Last updated12 September 2026
Waitlist privacy
This notice covers the coming-soon website, waitlist and contact form. It explains responsibility, processing, providers, retention, browser storage, rights and the governing language.
§ 1
Who is responsible
Citerra GbR, a partnership of Fadi Al Eliwi, Fares Al Eliwi, Mauro Maus and Yefan Jiang, is the controller. Its address is c/o Collective Incubator, Jülicher Straße 209q/s, 52070 Aachen, Germany. Privacy requests go to contact@citerra.de.
§ 2
What is processed
- Waitlist
- Citerra stores your email, language, signup source, confirmation status and consent record, including time, displayed wording and IP address. Confirmation and launch emails rely on your consent (Art. 6(1)(a) GDPR). Without your email address, Citerra cannot reserve a waitlist place.
- Contact
- Citerra stores your name, email, optional organization, topic and message to answer your request. Processing relies on legitimate interest in answering enquiries (Art. 6(1)(f) GDPR), or pre-contractual steps you request (Art. 6(1)(b) GDPR).
- Website security
- Vercel hosts the website and checks form submissions with BotID. Request data, IP addresses and browser signals help prevent abuse. Citerra also rate-limits submissions and monitors backend errors. These purposes rely on legitimate interest in reliable, secure operation (Art. 6(1)(f) GDPR).
§ 3
Who receives the data
The table identifies each provider and its processing location. Standard contractual clauses are the European Commission safeguards for transfers outside the EU.
Copies of applicable transfer safeguards can be requested from contact@citerra.de. The status of the Convex data processing agreement remains unverified.
| Provider | What it receives | Where |
|---|---|---|
| Convex | Waitlist entries, consent records and contact requests. | EU (Ireland) |
| Resend | Recipient addresses, confirmation and launch emails, and contact notifications. | EU (Ireland) for delivery. Provider is US-based, SCCs in force. |
| Vercel | Website requests, IP addresses, server logs and browser signals for BotID abuse prevention. | Global edge, EU region for server rendering. SCCs in force. |
| Sentry | Backend error reports with personal data removed. | EU |
§ 4
How long data is kept
Confirmed waitlist entries remain while the subscription lasts. Citerra deletes unconfirmed entries after 30 days and consent IP addresses after 1 year.
After withdrawal, Citerra retains the unsubscribe record for 3 years to document compliance with the request, then deletes it. This relies on Art. 6(1)(f) GDPR and the limitation period in §195 BGB.
Citerra deletes contact requests after 2 years. Contact rate-limit IP data expires within 14 days. Vercel retains request logs for 1 hour.
Resend retains sent emails for 30 days. Citerra retains email delivery records for 90 days.
§ 5
What is stored in your browser
NEXT_LOCALE stores your chosen language for 1 year. This requested preference relies on §25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR.
The website uses no advertising or analytics cookies. Fonts and artwork are served by Citerra. You can delete the language cookie in your browser.
§ 6
What rights you have
Withdraw consent using the unsubscribe link in a waitlist email or by writing to contact@citerra.de. Withdrawal does not affect earlier lawful processing.
You can request access, correction, erasure, restriction and portability where applicable (Art. 15 to 20 GDPR) from contact@citerra.de.
You can object to processing based on legitimate interest for reasons arising from your situation (Art. 21 GDPR). Citerra makes no solely automated decisions about you.
You can complain to your local supervisory authority. Citerra is supervised by the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Postfach 20 04 44, 40102 Düsseldorf. The authority can be reached at poststelle@ldi.nrw.de.
§ 7
Governing language
This notice is published in English and German. The English version governs until counsel has reviewed both texts.