Privacy Policy
Last updated:
1. Controller
The controller for data processing on circledeck.app is the natural person who decides on the purposes and means of processing:
Mika Brücke
Fritzlarer Str. 12
60487 Frankfurt am Main
Germany
E-mail: support@circledeck.app
WhatsApp (messages only): +61 407 725 147
2. Overview
On circledeck.app you can join the early-access list for the Circledeck app and answer an optional short survey. We process only the data described in this policy. The site does not set cookies and stores nothing in your browser's local storage. The legal bases are your consent (Art. 6(1)(a) GDPR), pre-contractual steps (Art. 6(1)(b) GDPR) and our legitimate interest in a secure, working website and in improving it (Art. 6(1)(f) GDPR). Each section states which basis applies.
3. Hosting and server logs (Vercel)
The site is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Server-side functions run in the Frankfurt region. Static content is delivered through Vercel's global network, so processing may also take place at other locations.
When you visit the site, Vercel processes technical data your browser transmits: IP address, date and time of the request, requested URL, referrer URL, browser type and version, operating system and host name. This is necessary to deliver and secure the site. The legal basis is Art. 6(1)(f) GDPR. Vercel keeps runtime logs only briefly (per Vercel's documentation up to one day on the Pro plan).
A data processing agreement under Art. 28 GDPR exists with Vercel and applies automatically with its terms under the Pro plan. Transfers to the USA rely on the EU Commission's standard contractual clauses. Vercel is also certified under the EU-US Data Privacy Framework.
4. Early-access sign-up and double opt-in
If you enter your e-mail address, we process: e-mail address, time of your consent, version of the consent text, a random confirmation token, time of confirmation, the page variant you saw, and the source and campaign parameters of the link you came from (utm_source, utm_medium, utm_content).
The purpose is to inform you by e-mail about the Circledeck launch, early access and short surveys. The legal basis is your consent, Art. 6(1)(a) GDPR. We use a double opt-in: you receive a confirmation e-mail and count as subscribed only after you click the link. We store the times and the version of the consent text to prove your consent (Art. 7(1) GDPR).
We delete unconfirmed sign-ups after 7 days. At MailerLite, final erasure can take up to 30 days after the deletion request. We keep confirmed sign-ups until you withdraw your consent. No later than 24 months after your confirmation, we will ask you by e-mail whether you still want to receive messages. If you do not confirm within 30 days, we delete your data.
You can withdraw consent at any time with effect for the future, for example via the unsubscribe link in every e-mail or by writing to support@circledeck.app. Processing before withdrawal remains lawful.
5. E-mail dispatch and performance measurement (MailerLite)
We send confirmation and information e-mails through MailerLite. As our processor, MailerLite processes your e-mail address and the custom fields variant and token. According to MailerLite the data is stored on Google Cloud servers in the EU; transfers to MailerLite, Inc. (USA) rely on standard contractual clauses. The data processing agreement applies automatically with MailerLite's terms.
Performance measurement: Our e-mails contain a tracking pixel and links so that we can see whether and when you open an e-mail and which links you click. IP address and device information may be processed as well. We use this to improve content and send times. The legal basis is your consent given at sign-up (Art. 6(1)(a) GDPR and § 25(1) TDDDG). Open and click measurement are permanently enabled on our side. If you unsubscribe or withdraw consent, measurement ends.
Suppression list: After you unsubscribe we may keep your e-mail address on a suppression list with us or with MailerLite so that you do not receive further e-mails. We use this data only for that purpose (legitimate interest, Art. 6(1)(f) GDPR). The storage is not limited in time. You can object if your interests prevail.
6. Optional survey
You may answer up to three optional questions, including free-text answers of up to 500 characters. Answers are linked to your sign-up through a token and stored in our database in Frankfurt. The legal basis is your consent by submitting voluntarily, Art. 6(1)(a) GDPR. Please do not enter sensitive data (for example health data) in free-text fields. We store answers until you withdraw consent or ask for deletion, at most 12 months.
7. Database (Supabase)
We store sign-up and survey data with Supabase (Frankfurt, EU region) as our processor. Access takes place only server-side. The contracting party is Supabase Pte. Ltd. (Singapore); the data processing agreement applies automatically with its terms. Supabase stores and processes the data primarily in the selected region; access from third countries cannot be fully excluded. Transfers are secured by the EU Commission's standard contractual clauses.
8. Anonymous usage statistics (PostHog, EU Cloud)
We use PostHog (EU Cloud, hosted in the EU) to understand how the site is used. We record page views, clicks on buttons and links outside the survey (including their label), clicks without a visible effect, whether a survey question was answered or skipped (only the question ID), whether the form was submitted, the page variant and web performance metrics. We do not record e-mail addresses, free-text input or session recordings. Your IP address is discarded and not stored. PostHog sets no cookies, no local storage and no profiles; every visit counts as a new anonymous visitor.
The legal basis is our legitimate interest in improving the site and the product (Art. 6(1)(f) GDPR). Data is stored for 12 months. You can object at any time with effect for the future (see section 13). PostHog Inc. (USA) is our processor, servers are in the EU. Access from the USA cannot be fully excluded; transfers are secured by standard contractual clauses. A data processing agreement with PostHog is in place.
9. Contact by e-mail and WhatsApp
If you write to us, we process your message, your contact details and anything you tell us in order to answer. The legal basis is Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR for contract-related requests. We do not pass this data on without your consent. E-mail runs through Namecheap Private Email (Namecheap, Inc., USA). According to Namecheap the servers are located in the USA (Phoenix). The data processing agreement is part of Namecheap's terms, and the transfer relies on the EU Commission's standard contractual clauses.
WhatsApp is provided by WhatsApp Ireland Limited, a Meta company. When you write to us, WhatsApp processes your phone number and message metadata. We do not use WhatsApp for marketing. We only reply to your message.
We delete correspondence once the matter is resolved unless statutory retention periods or claims require longer storage, at most after 3 years.
10. Fonts and external content
Fonts are delivered from our own server, no connection to Google servers is made. The site embeds no external content, maps or social media plugins.
11. Recipients and transfers to third countries
Recipients of your data, as stated above, are our service providers Vercel (hosting), Supabase (database), MailerLite (e-mail dispatch), PostHog (statistics), Namecheap (domain and mailbox). They process data only on our instructions. WhatsApp (messenger) is an independent service of WhatsApp Ireland Limited; if you write to us through it, its privacy policy applies. Beyond that we share data only if we are legally obliged to or you have consented. Where providers are based in the USA or can access data from there, the transfer relies on adequacy decisions (EU-US Data Privacy Framework, where the provider is certified) or standard contractual clauses.
12. Storage period
Unless a specific period is stated above, we store your data until the purpose ceases to apply. If you make a legitimate request for deletion or withdraw consent, we delete your data unless statutory retention duties prevent it.
13. Your rights
You have the right at any time to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), and the right to withdraw consent (Art. 7(3)). Write to support@circledeck.app.
You can demand restriction of processing if you contest the accuracy of the data, the processing is unlawful and you prefer restriction to erasure, we no longer need the data but you need it for legal claims, or you have objected and it is not yet clear whose interests prevail.
Right to object: Where we process data based on legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation. We will then stop processing unless we demonstrate compelling legitimate grounds or the processing serves to establish, exercise or defend legal claims. You can object to processing for direct marketing at any time without giving reasons.
Right to lodge a complaint: You can complain to a data protection supervisory authority, in particular the Hessian Commissioner for Data Protection and Freedom of Information in Wiesbaden or the authority at your place of residence or work.
14. Security
The site uses TLS encryption (recognisable by "https://" and the padlock icon). Transmission over the internet, for example by e-mail, may have security gaps, and complete protection against access by third parties is not possible.
15. Objection to advertising e-mails
We object to the use of contact details published in the legal notice for unsolicited advertising. We reserve the right to take legal action in the event of unsolicited advertising.
16. Obligation to provide data, automated decisions
Providing your e-mail address is voluntary but necessary to sign up. There is no automated decision-making and no profiling.
17. Changes
We update this policy when the site or the legal situation changes. The version published here applies.