Privacy policy

This policy explains, in plain language, which personal data we process when you visit this website or join the Swarmli waitlist, why, on which legal basis, for how long, and which rights you have. It follows the General Data Protection Regulation (EU) 2016/679 (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021).

1. Who is responsible

The controller within the meaning of Art. 4(7) GDPR is Thomas Dallinger, 3643 Maria Laach, Austria, thomas.dallinger@proton.me. Swarmli is his project; it is not a company. Only he has access to the waitlist. He is not required to appoint a data protection officer. For every question about your data, write to the address above.

2. Visiting this website

When you open this website, your browser sends technical data to our server: your IP address, the date and time, the page requested, the amount of data transferred, the referring page and your browser and operating system. Our server needs this data to deliver the page and records it in log files to detect and defend against attacks.

• Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).
• Storage: the hosting provider deletes these logs after 30 days at the latest; we keep no copy of them.
• Hosting: the website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, as our processor under a data processing agreement (Art. 28 GDPR). The server functions — including the waitlist — run in Frankfurt, Germany (region fra1); static files are delivered from Vercel’s network location nearest to you. Their privacy policy: vercel.com/legal/privacy-policy.

3. Cookies and tracking

This website sets no cookies and uses no local storage, analytics, advertising or social-media plugins. All fonts and icons are delivered with the website itself, so your browser contacts no other party while you read this site. Because nothing is stored on your device, no cookie consent is needed.

4. The waitlist

What we process

When you join the waitlist we store your e-mail address and, as proof of your consent, the exact consent text and its version, the time you signed up and the time you confirmed, and where on the page you signed up. We do not store your IP address, your name or any other data with the entry. To stop abuse, your IP address is used for a few minutes in our server’s memory to limit the number of sign-ups and is never written down.

Why

To send you one e-mail to confirm your address and, once you confirmed, to tell you about the launch of Swarmli, early access and closely related product news. We use the number of sign-ups, without any personal data, to judge interest in Swarmli. We send no other advertising and never pass your address on for anyone else’s marketing.

Double opt-in

After you sign up we send a confirmation link. Only when you click it is your address added to the waitlist. If you do not confirm, your sign-up is deleted automatically after 7 days.

Legal basis

Your consent (Art. 6(1)(a) GDPR, § 174 TKG 2021). You can withdraw it at any time with the link in every e-mail or by writing to us; the withdrawal does not affect the lawfulness of the processing before it.

How long

Until you leave the waitlist, and at the latest 24 months after you confirmed. When you leave, your entry is deleted immediately.

Who processes it for us

• The waitlist is stored in a database of Supabase Inc. in Frankfurt, Germany (region eu-central-1), as our processor under a data processing agreement (Art. 28 GDPR). Only our server can read it; access is limited to Thomas Dallinger. Their privacy policy: supabase.com/privacy.
• The sign-up itself passes through our server functions at Vercel Inc. in Frankfurt, Germany (region fra1) (see section 2).
• Confirmation e-mails are delivered by Brevo (Sendinblue SAS), Paris, France, as our processor under a data processing agreement (Art. 28 GDPR). Their privacy policy: www.brevo.com/legal/privacypolicy/.

Where it is stored

Waitlist data is stored and processed in the European Union (Frankfurt). Vercel Inc. and Supabase Inc. are companies based in the USA. Should they access data from outside the EU, this is covered by the EU standard contractual clauses (Art. 46 GDPR) and, where the provider is certified, by the EU–US Data Privacy Framework (Art. 45 GDPR).

5. Writing to us

If you e-mail us — for example as an investor or design partner — we process your address, your message and anything you choose to send, to answer you and to continue the conversation. Legal basis: steps prior to a possible contract (Art. 6(1)(b) GDPR) or our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We delete the correspondence when it is concluded, unless statutory retention periods apply.

6. Links to other websites

This website links to personal websites and to profiles on LinkedIn and GitHub. No data is sent to these services until you click a link; from then on, their own privacy policies apply.

7. Your rights

Under the GDPR you have the right to

• access the data we hold about you (Art. 15),
• have it corrected (Art. 16) or erased (Art. 17),
• restrict its processing (Art. 18),
• receive it in a portable format (Art. 20),
• object to processing based on legitimate interest (Art. 21), and
• withdraw your consent at any time (Art. 7(3)).

To use any of these rights, write to thomas.dallinger@proton.me. If you believe we process your data unlawfully, you can complain to the supervisory authority — in Austria the Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, Austria, dsb@dsb.gv.at, www.dsb.gv.at.

8. Security

The website is served only over encrypted connections (TLS). Confirmation and leave links carry random tokens that we store only as one-way hashes. The database accepts no access from browsers; the key our server uses lives only in the hosting provider’s encrypted settings.

9. Changes

We update this policy when the website or the law changes, for example when Swarmli launches as a product. The date at the top shows the current version. A German version is available on request.