The short version
- Your Weekly Orders Report is read and analysed inside your browser. It is never uploaded, and we never receive it.
- FeeSift sets no cookies and stores nothing on your device, which is why you are not being asked to dismiss a consent banner.
- There is no advertising, no analytics, no tracking pixel, no session replay and no error monitoring on any page.
- Fonts are served from this site. Loading a page does not contact Google or any other third party.
- Our web host unavoidably processes your IP address to deliver the page to you. That is the only routine processing described below.
We do not claim that FeeSift “collects no data”. Serving a web page means a server sees your IP address, and emailing us means we read your message. This notice describes exactly that, and nothing is hidden behind a vaguer phrase.
Who is responsible
The controller for the processing described here, within the meaning of Art. 4(7) GDPR, is:
Marek KammFeeSiftChristianental 738855 WernigerodeGermany- marek.kamm2005@gmail.com
- Telephone
- +49 1573 9286116
No data protection officer has been appointed. Art. 37 GDPR and § 38 BDSG do not require one here: FeeSift is run by one natural person, carries out no large-scale or systematic monitoring, and processes no special categories of data. If that changes, a data protection officer will be appointed and named on this page.
Your Weekly Orders Report never reaches us
The payout analyzer is the part of FeeSift that touches genuinely sensitive material: a Whatnot Weekly Orders Report contains your buyers' names and locations alongside your own revenue. It is built so that this data is never transmitted to us in the first place.
- You choose a file yourself in your browser's file dialog. Nothing is read until you do.
- The file is handed to a dedicated worker inside your browser and parsed there, in memory.
- Analysis, fee comparison and totals are all computed on your device. FeeSift has no server-side database and no upload endpoint the file could be sent to.
- Exports are generated in your browser and saved by your browser. The anonymised export removes buyer identity by default, but you should still check the file before sharing it.
- Resetting the tool or closing the tab discards the analysis. Nothing is written to your device, so nothing survives the tab.
Because the report is never transmitted to us, we cannot access it, disclose it, lose it in a breach, or restore it for you. This is a deliberate trade-off: your report is safer, and there is no “open my last analysis” feature. Loading the page itself is an ordinary web request and is covered by serving the website below — but that request carries no CSV content and no calculated figures.
Serving the website
Requesting a page from FeeSift means your browser sends technical data to our host, which is unavoidable if the page is to arrive at all.
- Data
- IP address, request time, requested URL, user agent
- Purpose
- Delivering the requested page, keeping the service stable, and defending it against attack, bot traffic and abuse.
- Legal basis
- Art. 6(1)(f) GDPR. Our legitimate interest is operating a website that can actually be reached and is not knocked over or defaced. Nothing in these logs is used to build a profile of you, and no attempt is made to identify you from them.
- Processor
- Cloudflare, Inc.
- Processor's address
- 101 Townsend Street, San Francisco, CA 94107, USA
- Processing region
- Global edge network; a request is answered by the nearest data centre
- Retention
- Cloudflare stores an invocation log for each request (Workers Logs). On the Free plan in use, those logs are deleted after 3 days.
When you email us
Email is the only contact channel FeeSift offers. There is no contact form, because a form would need server-side processing that the site otherwise does not have.
- Data
- Sender address, subject, message content, technical headers
- Purpose
- Reading and answering your message, and correcting a fee rule or a parsing bug you report.
- Legal basis
- Art. 6(1)(f) GDPR — the mutual interest in a question being answered. If your message concerns a legal claim, the basis is Art. 6(1)(c) or (f) as applicable to that claim.
- Processor
- Google Ireland Limited
- Retention
- Messages are deleted once they are no longer needed, and at the latest 24 months after the matter is closed, unless a statutory retention period applies.
Openly stated: during FeeSift's initial test period the published address is a private Gmail mailbox. Google operates a free consumer account under its own consumer terms as an independent controller, so there is no Art. 28 processing agreement behind it — one cannot be concluded for a consumer account. Anything you send to that address is therefore readable by Google under its own terms. The address is being moved to a mailbox on the FeeSift domain with a proper processing agreement; until then, send nothing by email you would not want Google to hold.
Please do not attach your Weekly Orders Report to an email. We do not want it and have nowhere appropriate to keep it. If we receive one unasked, we delete it and tell you that we have.
Cookies and browser storage
§ 25 TDDDG requires consent before information is stored on or read from your device, unless it is strictly necessary for a service you expressly requested. FeeSift shows no consent banner because there is nothing to consent to — the application stores nothing on your device at all.
| What | Why it needs no consent |
|---|---|
| From FeeSift itself: nothing | The application sets no cookies and writes to no localStorage, sessionStorage or IndexedDB. A consent banner would have nothing to ask about. |
| The CSV file you select | Read, not stored: you pick the file yourself in the file dialog, it is processed in browser memory and discarded when you reset the tool or close the tab. That is the service you expressly requested under § 25(2) no. 2 TDDDG. |
| Cloudflare security cookies | Depending on the zone's security settings, Cloudflare may set a strictly necessary cookie to fend off bots and attacks. It serves the security of delivery only, never analytics or advertising. |
What FeeSift deliberately does not do
The following are absent from every page, in every state, without a setting to change. This is not a promise about intent; it is a property of the build, and an automated test fails if any of it appears.
- No advertising and no advertising network. FeeSift does not use Google AdSense.
- No web analytics, on any page, consented or otherwise.
- No tracking pixels, conversion tags, or social plugins.
- No session replay or heat mapping.
- No third-party error monitoring.
- No chat widget and no embedded video.
- No externally hosted fonts. The Geist fonts are downloaded when the site is built and served from this domain, so your browser makes no request to Google Fonts.
- No affiliate links and no affiliate tracking.
- No user accounts, no login, and no newsletter.
If advertising is ever introduced, it will require a consent management platform, a rewritten version of this notice, and a new entry in the change log — and it will still be kept off the payout analyzer.
Transfers outside the EEA
- Web host
- Cloudflare, Inc. is based in the United States. Cloudflare's data processing addendum forms part of its self-serve terms and relies on the EU Standard Contractual Clauses for transfers out of the EEA; Cloudflare additionally states that it is certified under the EU-U.S. Data Privacy Framework.
- Email provider
- The contracting party is Google Ireland Limited in Ireland. Google states that it also processes email in data centres outside the EEA, including the United States, and relies on the EU-U.S. Data Privacy Framework and standard contractual clauses for those transfers. Those statements are Google's own; no separate processing agreement exists for a private Gmail account.
Your report data is not part of any transfer, because it never leaves your browser.
Your rights
Under the GDPR you have the following rights in relation to your personal data. Write to marek.kamm2005@gmail.com to use any of them.
- Access (Art. 15)
- Confirmation of whether we process your data, and a copy of it.
- Rectification (Art. 16)
- Correction of inaccurate data and completion of incomplete data.
- Erasure (Art. 17)
- Deletion, where one of the listed grounds applies.
- Restriction (Art. 18)
- Restriction of processing instead of deletion, in the listed cases.
- Portability (Art. 20)
- Receipt of data you provided in a structured, commonly used, machine-readable format.
- Objection (Art. 21)
- Objection, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) — which here means the server logs.
There is no consent-based processing on this site, so there is no consent for you to withdraw. Should that ever change, withdrawal will be made as easy as giving consent.
A practical limit worth stating plainly: server logs contain an IP address and nothing that links it to you by name. Where we genuinely cannot identify you from the data we hold, Art. 11 GDPR applies and we may need additional information from you before we can act on a request.
Complaining to a supervisory authority
Under Art. 77 GDPR you may complain to a supervisory authority, in particular in the EU member state where you live, where you work, or where you believe the infringement took place. The authority competent for the operator is:
- Authority
- Landesbeauftragte für den Datenschutz Sachsen-Anhalt, Otto-von-Guericke-Straße 34a, 39104 Magdeburg (Postfach 1947, 39009 Magdeburg)
You are welcome to raise the matter with us first, but you are not required to.
Whether you have to provide data
You are under no statutory or contractual obligation to provide any data. Sending an IP address is a technical necessity of requesting a web page rather than a choice we impose. If you email us, giving your address is what allows a reply; without it there is simply no way to answer. No FeeSift feature is withheld from you for declining anything.
Automated decision-making
There is no automated decision-making producing legal or similarly significant effects, and no profiling, within the meaning of Art. 22 GDPR. FeeSift's calculators apply published fee rules to numbers you type in; they reach no decision about you.
Changes to this notice
This notice is reviewed whenever a dependency, vendor or feature changes what actually happens, and at least once a year. Each version is recorded below rather than replaced silently.
- 2026-08-17
- First version of the legal notice, privacy notice and terms of use, written from the actual implementation: no cookies, no advertising, no analytics, no external fonts.