Privacy policy

1. Who is responsible

The controller under the General Data Protection Regulation (GDPR) is:

We have not appointed a data protection officer because we are not legally required to. For any privacy question, write to the address above.

2. Visiting this website

This website is delivered through the network of Cloudflare, Inc. To deliver the pages and protect them against attacks, Cloudflare processes connection data: your IP address, the date and time, the requested address, the referring page and technical details of your browser.

Legal basis is our legitimate interest in a secure and reliable website (Art. 6 (1) (f) GDPR). We do not use Cloudflare Web Analytics or any other analytics service.

3. Joining the waitlist

What we store

• your email address,
• where on the page you signed up (for example “hero”),
• how you found the waitlist: the page with the form, the website that linked to it (only its domain; for links within this website also the page) and campaign tags in the link you followed (utm_source, utm_medium, utm_campaign),
• the version of the consent text you saw,
• when you signed up, when we sent the confirmation email and how often, when you confirmed and, if you do, when you unsubscribed.

Why and on what legal basis

We use your email address only to tell you about the launch of Metriloft and about early access. Legal basis is your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time with effect for the future.

We use the information on how you found the waitlist only in counted form, to see which pages and channels bring people to the waitlist. Your browser sends it once together with the form; nothing is stored in your browser for this. Legal basis is our legitimate interest in understanding which of our pages and channels work (Art. 6 (1) (f) GDPR). It is deleted together with your entry.

Double opt-in

After you sign up, we send one email with a confirmation link. Only after you click it do you receive further emails. If you do not confirm, we never email you again. The dates of sign-up and confirmation prove that you gave your consent (Art. 7 (1) GDPR).

How long we keep it

• Unconfirmed sign-ups are deleted automatically after 30 days.
• Confirmed addresses are kept until you unsubscribe or until we no longer need the waitlist after the launch.
• After you unsubscribe we keep your address with the dates of your consent and your withdrawal for three years, only to be able to prove both. Then it is deleted automatically. Legal basis is our legitimate interest in proving compliance (Art. 6 (1) (f) GDPR).

Protection against abuse

To stop automated sign-ups, we limit how many requests one connection can send per hour. For this we store a keyed one-way hash of your IP address in a counter, never the IP address itself. The counters are deleted automatically within about one day. Legal basis is our legitimate interest in protecting the waitlist (Art. 6 (1) (f) GDPR).

4. Emails we send

We send the confirmation email and, after you confirm, emails about the launch and early access. Our emails contain no tracking pixels and no tracked links. Every email has an unsubscribe link, and your email app can also unsubscribe you with one click.

5. Service providers

We use the following providers, who process data only on our behalf and according to our instructions (Art. 28 GDPR):

• Cloudflare, Inc. delivers and protects this website.
• Supabase, Inc. runs our database and the server functions of the waitlist. The data is stored in Frankfurt, Germany. When you sign up, confirm or unsubscribe, your browser connects directly to Supabase, which processes your IP address to answer the request.
• Amazon Web Services EMEA SARL sends our emails through Amazon Simple Email Service in the Frankfurt region.

Some of these providers belong to companies based in the United States, so personal data may be accessed from there. Such transfers are based on the EU-U.S. Data Privacy Framework where the provider is certified under it, and otherwise on the EU Standard Contractual Clauses.

6. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16) or deleted (Art. 17), to restrict its processing (Art. 18), to receive it in a portable format (Art. 20) and to object to processing based on legitimate interest (Art. 21). You can withdraw your consent at any time (Art. 7 (3)), most easily with the unsubscribe link in any of our emails. Write to info@kstaq.de for anything else.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).

We do not use automated decision-making or profiling.

7. Changes

We update this policy when our website or our services change. The date at the top shows the current version.