under the EU General Data Protection Regulation (GDPR).
Alexander Vierdag, Compound Bio, Am Mühlenbusch 56, 42781 Haan, Germany. Email: alex@compound-bio.com.
This site is hosted by Cloudflare, Inc. (USA, certified under the EU-US Data Privacy Framework). To deliver the page and keep it secure, Cloudflare processes the technical data your browser sends: IP address, date and time, the page requested, and browser and operating system. The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).
This site sets no cookies and uses no analytics or tracking. Fonts and videos load from this site itself, so no data goes to Google Fonts, YouTube or social networks when you open the page.
We process what you enter: your name, work email, brand website, creator style, the product and notes you add, and whether you are hiring. We use it to run your casting, to answer you and to run your sprint. The legal basis is taking steps at your request before a contract, and performing it (Art. 6(1)(b) GDPR).
The form is delivered by Web3Forms, a service of Web3Creative, India, which passes your submission to our inbox. Web3Forms stores submissions on infrastructure providers including Amazon Web Services, Cloudflare and Hetzner, protects transfers out of the EU with the EU Standard Contractual Clauses, and deletes submissions after three years at the latest. If the form opens your email app instead, your message goes straight to our inbox.
Invoices and card payments run through Stripe (Stripe Payments Europe, Limited, Ireland). You enter your card details directly with Stripe; we see your name, email, billing address, the amount and the last four digits of your card. The legal basis is performing our contract with you (Art. 6(1)(b) GDPR) and our legal duty to keep invoices (Art. 6(1)(c) GDPR). Stripe also processes payment data under its own privacy notice, for example to prevent fraud.
We run castings for brands on creator marketplaces. If you apply, we see what you share there, such as your name, handles, audience figures and fee, and once you are booked, your shipping address. We share your profile and fee with the brand the casting is for, and your address with that brand once you are booked, so it can send you the product. The legal basis is taking steps before, and performing, the contract you apply for (Art. 6(1)(b) GDPR). If you are not booked, we delete your details within twelve months.
Our email runs on Google Workspace, provided in the EU by Google Ireland Limited. Emails you send us are stored there. Google may process data in the US; Google LLC is certified under the EU-US Data Privacy Framework.
We write to people at US consumer brands that are hiring for creator or influencer roles. For that we use business contact details from public sources, such as the company’s website and its job posting: name, role, company and work email. The legal basis is our legitimate interest in offering a relevant service to businesses (Art. 6(1)(f) GDPR). Reply that you are not interested, or object at any time, and we stop, delete your details and keep only a note not to contact you again. Otherwise we delete them within twelve months of our last message.
We keep your brief and our emails as long as we need them to handle your request. If no sprint follows, we delete them within twelve months. If a sprint follows, we keep business letters and invoices for as long as German commercial and tax law requires, up to ten years.
You can ask us for access to your data (Art. 15 GDPR), correction (Art. 16), deletion (Art. 17), restriction of processing (Art. 18) and a copy in a portable format (Art. 20). Where we rely on legitimate interests, you can object at any time (Art. 21). An email to alex@compound-bio.com is enough.
You can also complain to a data protection authority, for example the one responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (ldi.nrw.de).
No. Without an email address, though, we can’t reply to a brief.
Last updated: September 2026