Waitlist privacy notice

Aun Amer Abdelrahman Al Atiat, Researium, Str des Bergmanns 1, 01968 Senftenberg, Deutschland / Germany. For privacy requests: [email protected], +49 163 2063888.

This notice covers the public website and waitlist. We collect your email address, language, signup page, request, confirmation and unsubscribe timestamps, separate product-news choice and consent-text version. Confirmation links contain random, expiring tokens; the database stores their hashes. Public account registration, payments, file uploads and AI processing are unavailable during this phase.

With your consent, after email confirmation we send one product-launch email (GDPR Art. 6(1)(a), § 7 UWG). Occasional product news requires a separate, optional consent. You can withdraw either consent at any time using the link in each email or by contacting us, without affecting earlier lawful processing. Providing data is voluntary; without an email and confirmation you receive no messages. You can still browse the website.

Hosting and security services process technical data such as IP address, timestamp, URL and browser information for delivery, security and troubleshooting (GDPR Art. 6(1)(f); our interest is a secure, functioning service). Our API rate limiter briefly holds IP addresses in memory. We handle support enquiries to respond to your request (Art. 6(1)(b) or (f)). We do not use automated decisions with legal or similarly significant effects, or advertising profiling.

We use DigitalOcean for the website and API in Frankfurt, Supabase for the database and operator authentication, Cloudflare for DNS, the security proxy and private R2 backups, and Resend for email delivery. GitHub Actions runs automated deployment and backup/restore tasks; database exports may be processed briefly in isolated runners before encryption. Email data also reaches your chosen mailbox provider.

These providers and their subprocessors may process data outside the EEA, including in the United States and Singapore. Their processing agreements and, where required, EU Standard Contractual Clauses or applicable adequacy decisions govern processing and transfers. You can contact us for information and copies of relevant safeguards. We do not claim that all processing takes place in Europe.

DigitalOcean DPASupabase DPACloudflare DPAResend DPAGitHub DPA

Confirmation links expire after 48 hours. Unconfirmed requests are deleted seven days after the last request. Confirmed entries are retained for no more than twelve months after confirmation and reviewed again at launch. Unsubscribing stops messages immediately; contact data is removed within seven days. “Delete waitlist data” requests immediate deletion from the active database. Encrypted daily backups expire after seven days. Erasure records without email addresses are retained for up to 30 days to replay deletions after recovery. Records needed for legal obligations or a specific legal claim may be kept longer to the extent necessary.

Error logs do not intentionally record email content or confirmation links. Our container logs have size and count limits and are removed after at most seven days. Providers retain security and delivery logs according to their contractual periods; see the linked agreements or contact us for details. We normally delete support correspondence six months after resolution unless a longer duty applies.

The public waitlist uses no advertising or analytics cookies and no email open-tracking pixels. A light/dark preference you choose is stored locally. Operator sign-in uses necessary session cookies. These functions serve the display or sign-in you request (§ 25(2) TDDDG); nonessential storage or tracking requires separate prior consent.

Subject to the GDPR, you have rights of access, correction, deletion, restriction and portability. You can object to legitimate-interest processing because of your particular situation, and to direct marketing at any time. You can withdraw consent at any time. Contact [email protected]. We normally respond within one month and inform you of any justified extension. You can complain to a data protection authority, including where you live or work, or the Brandenburg Commissioner for Data Protection and Access to Information (LDA Brandenburg).