Privacy policy

Below we inform you, in accordance with the statutory requirements of data-protection law (in particular the German Federal Data Protection Act, BDSG n.F., and the European General Data Protection Regulation, "GDPR"), about the nature, scope and purpose of the processing of personal data by our company. This privacy policy also applies to our websites and social-media profiles. For the definition of terms such as "personal data" or "processing", please refer to Art. 4 GDPR.

1. Controller

The controller ("controller") within the meaning of Art. 4 No. 7 GDPR is:

Company: Stellwerk Labs GmbH
Address: Kokkolastr. 5
40882 Ratingen
Germany
Managing directors: André Alfter, Clemens Jütte, Tobias Gurtzick
Email

See our legal notice for full company details.

2. Categories of data, purposes and data subjects

This website is a pre-launch project page with a waitlist. We deliberately keep data processing to a minimum. Concretely, we process:

Waitlist data — the data you enter when joining the waitlist: your email address (required) and, optionally, your name, role/organisation, a preferred partner for delivery, and whether you are applying as a Friendly Foundational Customer. We also store the confirmation status, the locale you signed up in and the timestamp of your subscription.
Usage / meta data — data your browser transmits when accessing the site (e.g. IP address, date and time, requested resource), processed as server log files.

The purposes of processing are: contacting you about early access, releases and related project news; the technically secure, uninterrupted delivery and operation of our website; safeguarding against attacks and other security measures; and evidence purposes. The data subjects affected are visitors/users of the website and people who join the waitlist (collectively, "users").

3. Legal bases of processing

Where we have obtained your consent for processing personal data, the legal basis is Art. 6(1)(a) GDPR. Where processing is necessary for the performance of a contract or pre-contractual measures, the legal basis is Art. 6(1)(b) GDPR. Where processing is necessary to comply with a legal obligation to which we are subject, the legal basis is Art. 6(1)(c) GDPR. Where processing is necessary to safeguard our legitimate interests or those of a third party, and your interests or fundamental rights and freedoms do not override them, the legal basis is Art. 6(1)(f) GDPR.

4. The waitlist and double opt-in

We use the data you provide on the waitlist form solely to contact you about early access, releases and related project news and — where you apply as a Friendly Foundational Customer — to process your application, including your preferred partner. We do not pass your application to a partner without your separate consent. The legal basis is your consent under Art. 6(1)(a) GDPR, given via the checkbox on the form.

After you submit the form we send a confirmation email (double opt-in). Your address is added to the waitlist only after you confirm it. Unconfirmed entries are deleted after 30 days. To keep personal data out of our log infrastructure, email addresses are masked in server logs.

5. Storage, processors and third countries

Subscriber data is stored on our self-hosted email system (Listmonk, hosted at WX1) within the EU. We do not sell your data or pass it to third parties for their own purposes. Where a processor is involved (e.g. hosting), a data-processing agreement pursuant to Art. 28 GDPR is in place, and processors are selected carefully and bound to appropriate technical and organisational measures. We do not intend to transfer your data to a third country outside the EU/EEA. Should this become necessary, it would only occur under the safeguards of Art. 44 et seq. GDPR (e.g. an adequacy decision or EU Standard Contractual Clauses).

6. Retention and withdrawal

We keep your waitlist data until you withdraw your consent or unsubscribe, which you can do at any time via the link in every email or by writing to . Withdrawal does not affect the lawfulness of processing carried out before it. Otherwise, personal data is erased or blocked as soon as the purpose for storage no longer applies, unless statutory retention obligations require otherwise.

7. Server log files

When you use the website purely for information (without joining the waitlist), our hosting provider processes standard access logs — including IP address, internet service provider, date and time of the request, browser type and version, the requested content, access status/HTTP status code, volume of data transferred, the referring website and the operating system. This data serves the user-friendly, functional and secure delivery of our website, as well as its optimisation and statistical evaluation. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. For security reasons the data is stored in server log files for 70 days and then automatically deleted, unless we need to retain it as evidence in the event of attacks on our server infrastructure or other legal violations.

8. Cookies and consent

This site uses only cookies and comparable browser storage that are strictly necessary for it to function. To remember the choice you make in the cookie banner, we store a single entry (stellwerk_cookie_consent) in your browser's local storage. This entry stays on your device, is not transmitted to us, and is set on the basis of our legitimate interest under Art. 6(1)(f) GDPR. We set any optional cookies — for example for analytics — only after you have given consent via the banner (Art. 6(1)(a) GDPR); at present we use no such cookies. You can accept or decline in the banner, and change or withdraw your choice at any time via "Cookie settings" in the footer. You can also delete this storage at any time in your browser settings.

9. No third-party trackers

This site sets no advertising or analytics cookies and embeds no third-party trackers — no Google Analytics, no reCAPTCHA, no social-media plugins. In place of a third-party CAPTCHA, the waitlist form uses a simple hidden-field ("honeypot") spam check that transmits no additional personal data to anyone. Web fonts are self-hosted from our own server — no data is sent to Google Fonts or any other CDN. We use no automated decision-making or profiling.

10. Your rights

You have the right of access (Art. 15 GDPR), to rectification (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR) and to data portability (Art. 20 GDPR). Where processing is based on your consent, you may withdraw it at any time with effect for the future. Where processing is based on our legitimate interests under Art. 6(1)(f) GDPR, you have the right to object under Art. 21 GDPR. You also have the right to lodge a complaint with a supervisory authority (e.g. the data-protection authority of North Rhine-Westphalia). To exercise any of these rights, contact us at .