Privacy policy

Last updated: 15 November 2026

1. Who is responsible

The person named in the imprint, with the postal address given there. Email:[email protected].

2. Visiting this website

The site is served by Cloudflare Pages (Cloudflare, Inc., USA). To deliver pages, Cloudflare processes your IP address and the request itself. We do not keep access logs. Legal basis: Art. 6 (1) (f) GDPR, our interest in delivering the site securely. Cloudflare is certified under the EU–US Data Privacy Framework, and we have a data processing agreement with it.

The site sets no cookies, and it loads no fonts or scripts from third parties except Turnstile, described below. It counts no visits and uses no analytics. If you pick a language with the language switch, your browser remembers that choice in its local storage (localStorage); the value never leaves your browser. Without such a choice, the language follows your browser's language setting.

3. The waitlist

When you join the waitlist we store your email address and where you said you would want it to run. If you answer them, we also store your role, your company size, your monthly LLM spend band, the providers you use, and what you wrote about what you would want to see first; those questions are optional and an unanswered one is stored empty. We store how you reached the site (the referring website and campaign parameters in the link, if any), and the language you filled in the form in. We do not store your IP address.

We use this to plan the product and to email you about Plevsy. Legal basis: your consent, Art. 6 (1) (a) GDPR. You can withdraw it at any time with the link in every email or by writing to us; that deletes your entry.

Double opt-in. We send a confirmation link to the address given. Until it is clicked the entry is marked unconfirmed, and unconfirmed entries are deleted after 7 days. To be able to prove your consent we store when you signed up, when you confirmed, and which version of the consent wording you saw.

Storage. Entries are stored in Cloudflare D1 with EU data location. Confirmed entries are kept until you withdraw consent, and at most until six months after Plevsy launches.

Email. Emails are sent through Resend (Plus Five Five, Inc., USA). Resend processes your email address to deliver them, under a data processing agreement. Resend is certified under the EU–US Data Privacy Framework (adequacy decision, Art. 45 GDPR); the agreement also includes the EU standard contractual clauses (Art. 46 (2) (c) GDPR).

Spam protection

To keep bots out of the waitlist, the form uses Cloudflare Turnstile. It loads only when you scroll to the form. Turnstile processes your IP address and technical details of your browser to tell people from bots. Legal basis: Art. 6 (1) (f) GDPR, our interest in protecting the form from abuse. Turnstile sets no cookie here: the check yields a one-time token that is sent with the form and verified once. Reading these details from your browser is strictly necessary to provide the form you chose to use, so it needs no consent (§ 25 (2) no. 2 TDDDG). Cloudflare processes these signals for us as our processor, and as its own controller to improve its bot detection; it says it does not use them to identify, profile or target anyone. Cloudflare is certified under the EU–US Data Privacy Framework.

4. Interest in a paid tier

The form under the tiers sends what you enter straight to our control plane atapi.plevsy.com, which runs on OVHcloud in Germany, not to Cloudflare. We store your email address, the tier you chose, your note if you wrote one, and when you registered; registering again for the same tier replaces the note and the date. There is no account and no confirmation email: we write to the address once, when the tier is available, and that email says how the address came to be on the list and how to be removed.

To recognise a flood of registrations for what it is, we also keep your IP address and your browser's user agent, but only as a hash made with a secret key, so that the stored value cannot be matched against a list of addresses. The hashes are deleted 30 days after you last registered. The rest is kept until you ask us to delete it: write to [email protected]. Legal basis: for your email address, tier and note, your consent, Art. 6 (1) (a) GDPR, given by sending the form to be told when the tier is available; you can withdraw it at any time by writing to us. For the hashes, Art. 6 (1) (f) GDPR, our interest in keeping the list free of automated sign-ups.

5. Your rights

You have the right to:

• access the data we hold about you (Art. 15 GDPR),
• have it corrected (Art. 16) or deleted (Art. 17),
• restrict its processing (Art. 18),
• receive it in a portable format (Art. 20),
• object to processing based on Art. 6 (1) (f) (Art. 21),
• withdraw your consent at any time, without affecting processing before the withdrawal (Art. 7 (3)).

Write to [email protected]. You can also complain to a data protection supervisory authority, for example the one responsible for us: the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI), Lautenschlagerstraße 20, 70173 Stuttgart, baden-wuerttemberg.datenschutz.de.

We make no automated decisions about you.