Privacy policy for the website
Last updated: 21 September 2026
This policy covers this website and the waiting list. The Elody app is covered by the privacy policy for the app – in German.
We take the protection of your personal data seriously. This policy tells you which data we process in connection with the Elody waiting list and what rights you have.
1. Controller
The controller responsible for data processing is the operator named in the legal notice (Impressum).
2. What data we process
For the waiting list, we primarily process your email address. In addition, we store technical processing data needed for the procedure: the time of sign-up and of confirmation, the confirmation status, your position in the order of confirmed sign-ups and – as proof of your consent under Art. 7(1) of the EU General Data Protection Regulation (GDPR) – the wording, version and language of the consent text you agreed to. We do not store IP addresses in this process.
For access to protected areas of the site, we use strictly necessary cookies that expire after 30 days at the latest (see section 11) – no marketing or tracking cookies. To protect against misuse (spam, automated requests), we also process your IP address: for rate limiting, it is used only briefly and in truncated, hashed form, and we use the bot protection service Cloudflare Turnstile, which processes your IP address for verification (see section 6). No further tracking or analysis of your usage behaviour (e.g. via web analytics tools or advertising cookies) takes place.
Language choice: If you switch the language via EN/DE, we remember your choice in a strictly necessary cookie named “sprache”. It contains only “de” or “en”, lasts one year and is not used for tracking (Section 25(2) no. 2 TDDDG). Without this cookie, the language follows the language setting your browser sends – we do not use your IP address for this.
3. Purpose of processing
The processing serves to add you to the waiting list, to inform you about the launch of the Elody app and to run the “3 months of Premium free” promotion for the first participants.
4. Legal basis
The legal basis is your consent under Art. 6(1)(a) GDPR. We obtain it using the double opt-in procedure: after you sign up, you receive an email with a confirmation link; your sign-up only becomes effective once you have clicked it.
5. Storage period
We store your data until you withdraw your consent, but no longer than until the launch promotion has ended. After that, it is deleted. Unconfirmed sign-ups are deleted automatically once the confirmation link has expired. If you unsubscribe, we keep your address only with a suppression flag, so that you reliably receive no further emails from us (legal basis: Art. 6(1)(f) GDPR – proof and technical implementation of your withdrawal); on request, we will also delete this entry completely.
6. Recipients and processors
We use the following service providers: the data is stored in a database provided by Supabase in the Frankfurt region (EU). The website is hosted by Vercel (server functions in the Frankfurt region). To send the confirmation and waiting list emails, we use the email service provider Resend (sending via EU infrastructure). For bot protection on the sign-up form, we use Cloudflare Turnstile; in doing so, Cloudflare processes your IP address to check whether the request comes from a human. For rate limiting, we use Upstash; your IP address reaches Upstash only in truncated and hashed form, short-lived and without any link to your email address. We have data processing agreements with these providers under Art. 28 GDPR. Your data is not passed on to third parties beyond this.
7. Processing in the EU and transfers to the USA
Your email address is stored in the European Union: the database runs in the Frankfurt region, and the server functions that process and store your input run there as well. Every request to the website – including submitting a form – first reaches the nearest location of Vercel’s global network. There, technical connection data (e.g. your IP address) is processed and the request is forwarded to Frankfurt.
When sending emails, however, your address and the message text are transferred to Resend (Plus Five Five, Inc., San Francisco, USA) – sending is requested via a US interface, while the actual delivery takes place via European infrastructure. Vercel (hosting), Cloudflare (bot protection) and Upstash (rate limiting) are also US companies and may process technical connection data in the USA.
These transfers are safeguarded by the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR); Resend is additionally certified under the EU-US Data Privacy Framework (Art. 45 GDPR). That said, we want to be honest with you: the USA does not have a level of data protection comparable to that of the EU, and access by US authorities cannot be completely ruled out.
8. Your rights
Under the GDPR, you have the following rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can exercise these rights via the contact address given in the legal notice (Impressum).
9. Withdrawing your consent
You can withdraw your consent at any time with effect for the future. This does not affect the lawfulness of the processing carried out before the withdrawal. The easiest way is to use the unsubscribe link included in every waiting list email; alternatively, an informal message to the address given in the legal notice (Impressum) is sufficient.
10. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority – in particular with the authority responsible for your place of residence or for the controller’s place of business.
11. Closed test feedback channel (beta)
We offer a closed feedback channel for selected, invited test participants. The following data is processed: your email address (as an identifier for attribution and for follow-up questions), an automatically assigned pseudonym and the messages you send (text and time). Other participants see only your pseudonym, your text and the time – not your identity. The operator can see which pseudonym belongs to which identifier (for evaluation and moderation).
The legal basis is your consent (Art. 6(1)(a) GDPR), which you give when joining and can withdraw at any time with effect for the future. Storage period: messages are deleted automatically after 90 days at the latest; individual messages and your access can be removed at any time at your request or by the operator. For access, we use a strictly necessary cookie that expires after 30 days (no tracking); to protect against misuse, we process your IP address only in truncated, hashed form. The access email is delivered via our email service provider; no advertising emails are sent via this channel.
12. Idea form and voting on the homepage
On the homepage, you can submit a suggestion under “Your idea counts”. In doing so, we process the text you write (up to 1,000 characters), your email address for assigning any prize (a free month of Premium) and for follow-up questions, the time, the approval status and the wording, version and language of the consent text. Please do not enter any sensitive information or data about other people in the free-text field.
Approved ideas appear in the public list without your email address. For voting, we store a truncated and hashed form of your IP address with each vote – your IP address cannot be derived from it; it is used solely to detect multiple votes and is stored persistently for as long as the vote is running.
The legal basis is your consent (Art. 6(1)(a) GDPR), which you give when submitting and can withdraw at any time with effect for the future; for the voting hash, additionally our legitimate interest in a vote free from manipulation (Art. 6(1)(f) GDPR). If you send an informal message to the address given in the legal notice (Impressum), we will delete your idea and the associated email address.