DATENSCHUTZERKLÄRUNG

Privacy Policy

What we collect, why we need it, and the choices you have.

Last updated: 16 September 2026

1. Who is responsible?

The controller under the General Data Protection Regulation (GDPR / DSGVO) for this website and its waitlist is:

This notice covers subpolar.io and the corresponding Subpolar website hosted on chatgpt.site.

2. Visiting the website

Our hosting infrastructure processes the information needed to deliver the website and protect it from abuse. This includes your IP address, request time, requested address and technical HTTP information, which can include browser information. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in providing a reliable and secure website.

The website and its waitlist database run on OpenAI Sites, using Cloudflare infrastructure, including Workers and D1. Hosting providers and their authorised service providers may process technical request data and stored waitlist data to operate and secure the service. Sites does not provide an EU-only data-residency guarantee. Processing outside the European Economic Area, including in the United States, is possible.

Provider information: OpenAI privacy information, OpenAI subprocessors and Cloudflare privacy information. OpenAI’s European entity is OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland.

Fonts, imagery and interface scripts are delivered with this website. Your browser does not need to contact Google Fonts or unpkg to load them.

3. Joining the waitlist

If you join, we collect your name and email address, together with the signup time, an internal record identifier and the version of the consent notice. We use these details to manage the waitlist and send the Subpolar development and launch updates you requested. The legal basis is your consent under Article 6(1)(a) GDPR.

Providing these details is voluntary. You can browse without joining; we need a name and valid email address to register you through the form. Joining does not open a financial account or commit you to buy anything.

Your details are stored in the site’s database and are accessible to authorised site administrators and the service providers needed to operate it. The signup form currently stores registrations; it does not automatically send confirmation or marketing emails. We do not send your name or email address to PostHog.

We retain waitlist details while needed to run the waitlist and provide the requested updates. You can withdraw your consent or request removal at any time by emailing alex@subpolar.io. We will stop using your details for updates and erase them when they are no longer needed, except where a legal obligation or a necessary legal-claims record requires limited retention. Withdrawal does not affect the lawfulness of processing before it.

4. Protecting the signup form

To limit automated or excessive submissions, we derive a daily-changing hash from the request IP address and store attempt counts and a time window. This is separate from your waitlist record; the raw IP address is not stored in that record. Hashing does not necessarily make data anonymous. Our legitimate interest in preventing abuse is the legal basis under Article 6(1)(f) GDPR.

Rate-limit records older than 24 hours become eligible for deletion. Cleanup runs when further valid signup requests arrive, so deletion may occur later during quiet periods. Hosting providers may separately process IP addresses for network delivery and security.

5. Optional analytics

Only if you choose “Allow analytics”, we use PostHog Inc.’s EU service to measure homepage visits, waitlist-form openings and newly completed signups. We send the event type, a random identifier created for that page load, the page’s domain and path, and—for form openings—the button location. The analytics provider also receives technical connection information, including the IP address of browser requests.

We do not send names, email addresses, form contents, query strings or referrers to analytics. We do not use session replay, screen recording or automatic interaction recording. Location enrichment and person profiles are disabled. The random identifier is held in memory and is not saved as a persistent analytics cookie or identifier.

The legal basis is Article 6(1)(a) GDPR and, where consent is required for access to your device, § 25(1) TDDDG. Declining leaves the website and waitlist usable. We also respect the browser’s Do Not Track and Global Privacy Control signals in this integration.

Analytics events are retained for evaluating website use and waitlist conversion while that purpose remains relevant, subject to the project’s retention configuration and applicable erasure requests. Closing the page discards its in-memory identifier; it does not erase events already received by PostHog. Contact us for an erasure request. Because we do not link these events to your email address, we may be unable to identify a particular event from your email alone.

PostHog Inc. is a US company; using its EU service does not rule out access from outside the EEA. Its published data processing agreement describes international-transfer safeguards, including EU Standard Contractual Clauses. See also its privacy information.

6. Your analytics choice

We store your allow/decline preference and its expiry in your browser’s local storage under subpolar.analytics-consent.v1 for 180 days. This is used to remember and enforce your choice, not to identify you for analytics. The legal basis is Article 6(1)(f) GDPR and the strictly necessary storage exception in § 25(2)(2) TDDDG.

You can change your choice in “Analytics preferences” in the homepage footer, or use the button below to decline analytics now. Withdrawal stops future analytics collection in this browser; it does not delete events already sent. Each domain and browser maintains its own preference.

7. Contacting us

If you email us, we use your email address and message to respond. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in answering enquiries, or Article 6(1)(b) GDPR when the enquiry concerns steps you request before a contract. Email delivery involves the email providers used by the sender and recipient. We retain correspondence while needed to resolve the enquiry and, where applicable, comply with statutory retention duties or establish, exercise or defend legal claims.

8. International processing

Our hosting and analytics services can involve processing outside the EEA. Providers publish information about adequacy decisions and contractual safeguards for these transfers: OpenAI’s data processing terms and PostHog’s data processing terms. You may contact us to request information about the safeguards applicable to your data or a copy, subject to necessary redactions.

9. Your rights

Under the applicable conditions of the GDPR, you have rights of access, rectification, erasure, restriction of processing and data portability (Articles 15–20). You can withdraw consent at any time without affecting earlier lawful processing.

Where processing is based on legitimate interests, you can object for reasons relating to your particular situation under Article 21 GDPR. You can object to processing for direct marketing at any time.

Contact alex@subpolar.io to exercise your rights. We may request proportionate information to verify your identity. We do not use your data for automated decisions producing legal or similarly significant effects.

You may complain to a data protection supervisory authority, particularly where you live, work or believe an infringement occurred. Our local authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany; email: mailbox@datenschutz-berlin.de.

10. Changes

We will update this notice when the website or its data processing changes. New processing that requires consent will not be covered automatically by your existing choice.