Privacy Policy — Deepcut

1. Data Controller

The controller responsible for data processing on this website is the person named in the Legal Notice.

For data protection inquiries, contact us at:
hello@getdeepcut.de

2. Privacy at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you.

How do we collect your data?

Your data is collected when you provide it to us (e.g., waitlist registration). Other data is automatically collected or collected with your consent when you visit the website (e.g., technical data such as browser, operating system, time of page visit).

3. Hosting

This website is hosted by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Cloudflare is certified under the EU-US Data Privacy Framework, ensuring an adequate level of data protection.

When visiting this website, server log files are automatically recorded. These contain:

IP address (anonymized)
Date and time of the request
Page accessed / URL
Browser type and version
Operating system
Referrer URL

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and efficient provision of the website).
Storage duration: Server logs are stored by Cloudflare for a maximum of 72 hours.
Data processing agreement: We have concluded a Data Processing Agreement (DPA) with Cloudflare pursuant to Art. 28 GDPR.

Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/

4. Your Rights

You have the right to:

Access information about your stored personal data (Art. 15 GDPR)
Rectification of inaccurate data (Art. 16 GDPR)
Erasure of your data (Art. 17 GDPR)
Restriction of data processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Object to processing (Art. 21 GDPR)
Withdrawal of consent at any time with future effect (Art. 7(3) GDPR)

To exercise your rights, send an email to hello@getdeepcut.de.

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data (Art. 77 GDPR). The competent authority is:

[State Data Protection Commissioner of the respective federal state]
(The competent authority depends on the registered office of the controller and will be added after registration of the company.)

5. Data Collection on This Website

Waitlist Registration & Newsletter

When registering for the waitlist, we collect your email address and chosen role (Fan, Artist, or Digger). Registration requires explicit consent to this privacy policy (opt-in checkbox). If double opt-in is enabled, you will receive a confirmation email after signing up and will only be added to the mailing list after confirming.

Data processed: Email address, role, language
Purpose: Notification about the app launch, updates and news about Deepcut
Legal basis: Art. 6(1)(a) GDPR (explicit consent)
Storage duration: Until withdrawal of your consent or deletion upon request
Email sending & contact storage: Brevo (sendinblue SAS, Paris, France — EU, see section 6)

You can withdraw your consent at any time by emailing hello@getdeepcut.de or using the unsubscribe link in our emails.

Cookies

This website does not use tracking cookies or analytics tools. Only technically necessary cookies are used that are required for the operation of the website (e.g., language preference).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the operation of the website).

6. Third-Party Services and Data Processing Agreements

We use the following third-party service providers, with each of whom a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR has been concluded:

Brevo (Email Marketing & Transactional Emails)

For email sending and managing our contact list (waitlist/newsletter), we use Brevo (sendinblue SAS, 55 rue d'Amsterdam, 75008 Paris, France). Brevo is a European company headquartered in France — data is processed within the EU.

Data processed: Email address, role (Fan/Artist/Digger), language
Purpose: Sending confirmation and newsletter emails; managing waitlist contacts
Legal basis: Art. 6(1)(a) GDPR (consent)
Storage location: EU (France / AWS eu-west-1)
Data processing agreement: DPA pursuant to Art. 28 GDPR concluded

Brevo privacy policy: https://www.brevo.com/legal/privacypolicy/

Supabase

We use Supabase, Inc. (970 Toa Payoh North, #07-04, Singapore 318992) for data storage. Our database instance is located in the EU region (AWS eu-central-1, Frankfurt).

Data processed: Waitlist entries (email, role, language)
Legal basis: Art. 6(1)(a) GDPR (consent)
Storage location: EU (Frankfurt, Germany)

Fonts (Self-Hosted)

This website uses locally hosted fonts (Fontsource). No external connections are made to Google Fonts or other font CDNs. Your IP address is not transmitted to third parties.

7. Changes to This Privacy Policy

We reserve the right to update this privacy policy to reflect changes in legislation or changes to our services. The current version can always be found on this page.