privacy

Controller

The controller responsible for data processing on this site is Tim Thaddeus Gelhard (trading as Achron). Contact: [email protected]. Full operator and postal details are listed in the legal notice.

Server log data

When you visit the site our hosting/edge providers process technical data (IP address, request time, requested page, user agent) to deliver pages and protect against abuse. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning service).

Contact & waitlist forms

If you submit the contact form we process the data you provide (the request category, your message, your email address, and an optional name) to respond to you and keep a record of the inquiry. If you join a product waitlist we process your email address to notify you when that product opens.

Your IP address is hashed before storage and never logged in raw form. Legal basis: Art. 6(1)(b) GDPR (steps prior to a contract / responding to your request) and/or Art. 6(1)(a) GDPR (consent) where applicable.

Bot protection (Cloudflare Turnstile)

Public form submissions are checked by Cloudflare Turnstile, a privacy-friendly, cookieless bot-protection challenge, to prevent spam and abuse. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting the service).

Analytics (cookieless)

We use Cloudflare Web Analytics, which is cookieless and does not track individuals across sites or build advertising profiles. Because it sets no cookies and does not use device fingerprinting for tracking, no cookie-consent banner is required. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding aggregate site usage).

We also use PostHog (EU region) for product analytics — to understand which pages and features are used and how form submissions convert. It is configured without cookies and without persistent device identifiers (memory-only, no cross-session or cross-site tracking, no advertising profiles), and session recording is disabled, so no cookie-consent banner is required. Events record non-identifying facts only (e.g. which product, which inquiry category) — never your email, name, or message. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding aggregate site usage).

Processors we use

We use the following service providers as processors. Each handles data only on our instructions, under that provider's data-processing agreement; where a provider processes data outside the EU, it does so under the EU Standard Contractual Clauses.

• Hetzner Online GmbH — Server hosting (origin VPS) (EU (Germany)).
• Supabase — Postgres database (contact + waitlist records) (EU region).
• Resend — Transactional + confirmation email (send-only) (USA, under SCCs).
• Cloudflare, Inc. — DNS, reverse proxy, WAF/DDoS, Turnstile (bot check), Web Analytics (cookieless) (global edge; EU data options, under SCCs).
• PostHog — Product analytics (cookieless, aggregate usage + events) (EU (eu.posthog.com)).

Retention

Contact inquiries: kept for up to 12 months after we have finished handling your message, then deleted.

Waitlist entries: kept until the relevant product launches and we have notified you, or until you ask to be removed — whichever comes first. Entries for products that do not launch are deleted within 18 months.

Server logs: retained only briefly by our hosting and edge providers for security, then rotated.

Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing. Where processing is based on consent, you may withdraw it at any time. To exercise any of these, contact us at the email above.

You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).