Privacy Policy

1. Controller

The controller responsible for data processing on this website under the GDPR is:
[TODO: Name and address of the controller (see Imprint)]
Email: [TODO: Contact email address]

2. What we collect for the waitlist

When you join the waitlist, we collect: your email address (required), optionally your first name, your consent, and the time of signup. To prevent abuse and spam, we also briefly process your IP address (Cloudflare Turnstile for bot detection, and a simple counter that limits repeated attempts and is automatically deleted after 10 minutes).

3. Purpose and legal basis

We process your email address (and optional first name) to send you emails about Evrly's launch. The legal basis is your explicit consent (Art. 6(1)(a) GDPR), given via the unchecked checkbox in the signup form, which you can withdraw at any time with future effect (see section 7). The brief processing of your IP address for spam and abuse prevention relies on our legitimate interest in a working, abuse-free signup form (Art. 6(1)(f) GDPR).

4. Double opt-in

After you sign up, we send you an email with a confirmation link. Your signup only becomes active once you click that link, moving your status from "pending" to "confirmed" — this ensures nobody can sign up an email address that isn't theirs.

5. Retention

We keep your signup data for as long as the waitlist is active, or until you unsubscribe. [TODO: Define a concrete deletion period after the waitlist ends / product launches]

6. Recipients and processors

We use the following service providers to run this site:

• Cloudflare, Inc. — hosting, database (Cloudflare D1), bot detection (Turnstile), optionally Cloudflare Web Analytics (cookieless, aggregate). Cloudflare acts as a processor under Art. 28 GDPR. [TODO: Execute a data processing agreement (DPA) with Cloudflare and confirm/configure an EU data location for D1/KV]
• Resend — sends the confirmation and waitlist emails. [TODO: Execute a DPA with Resend and confirm the sending region]
• Sanity — content management for this site's editorial copy (e.g. headlines). Sanity does not receive any personal data from site visitors or waitlist signups.

7. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21) regarding your personal data. You can withdraw your consent at any time, informally — for example via the unsubscribe link in any email, or by messaging [TODO: contact email address]. You also have the right to lodge a complaint with a data protection supervisory authority, e.g. [TODO: the responsible German state data protection authority].

8. Cookies

This website does not set non-essential cookies. Cloudflare Turnstile and Cloudflare Web Analytics (if enabled) operate without cookies.

9. Security

Data in transit is encrypted (TLS). Credentials and tokens are never logged in plain text.