Smoke at the Water
Daily from 10 am
Smoke at the Water
Call Directions

Smoke at the Water

Privacy policy

Under Art. 13 GDPR, for website and app

This English text is a convenience translation. Only the German version is legally binding. / Dieser englische Text ist eine Arbeitshilfe. Es gilt allein die deutsche Fassung.

Version 2026-09-12.

1. Controller

Controller under the GDPR:
Smoke at the Water, owner Benn Neujahr
Am Strand 5a
19063 Schwerin
Email: b.neujahr@smokeatthewater.de
Phone: 0172 5354796

2. General notes on processing

We take the protection of your personal data seriously and treat it confidentially in line with statutory data-protection rules and this privacy policy.

You can use the information pages on smokeatthewater.de without providing personal data. We only collect personal data if you use our online booking (section 7), sign up for or manage a membership (section 8), use the Smoke at the Water app with sign-in (section 8), or contact us by email or phone.

3. Data collected when you load the site

When you request this website, your browser automatically sends data to the web server. These server logs may include:

Browser type and version, operating system, referrer URL, host name of the accessing machine, time of the request and IP address.

This data is not combined with other sources. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in technically correct and secure operation of the website).

The information pages set no cookies and use no analytics or tracking tool. Only if you sign in on the website (membership account or staff area) do we set a technically necessary session cookie (section 8.2).

4. Hosting: Vercel

This website is hosted by Vercel. Provider: Vercel, Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When the site is requested, Vercel processes technically necessary server-log data (including IP address, time, browser type) on the basis of Art. 6(1)(f) GDPR. Delivery uses a worldwide network, preferably EU servers.

Because Vercel is a US company, data may be transferred to the United States. Vercel is certified under the EU-U.S. Data Privacy Framework and also uses standard contractual clauses under Art. 46 GDPR. Details in Vercel’s privacy policy.

5. Google Maps on the contact page (two-click)

On the contact page we embed a map from Google Maps. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The map loads only after you click “Load map”. Only then is a connection made to Google and your IP address and possibly other data (browser information, location) sent to Google. If you are signed in to Google, Google may link the data to your account.

Legal basis: your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. You withdraw it by reloading the page and not loading the map. Details in Google’s privacy policy.

6. Fonts (hosted locally)

We use the typefaces “Bricolage Grotesque”, “Open Sans” and “Pacifico”. They are served from our own server. There is no connection to Google Fonts or other font providers.

7. Online booking of SUP boards and sun loungers

At smokeatthewater.de/buchen you can reserve and pay for SUP boards and sun loungers online. Until online booking is enabled, no data is processed there. When you book we process:

Data collected: name, email address, phone number (optional), booking details (date, time, service, quantity), the time you accepted the rental terms, and the data needed for payment.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract and pre-contractual steps).

Retention: we store booking data until the contract is fully performed. Data with tax relevance is kept under § 147 AO and § 257 HGB for up to ten years.

7.1 Storage of booking data: Supabase

We store name, email, phone number and booking details in a database at Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992 (also for membership and the app, section 8), on servers in the EU (Frankfurt). We have a data-processing agreement with Supabase under Art. 28 GDPR. Details in Supabase’s privacy policy.

7.2 Payments: Stripe

Payments are processed by Stripe. EU provider: Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Stripe processes the payment data you enter (for example card or SEPA details) under its own responsibility; we do not receive complete payment data. Stripe sets technically necessary cookies for fraud prevention (§ 25(2) no. 2 TDDDG). Legal basis: Art. 6(1)(b) GDPR. Details in Stripe’s privacy policy.

7.3 Email: Strato

We send booking confirmations from our own mailbox at STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin. Your email address and the confirmation content are transmitted via Strato’s mail servers in Germany. Legal basis: Art. 6(1)(b) GDPR. Details in Strato’s privacy policy.

8. Membership and the Smoke at the Water app

At smokeatthewater.de/mitgliedschaft you can take out a membership (Bronze, Silver, Gold). You then use membership card, perks, check-in and leaderboard in our iOS app. Until membership is enabled, no data is processed there.

8.1 Signup and contract data

Data collected: name, email address, optional phone number and date of birth, chosen tier and billing interval, chosen offer, version and time of your acceptance of the membership terms and of this privacy policy, a shortened technical identifier (hash) of your IP address and browser as proof of consent, and the customer, subscription and invoice identifiers Stripe sends us.

Customer number: with the first payment you receive a sequential four-digit customer number. It is a pseudonym and is shown to other members on the leaderboard (section 8.5).

Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (legal duties to keep records).

8.2 Account and sign-in: Supabase Auth

For accounts and sign-in we use Supabase Auth (Supabase Inc., section 7.1, servers in Frankfurt). Your account is created automatically after the first payment with the email address from checkout. You sign in in the app and on the website with your email and a one-time code we send by email; there is no password. We process email address, time and IP address of sign-in, and a session token.

In the app the session token is stored on your device so you stay signed in. On the website we store it in a technically necessary cookie (§ 25(2) no. 2 TDDDG), which is deleted when you sign out. Legal basis: Art. 6(1)(b) GDPR.

8.3 Payment and subscription: Stripe

Fees are collected as recurring payments via Stripe (section 7.2). Stripe stores your payment method and issues invoices; we do not receive complete payment data. In the Stripe customer portal you can change payment methods and download invoices. We send Stripe name, email address, tier, billing interval and offer, plus technical identifiers. Legal basis: Art. 6(1)(b) GDPR.

8.4 Perks, check-in and points

We store which perks you are entitled to and when our staff redeemed them (time, amount, person who redeemed), your check-ins (calendar day), your points (from check-ins and from orders our staff assign to your customer number, with order value) and your streak. This data sits in our database at Supabase (section 7.1). Legal basis: Art. 6(1)(b) GDPR.

Camera: for check-in you scan a QR code at the stand in the app. The app asks for camera permission. The camera image is evaluated only on your device; no photos or videos are stored or transmitted. Only the QR-code content is sent. We do not collect location. Without camera permission check-in is not possible; all other app features remain usable.

8.5 Leaderboard

The monthly and all-time leaderboards show other signed-in members your rank, points and customer number (for example #0042). Name, email or other details are not shown. At month end we store places 1 to 3 with points to assign prizes. Legal basis: Art. 6(1)(b) GDPR; the leaderboard is part of the membership you booked.

8.6 Real-time updates

So the app can show new perks and check-ins without a reload, it keeps a connection to Supabase Realtime (section 7.1). Only changes to your own data are transmitted. Legal basis: Art. 6(1)(b) GDPR.

8.7 Membership emails

We send you contract-related emails from our Strato mailbox (section 7.3): confirmation with customer number, one-time codes to sign in, reminders before the end of the initial term and before yearly charges, notices of failed payments, cancellation and refund confirmations. We do not send advertising. Legal basis: Art. 6(1)(b) GDPR.

8.8 Cancellation via the cancellation button

If you cancel at smokeatthewater.de/kuendigen, we store email address, customer number, type and reason of cancellation, time, and a hash of the IP address so we can prove receipt and effect (§ 312k BGB). Legal basis: Art. 6(1)(b) and (c) GDPR.

8.9 Retention and deletion

We store account and contract data for the duration of the membership. After the contract ends we delete or anonymise check-ins, points, streak and leaderboard entries within twelve months; customer numbers are not reused. Invoice and payment data is kept under § 147 AO and § 257 HGB for up to ten years. You can request deletion of your account any time in the app or by email; it happens after the membership ends, subject to retention duties.

9. External links

Our website links to Instagram (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin, Ireland), our Google reviews profile (Google Ireland Limited) and the Apple App Store (Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland). These are plain links without embedded plugins. Data only flows when you click a link and visit the external site.

10. Contact by email or phone

If you contact us by email (info@smokeatthewater.de or b.neujahr@smokeatthewater.de) or by phone, we store your details (name, contact data, message) to handle the enquiry. Legal basis: Art. 6(1)(b) or (f) GDPR. The data is deleted once the enquiry is fully handled and no statutory retention duties apply.

11. Your rights

You have the following rights towards us:

  • Access (Art. 15 GDPR) to your stored personal data.
  • Rectification (Art. 16 GDPR) of inaccurate data.
  • Erasure (Art. 17 GDPR) under the statutory conditions.
  • Restriction of processing (Art. 18 GDPR).
  • Data portability (Art. 20 GDPR) in a structured, commonly used format.
  • Objection (Art. 21 GDPR) to processing based on legitimate interests.
  • Withdrawal of consent (Art. 7(3) GDPR), for example for the map embed, at any time with effect for the future.

Right to complain: you can complain to a data-protection supervisory authority. Ours is:
Der Landesbeauftragte für Datenschutz und Informationsfreiheit Mecklenburg-Vorpommern
Lennéstraße 1, 19053 Schwerin
www.datenschutz-mv.de

12. Transfers to third countries

Using Vercel (USA), Stripe and Supabase (registered in Singapore, data for us held in Frankfurt) may involve transfers outside the EU/EEA. They take place on the basis of standard contractual clauses under Art. 46(2)(c) GDPR or, where applicable, the EU-U.S. Data Privacy Framework.

13. Contact for privacy requests

For questions about privacy or to exercise your rights, write to:
b.neujahr@smokeatthewater.de

As of: 12 September 2026