The short version
Advertising without scripts or cookies. The site shows partner banners for Lenovo, Ticombo, Alibaba.com, Govee, REDMAGIC, Geekbuying, TTGO, Homestyler, Turbo VPN, Gshopper, Noracora, Justfashionnow and StyleWe. Your browser loads the image from Admitad's server, which counts the impression and sees your IP address. No script or cookie of the network is in the page. That needs no consent, and the dialogue does not ask for it.
Reach measurement only with consent. The site measures its reach with Google Analytics, and that needs your consent, which it does not get in advance.
Nothing is loaded without your consent. Not "loaded but held back": while there is no answer, the server delivers the page without the measurement tag. What is not in the page cannot store anything on your device.
Your choice. You can allow the measurement or refuse it. Refusing is as quick as accepting - one click, same size of button. You can change or withdraw it at any time via "Cookie settings" in the footer.
Who asks. We do, in our own window. Your answer sits in our own cookie, and the server reads it to decide what it delivers.
Beyond that, the site behaves like this: no external fonts, no user account, no newsletter. A cookie-free reach measurement of our own runs in addition; what it counts is described below.
There is a contact form - voluntary, and only if you use it. What you enter there goes to our ticket system; the "Contact form" section below says to whom, what for and for how long.
The legal pages themselves (legal notice, this policy) and the contact form are excluded from measurement: nobody should be counted while reading how their data is processed.
Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Nikolas Gottschalk
Sonnenhof 150
53119 Bonn
Deutschland
Email: azerothbase-sl0rwx@1stlevel.tech
Server log files
When you open this site, your browser automatically transmits data that the hosting provider stores in log files:
- the address requested
- date and time of the request
- amount of data transferred and HTTP status code
- the previously visited page (referrer), if your browser sends it
- browser type and version, and operating system
- the IP address
Purpose: delivering the site, operational security and troubleshooting.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in operating the website securely and without errors.
Retention: log files are deleted after 7 days. The IP address is not combined with other data and is not used to identify individuals.
This processing happens regardless of your choice - without it the site could not be delivered at all.
Hosting and delivery
The website runs on Laravel Cloud, operated by Laravel Holdings, Inc., Mohnton, Pennsylvania, USA, on Amazon Web Services infrastructure. In front of it sits a content delivery network operated by Cloudflare, Inc., San Francisco, USA, through which all requests pass.
Both process the access data described above on our behalf under Art. 28 GDPR.
Transfers to third countries: both providers are based in the USA. This is based on the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR; both are additionally certified under the EU-US Data Privacy Framework. A residual risk remains: US authorities could access data without a remedy fully meeting European standards being available.
Security network cookie
Cloudflare sets a single cookie when you open the site, __cf_bm, with a
lifetime of 30 minutes. It distinguishes human visitors from automated
requests and thereby fends off attacks and abusive access. It carries no
identifier that would allow your behaviour to be tracked across websites, and
it is not used for advertising or analytics.
This cookie is set regardless of your choice - including when you decline, and including on this page. It is strictly necessary for operation under § 25(2)(2) TDDDG and therefore needs no consent; the processing relies on Art. 6(1)(f) GDPR and our legitimate interest in operating the site securely.
Our own reach measurement
We count how often each page is requested and whether the request came from a human or a bot. This runs without cookies, without an external service and without storing IP addresses, entirely on our own server and regardless of your choice - no connection to an external analytics service is made for it.
Google Analytics is a separate matter: it is an external service, runs only with your consent, and is described below under "Reach measurement with Google Analytics".
What is stored: daily counters on our own server only - number of views per page, browser or bot name, language version, hour of access and, if your browser sends one, the domain of the referring site (not the full URL, so that search terms are not stored).
Added to that is the country of origin as a two-letter code (for example "DE"), and only for human visits. Our content delivery network already sends that code along with the request. We ask no geolocation service, we do not evaluate your IP address for it, and we pass it to nobody. What gets stored is a daily counter per country - "this many views came from Germany on this day", not who came from there. If the network sends no code, nothing is stored.
What is not stored: your IP address, the full user agent, the full referrer URL, your city or any region below country level.
Recognition: to count how many distinct visitors a day had, we derive an identifier from IP address and user agent during the request. Its salt changes daily, so it cannot be followed across two days, and it is deleted after 2 days by a job that runs automatically every night. After that only numbers without any personal reference remain.
Storage location: the counters live in a MySQL database in the Frankfurt am Main (eu-central-1) region. The statistics data therefore does not leave the European Union.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is understanding which content gets read and how much of the traffic is bots. § 25 TDDDG does not apply because no information is stored on or read from your device.
Objection: you may object to this processing under Art. 21 GDPR at any time - an informal email to azerothbase-sl0rwx@1stlevel.tech is enough.
Saved builds
The talent calculator lets you file a talent distribution under a name. It then appears publicly in the build library of that class. This only happens if you fill in the form and submit it - simply using the calculator leaves nothing here.
What is stored: the class, the talent code, the name you gave it, your comment, a counter of how often the distribution has been opened, and the time of the entry.
What is not stored: your IP address, an identifier, an account or a session. Submitting sets no cookie. Two entries by the same person cannot be recognised as such afterwards.
Please note: name and comment are free text and visible to everyone. Do not enter anything that points to you or to others - no real or character names, no contact details. What you write there is your choice; we do not review entries for content beforehand.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a public collection of talent distributions that comes from the players themselves. Providing it is voluntary; without it you can keep using the calculator in full.
Retention: entries stay for as long as the library exists - they are its content.
Deletion: because there is no account, we cannot attribute an entry to you. Write to azerothbase-sl0rwx@1stlevel.tech naming the class and the entry, and we will delete it.
Contact form
The contact form lets you write to us. This is voluntary: simply reading the site leaves nothing here, and the email address in the legal notice remains as an alternative route.
What is processed: your email address, the subject, your message and - if you enter one - your name. The name is optional; the message is handled just the same without it.
Where it goes: every message is filed as a ticket in the helpdesk 1stlevel.tech. The provider processes the data on our behalf on servers in the EU; a data processing agreement under Art. 28 GDPR is in place. The reply comes from that same system.
Legal basis: Art. 6(1)(a) GDPR - your consent, given with the checkbox in the form. Where the message concerns a contract or a pre-contractual enquiry, Art. 6(1)(b) GDPR applies alongside it. You can withdraw your consent at any time with effect for the future; this does not affect the handling of a message already sent.
What is not collected: the form does not store your IP address, sets no cookie and creates no account. The rate limit against bulk submissions works in memory and keeps nothing.
Buffer during outages: if the ticket system does not respond at the moment you submit, the message stays on our server until it can be delivered - for no longer than 30 days. After that it is deleted, even if delivery never succeeded. In the normal case this buffer never comes into being.
Retention in the ticket system: tickets remain for as long as the matter is being handled, and beyond that for as long as statutory retention periods require. Then they are deleted.
Deletion: write to azerothbase-sl0rwx@1stlevel.tech and we will delete your ticket, unless a retention obligation stands in the way.
Advertising
Since 9 October 2026 the site shows partner banners, placed through the affiliate network Admitad (Admitad GmbH, Heinz-Nixdorf-Straße 6, 74172 Neckarsulm, Germany). Since 17 October 2026 several advertisers take turns: Lenovo, Ticombo, Alibaba.com, Govee, REDMAGIC, Geekbuying, TTGO, Homestyler, Turbo VPN, Gshopper, Noracora, Justfashionnow and StyleWe. Each banner is visibly labelled Advertisement. No ad tag - no script from an ad network - is delivered with any page.
Showing a banner goes to Admitad. Your browser loads the image from Admitad's server (ad.admitad.com), which counts the impression. Like any request to another server, it carries your IP address, your browser's identifier (user agent) and the page the banner is on. We put no script or cookie in the page for it. Legal basis: our legitimate interest in funding the site through commission, Art. 6(1)(f) GDPR. An ad blocker suppresses the request. We count none of it ourselves.
Which banner appears is drawn anew on every page view; no advertiser appears twice on one page. The country you visit from has a say: some advertisers have creatives in several languages, and some advertise only in certain countries. Cloudflare (see "Hosting and delivery") supplies the country as a two-letter code with every request. We use it only to pick the advertiser and creative and pass it on to no one.
If you click one, the link leads straight to Admitad's tracking address (bednari.com, for example). Like any request to another address, your browser sends along your IP address, your browser's identifier (user agent) and the page you clicked on. Admitad records the click and forwards you, in some cases through the advertiser's own affiliate system, to its shop. Our server takes no part in the click. From that point Admitad and the advertiser process your data as controllers in their own right, under their own privacy notices (Admitad's). We receive only totals of clicks and commissions, nothing that identifies you. Legal basis for the link to Admitad: our legitimate interest in funding the site through commission, Art. 6(1)(f) GDPR.
Before: Until 27 September 2026 ads ran through Google AdSense, and from then until 1 October 2026 through Adsterra (AD MARKET LIMITED, Limassol, Cyprus, together with ADMEDIA LLC FZ, United Arab Emirates). Both have ended. Consent you gave for advertising during that time no longer has any effect, and the consent dialogue no longer asks about advertising. Identifiers that Adsterra stored in your browser while it ran can be removed through your browser's cookie settings; how long Adsterra keeps data on its side is set out in its own notice at https://adsterra.com/privacy-policy/.
Should an ad network with its own script return, this policy will name the provider first and the consent dialogue will ask again - an earlier agreement does not cover a new provider.
Reach measurement with Google Analytics
The tag only loads once you have consented. It used to sit in every page with its default state set to "denied", sending a cookieless signal before you were asked. That is over: the server reads your decision from the cookie and builds the page accordingly. Without consent the page contains no Google tag, no connection to Google and therefore no signal either.
Two states are therefore possible:
- No decision yet, or rejected: no tag, no connection, no storage.
- Accepted: the tag is delivered and Google sets the cookies named below.
Your decision lives in a cookie of our own (see "Storing your choice") which the server reads on every request. Whoever consented is counted from the next page build; whoever declined is not counted at all.
The legal notice, this policy and the contact form are never measured.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing takes place jointly with Google LLC, 1600 Amphitheatre Parkway, Mountain View, California, USA. Privacy policy: https://policies.google.com/privacy
Purpose: understanding how the site is used - which content gets read, how visitors arrive and where they drop off. The analysis helps us decide which content to expand.
What is processed: the pages you open and when, the referring address, an
approximate location (country or region level, derived from your IP address),
device, operating system, browser, screen and language settings, plus
pseudonymous identifiers Google stores in cookies (_ga, _ga_<property ID>)
and in your browser's local storage. In Google Analytics 4 Google truncates the
IP address before storing it; it is not retained there permanently.
Property used: G-DZZSDVQVH3.
Legal basis: your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. There is no second basis any more and none is needed: before your consent no processing takes place, because nothing is loaded.
Retention: the cookies expire after two years at the latest. How long event data is kept in the property depends on its setting; Google offers two or fourteen months.
Transfers to third countries: Google also processes data in the USA. The basis is the European Commission's adequacy decision on the EU-US Data Privacy Framework, to which Google LLC has self-certified, supplemented by the standard contractual clauses under Art. 46(2)(c) GDPR. A residual risk remains: US authorities may access data under certain conditions. By consenting you accept that explicitly.
Withdrawing consent: at any time via the "Cookie settings" link in the footer. No measurement is loaded after that. The lawfulness of processing up to the withdrawal is unaffected (Art. 7(3) GDPR). Cookies already set can be deleted in your browser settings. Google also offers a browser add-on that prevents collection: https://tools.google.com/dlpage/gaoptout
Storing your choice
So that you are not asked again on every page view, we store your decision in
a cookie of our own called azb_consent. It holds only the decision itself, a
timestamp and a version number - no identifier that makes you recognisable,
and nothing that goes to a third party.
This used to live in the browser's local storage. It became a cookie because the server has to read your decision: only then can it leave the measurement tag out of the page in the first place, instead of delivering it and holding it back afterwards.
This storage is strictly necessary under § 25(2)(2) TDDDG to provide the service you asked for and therefore needs no consent of its own. It lasts six months; after that you are asked again. If purposes or providers change, we raise the version number and ask again straight away - an earlier agreement does not cover a new purpose.
Fonts
The fonts used (Cinzel and Inter) are stored on our own server and served from there. No connection is made to Google Fonts or any other external provider.
External links
This site links to external sources such as Blizzard, Wowhead and YouTube. Those links only become active when you click them. Only then does the respective provider receive your IP address and can set its own cookies. No third-party content (videos, maps, social media buttons) is embedded in the site in a way that would transmit data on page load.
Your rights
You have the right at any time to:
- access the data stored about you (Art. 15 GDPR)
- rectification of inaccurate data (Art. 16 GDPR)
- erasure (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- object to processing based on legitimate interests (Art. 21 GDPR)
- withdraw consent with effect for the future (Art. 7(3) GDPR)
An informal email to azerothbase-sl0rwx@1stlevel.tech is enough for any of these.
Right to lodge a complaint
If you believe that the processing of your data infringes the GDPR, you may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is the one in the German state where the controller is based, or the authority where you reside.
Automated decisions and profiling
No automated decisions producing legal effects within the meaning of Art. 22 GDPR take place.
No advertising profile is built: the partner banners depend only on the country of the request, not on you, and nothing about it is kept. Google Analytics evaluates how this site is used but makes no decision about you.
Changes
If the site changes technically - by adding another external service or a search function - this policy will be updated and consent obtained again. The date above shows the current version.