Privacy notice
Last updated: 4 November 2026
1. Who is responsible
Tom Gebauer, Marburger Tor 18, 57072 Siegen, Germany. Email: tom@alpscreen.de.
I am a sole trader in Germany. I have not appointed a data protection officer; the law does not require one at this size.
This notice covers this website (subrules.alpscreen.de), the free check and the waitlist.
2. What I process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR and UK GDPR) |
|---|---|---|
| Your email address, company domain and your two answers ("Stripe Billing: yes/no", "UK consumers: yes/no") | Keep you on the waitlist, judge whether the product is worth building, and email you once when early access opens | Your consent, Art. 6(1)(a) |
| Version of the consent text you agreed to, time of sign-up, time of confirmation | Prove that you gave consent (double opt-in record) | Legitimate interest in being able to prove consent, Art. 6(1)(f) together with Art. 7(1) |
| Your IP address and technical request data (browser type, requested page, time) | Deliver this website and protect it against attacks. Processed by my hosting provider Cloudflare; I do not store it | Legitimate interest in a secure, working website, Art. 6(1)(f) |
| A daily counter, keyed by a salted hash of your IP address and the date | Limit sign-ups to 5 per address and day, so nobody can flood other people's inboxes with confirmation emails. The IP address itself is not stored. The hash is pseudonymised data, not anonymous data | Legitimate interest in preventing abuse, Art. 6(1)(f) |
| Sending records at my email provider (recipient address, time, delivery status, and possibly whether a link was clicked) | Send the emails and find delivery errors | Legitimate interest in reliable delivery, Art. 6(1)(f) |
| Contact form (Kontaktformular): your name, email address and message | Read your message and answer it. The form forwards it by email to me through Brevo; I do not store it on this website. Only a daily counter keyed by a salted hash of your IP address and the date (3 messages per address and day, kept 2 days) is held to prevent abuse. A copy of the message stays in my mailbox for as long as needed to answer you and is then deleted | Your request and my answer, Art. 6(1)(b) if you ask about a contract, otherwise legitimate interest in answering enquiries, Art. 6(1)(f) |
The free check on this site runs only in your browser. Your answers there are not sent to me or to anyone else.
Giving your data is voluntary. There is no legal or contractual duty to do so. Without email, domain and the two answers I cannot add you to the waitlist. I do not use automated decision-making or profiling.
3. How the double opt-in works
- You submit the form. I store a pending entry and send you one email with a confirmation link and a deletion link. This email contains no advertising.
- The links contain random tokens. I store the tokens only as SHA-256 hashes.
- If you do not confirm within 48 hours, the pending entry and its tokens are deleted automatically.
- When you confirm, I store the time of confirmation with your entry.
- If you sign up again before confirming, the old links stop working and you get a new email. If you are already confirmed, nothing happens.
4. Service providers (processors)
Both providers process the data only on my instructions, under a data processing agreement (Art. 28 GDPR / UK GDPR).
Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA — hosts this website (Cloudflare Pages), runs the sign-up functions and stores the waitlist (Workers KV).
- Contract: Cloudflare Data Processing Addendum, part of the Cloudflare subscription terms.
- Location: Cloudflare runs a worldwide network. The waitlist is stored in the European Union; copies can be cached temporarily in Cloudflare data centres outside the EU.
- Transfers outside the EU/UK: Cloudflare takes part in the EU-U.S. Data Privacy Framework and its UK Extension (adequacy decision of the European Commission, Art. 45 GDPR; UK adequacy regulations). In addition, the EU Standard Contractual Clauses and the UK Addendum in Cloudflare's agreement apply (Art. 46(2)(c) GDPR).
Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany (part of the Brevo group, Paris) — sends the confirmation email and the early-access email, and forwards messages from the contact form to me.
- Contract: Brevo Data Processing Agreement, Appendix 3 of the Brevo Terms of Service.
- Location: Brevo hosts customer data in France and Belgium. Some of Brevo's sub-processors are in the USA (for example for its network protection and its support tool); for these Brevo relies on the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses.
Data between the UK and the EU: the European Commission has found that the UK protects personal data adequately (renewed decision of December 2025, valid until December 2031), and UK law treats the EU in the same way.
I do not sell your data, share it for advertising, or pass it to anyone else, unless a law obliges me to.
5. How long I keep data
| Data | Kept until |
|---|---|
| Unconfirmed entry and its tokens | 48 hours, then deleted automatically |
| Confirmed entry (incl. consent record) | Until I have sent the early-access email, or until I decide not to build the product (then I delete the list without further emails). At the latest 12 months after your confirmation, when it expires automatically |
| Your entry after you click the deletion link | Deleted at once and completely, including the consent record |
| Daily abuse counter | 2 days |
| Sending records at Brevo | Until the retention period I set in my Brevo account ends (the shortest period Brevo offers) |
| Technical request data at Cloudflare | Only as long as Cloudflare needs it to deliver and protect the site. I have not switched on any analytics or log export |
6. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21) — under the GDPR and the UK GDPR alike. You can withdraw your consent at any time with the deletion link in every email or by writing to me; this does not affect processing before the withdrawal (Art. 7(3)).
To use your rights, or to complain to me about how I handle your data, write to tom@alpscreen.de. I confirm receipt of a complaint within 30 days and answer without undue delay.
7. Complaints to a supervisory authority
You can complain to a data protection authority, in particular in the country where you live or work. The authority responsible for me is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Postfach 20 04 44, 40102 Düsseldorf, Germany, www.ldi.nrw.de. In the UK you can complain to the Information Commissioner's Office (ico.org.uk).
8. Cookies and third-party content
This site sets no cookies, uses no analytics or tracking and loads nothing from third parties. The bot check "Turnstile" is not switched on. If it is switched on later, this notice will be updated first.
9. Changes
If the processing changes, I update this notice and the date at the top. If you are on the waitlist and a change needs your consent, I will ask for it.