Skip to content
Demo data: prices, listings and scores on this site are generated for testing and are not real.
Worth the Bag

Prices for: Germany, EUR

Privacy policy

Last updated: October 2026

This policy explains which personal data Worth the Bag processes when you use the website, follow a bag or a brand, or subscribe to The Letter, and which rights you have under the EU General Data Protection Regulation (GDPR).

1. Controller

Loistava Holding UG (haftungsbeschränkt)
Asternring 9, 15732 Schulzendorf, Germany
Email: [email protected]

2. Overview

You can use this site without an account and without telling us who you are. We process personal data only where it is needed to run the site securely, to send alerts or The Letter if you have asked for them, or, after your consent, for detailed analytics. We do not sell personal data and we do not use it for advertising profiles.

3. Hosting, delivery and server logs

The website and its database run on servers of Hetzner Online GmbH in Germany. Requests pass through Cloudflare, which provides the content delivery network, DNS and protection against attacks.

When you open a page, the servers technically process your IP address, the date and time, the requested address, the referring page, the browser and operating system. This is necessary to deliver the site and to keep it secure and stable.

  • Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working website).
  • Retention: server logs are deleted after 14 days, unless a specific security incident requires us to keep individual entries longer for investigation.

4. Cookies and similar technologies

Before you make a choice in the consent banner, we only store what is strictly necessary for the site to work:

  • Consent cookie: remembers your choice in the consent banner, so we do not ask on every page.
  • Market cookie: remembers the country you selected in the market switcher, so prices are shown for that country. It is set only when you use the switcher.

These are necessary for a service you have requested (§ 25(2) TDDDG; Art. 6(1)(f) GDPR). Other cookies or similar storage are used only after your consent (see section 5). You can change your choice at any time through the cookie settings link in the footer.

5. Analytics

We use PostHog, hosted in the EU, to understand how the site is used.

  • Basic reach measurement without device storage. Page views and visitor counts are measured without cookies and without storing or reading anything on your device. Daily unique visits are estimated from a hash that is calculated on the server and changes daily, so you cannot be recognised across days. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in knowing how many people use which pages).
  • Persistent analytics, only with consent. If you agree in the consent banner, PostHog may also store an identifier on your device to recognise repeat visits and to analyse which features are used across sessions. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw your consent at any time through the cookie settings link in the footer, with effect for the future.

6. Following bags and brands, My Bags and The Letter

You can follow a bag and be told by email about a price increase, a price drop, it coming back in stock and, if you add a price, a preloved one listed below it. You can follow a brand to be told about price increases on the bags of that brand we track when you sign up. Separately, and only if you tick the box for it, you can subscribe to The Letter, our weekly email with a journal piece, confirmed price increases and preloved savings.

  • Data: your email address, the items you follow (a followed brand is stored as one entry per bag), market, language and type of alert, the time of sign-up and of confirmation, whether you subscribed to The Letter, and the version of the consent text you agreed to.
  • Double opt-in: after you sign up, we send an email with a confirmation link that is valid for 7 days. Nothing else is sent until you confirm. We send at most one email per day.
  • Legal basis: Art. 6(1)(a) GDPR (consent). Following and The Letter are separate consents, and neither is a condition for using a tool or seeing a result on this site. We store the consent version and confirmation time to be able to prove your consent.
  • My Bags: every alert and every issue of The Letter contains a personal link to a page without a login, where you can see what you follow, remove a bag, turn The Letter on or off, and unsubscribe from everything. Anyone who has this link can open that page, so please do not forward it. The page is not indexed by search engines, is not stored by caches, and we remove the personal part of the link from our analytics.
  • Measuring email: links in our emails carry a tag that names the type of email (for example utm_source=letter), not you. We do not track whether you open an email.
  • Withdrawal: every email contains a one-click unsubscribe link, and My Bags lets you stop individual bags or everything. You can also write to us. Withdrawal does not affect the lawfulness of processing before it.
  • Delivery: emails are sent through Resend (see section 9).
  • Retention: sign-ups that are not confirmed are deleted after 7 days. A bag you remove in My Bags is deleted at once. Confirmed subscriptions are kept until you unsubscribe; afterwards we keep the record of your consent and unsubscription for up to 3 years to be able to prove it, and then delete it.

7. Outbound clicks to shops

When you click a link to a retailer or resale platform, we record the click: the shop, the item, the position of the link on the page, the language and the market. We do not store your IP address or any identifier with it, so a click cannot be traced back to you. We use these counts to understand which links are used and to reconcile commissions.

Once you are on the shop's website, the shop and its affiliate network may process data under their own responsibility, for example to attribute a purchase to our link. Their privacy policies apply there.

8. Product matching with a language model

To match product titles from shop feeds to the bags in our catalogue, we may send product titles to Anthropic. Only product data is sent. No personal data of visitors or subscribers is ever sent to Anthropic.

9. Processors

We use the following service providers, who process data on our behalf under data processing agreements (Art. 28 GDPR):

Provider Purpose
Hetzner Online GmbH, Germany hosting and database
Cloudflare, Inc. content delivery, DNS and security
Resend, Inc. email delivery for alerts and The Letter
PostHog, Inc. (EU cloud) analytics, see section 5
Inngest, Inc. scheduling of background jobs; it receives no personal data beyond what a specific job needs, for example the address an alert is sent to
Anthropic, PBC product title matching only, no personal data

10. Transfers outside the EU

Some providers listed above are based in the United States or may access data from there. Where personal data is transferred to the United States, the transfer is based on the EU-US Data Privacy Framework (adequacy decision under Art. 45 GDPR) where the recipient is certified under it, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), together with additional safeguards where necessary. You can request a copy of the relevant safeguards using the contact details above.

11. Retention at a glance

Data Retention
Server logs 14 days
Outbound click records kept for statistics; they contain no personal data
Unconfirmed sign-ups deleted after 7 days
Confirmed subscriptions until you unsubscribe
Proof of consent and unsubscription up to 3 years after unsubscribing
Persistent analytics data (with consent) per the PostHog retention settings, at most 12 months

12. Your rights

You have the right to:

  • access the personal data we hold about you (Art. 15 GDPR),
  • have incorrect data corrected (Art. 16),
  • have your data erased (Art. 17),
  • have processing restricted (Art. 18),
  • receive your data in a structured, machine-readable format (Art. 20),
  • object to processing based on legitimate interest, on grounds relating to your particular situation (Art. 21),
  • withdraw any consent at any time, with effect for the future (Art. 7(3)).

To exercise these rights, write to [email protected].

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work, or where the alleged infringement took place (Art. 77 GDPR).

13. Is providing data required?

No. You can use the site without providing personal data. An email address is needed only if you want to receive alerts or The Letter. The cost per wear calculator and every other tool work without one.

14. No automated decisions

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

15. Changes

We update this policy when the site or the law changes. The current version is always available on this page.