Skip to content
AI4Bros home

Privacy policy

As of 12 November 2026

1. Controller

Pakun AI, owner Mikail Günes (brand AI4Bros), c/o Günes, Naunynstraße 83, 10997 Berlin, Germany, email: [email protected], phone +49 30 86321343.

We have not appointed a data protection officer because we are not required to. For all privacy questions, contact us at the email address above.

2. What this shop does technically (short)

3. Hosting and delivery (Cloudflare)

The website, the ordering functions and the database run at Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (Cloudflare Pages, Functions and D1). When you open any page, Cloudflare processes technically necessary connection data (IP address, time, requested address, browser identifier) to deliver the page and protect against attacks. The legal basis is our legitimate interest in a secure and fast website (Art. 6(1)(f) GDPR). We have a data processing agreement with Cloudflare (part of Cloudflare's terms). Cloudflare is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); the European Commission's standard contractual clauses also apply.

The shop itself does not store IP addresses. To protect against abuse (too many requests in a short time), we store for at most two minutes a shortened, irreversible hash of IP address, date and purpose.

# 4. Visitor counting without cookies
We count page views per day and page, how often a cart and the checkout were opened, and how many orders were placed and paid. We store only the date, the page path, a campaign code from the address if present (e.g. "?k=tiktok") and the count, as a daily total. No IP address, no device identifier and no cookie is stored, and the counters are not linked to orders or persons. The campaign code is not stored in your order. Legal basis: Art. 6(1)(f) GDPR (interest in measuring reach without personal data).

5. Local storage (cart)

So that your cart is kept while you browse, the shop stores item numbers and quantities in your browser's local storage. This is strictly necessary for the function you requested (§ 25(2) no. 2 TDDDG). You can delete the entry in your browser at any time; after an order we clear it ourselves.

# 6. Orders
For your order we process: email address, first and last name, delivery address, phone number, ordered items, amounts, payment method and status, and the tracking number. Required for ordering and delivery are name, delivery address and email address. The phone number is only required if the product you order is made by our print partner Spreadconnect, which requires a phone number for delivery questions of the parcel service for every shipment; otherwise it is optional. The checkout shows you whether it is needed. We do not use the phone number for marketing. The legal basis is the performance of the purchase contract (Art. 6(1)(b) GDPR) and our statutory retention obligations (Art. 6(1)(c) GDPR).

Our own server in Berlin retrieves orders through an encrypted, signed interface to pass them to the print partner and to add tracking numbers.

Retention: Unpaid, cancelled orders are anonymised after 30 days. Accounting records (e.g. invoice data) are generally kept for eight years from the end of the calendar year in which they were created, business letters generally for six years (§ 147 AO, § 257 HGB); statutory extensions remain unaffected. Other order and withdrawal data are deleted or anonymised as soon as they are no longer needed for processing and for establishing, exercising or defending legal claims. Where they form part of records that must be kept by law, or ongoing proceedings require further storage, they are kept with restricted processing for those purposes and deleted afterwards. Amounts and items without personal data are kept for accounting.

7. Payment (Stripe)

Payment is processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. After you click "Order and pay" you are redirected to a Stripe payment page. We transmit order number, amount, item names and your email address. You enter your payment data (e.g. card number) only with Stripe. Stripe processes this data to handle the payment and prevent fraud, partly as an independent controller, and uses its own cookies on its page. If you pay with PayPal or Klarna, Stripe passes the necessary data to these providers (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg; Klarna Bank AB, Stockholm). Legal basis: Art. 6(1)(b) GDPR. Stripe's privacy notice: stripe.com/privacy.

# 8. Print partner and shipping
Our shirts and hoodies are made by a print partner after you order and shipped directly to you. We transmit the order data needed for production and shipping (name, delivery address, phone number if given, and ordered items; we do not pass on your email address) to the print partner used for the product you ordered. A fallback partner is only used if it can deliver the ordered product unchanged. Our print partners are:

The print partner passes name, address and phone number to the shipping company so the parcel can be delivered. Legal basis: Art. 6(1)(b) GDPR. Transfers to Printful, Inc. in the USA are based on the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914, Module 2), which are part of Printful's data processing terms (Art. 46(2)(c) GDPR). You can obtain a copy of these safeguards by writing to [email protected].

# 9. Emails
We send order confirmations and payment, shipping and withdrawal confirmations to the email address you gave (Art. 6(1)(b) and (c) GDPR), using the service Resend (Resend, Inc., USA; standard contractual clauses). We do not send marketing newsletters.

If you email us, Cloudflare Email Routing receives the message, stores it in our database at Cloudflare and forwards it to our mailbox at Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Legal basis: Art. 6(1)(b) GDPR (order-related requests) or (f) (other requests; our interest is answering you). We delete requests once they are resolved and no retention obligation applies.

We handle your request without transmitting personal content to external AI services.

# 10. Withdrawal via the website
If you use the "Withdraw from contract" function, we store name, email address, order number or your details of the order, your details on the scope and any message, together with the date and time of receipt, and send you an acknowledgement of receipt. Legal basis: Art. 6(1)(c) GDPR (§ 356a German Civil Code). Deletion follows the same rule as for order data (section 6).

11. Social media links

We link to our Instagram and TikTok profiles with plain links only. The platform's privacy terms apply only once you click a link.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). To exercise them, email [email protected].

You can lodge a complaint with a data protection supervisory authority, for example the authority responsible for us: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany.

13. No automated decisions

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.