Privacy Policy

1. Who is responsible

Maurice Ihl, trading as stappez
Saxoniastraße 18
01159 Dresden
Germany

Email: hello@stappez.com

Maurice Ihl is the controller within the meaning of the General Data Protection Regulation, or GDPR. You can use the contact details above for privacy questions and requests.

2. Visiting this website

Your browser sends the connection information needed to request a page, such as an IP address, request time, requested path and browser information. We process this information to deliver the website, diagnose errors and protect its operation. Our legal basis is Article 6(1)(f) GDPR, reflecting our legitimate interest in a reliable and secure website.

During local development, access requests may appear in the server console. Console records follow the local debugging session and terminal retention settings.

For the public website, we have selected Cloudflare for hosting. Depending on the chosen services, this may also include content delivery and security functions. Cloudflare, Inc., United States, and relevant group companies may process connection and request data to provide those services. Processing can involve countries outside the European Economic Area. Cloudflare’s data processing addendum provides contractual safeguards, including standard contractual clauses for restricted transfers. Its privacy policy explains its processing. The actual service configuration, account entity and log retention must be confirmed before public hosting begins.

3. Cookies, analytics and local assets

We use optional PostHog analytics to understand visits and improve stappez. Analytics starts only after you select Accept. Declining does not affect the website or launch signup. You can change your choice or withdraw consent at any time through Analytics settings in the footer. Withdrawal stops future collection and removes the analytics identifiers stored by our integration on your device. It does not affect the lawfulness of earlier processing.

With your consent, we collect page views, approximate time spent, device and browser information, country, selected referral and campaign information, and events for opening the launch form, submitting it and confirming launch access. Random identifiers help distinguish visits and sessions. We do not send email addresses, form values, confirmation or unsubscribe tokens, URL query strings or fragments to analytics. We do not enable session recordings, automatic click capture or identified person profiles. These safeguards reduce the data collected but do not make it anonymous.

Analytics is supplied by PostHog, Inc., United States. We selected its EU cloud, hosted in Frankfurt. Connection IP information is processed to derive approximate location; IP storage is disabled in our project. EU hosting does not exclude access or processing outside the European Economic Area. PostHog’s data processing agreement describes processor duties and transfer safeguards. Its privacy policy provides further information.

Our legal basis for analytics is your consent under Article 6(1)(a) GDPR and, for optional storage or access on your device, Section 25(1) TDDDG. We remember your analytics choice in local storage for 180 days. After consent, analytics uses local storage for random visitor and session identifiers. The free PostHog plan provides an event reporting window of one year. This reporting window is not a guarantee that older records are automatically deleted; deletion is handled separately through the provider’s data deletion controls. You can contact us about your data using the details in section 1.

The signup form loads Cloudflare Turnstile when opened or shown, as explained in section 5. The site does not embed a video player or social media feed. Fonts, images and icons are delivered from this website. The AI logos are images and do not connect your browser to an AI service. Selecting a normal external link takes you to that provider, which handles data under its own privacy notice.

4. Contact by email

If you email us, we process your email address, the content of your message and any details you provide to respond to your request. The legal basis is Article 6(1)(b) GDPR for enquiries about a contract, or Article 6(1)(f) GDPR for our legitimate interest in handling other enquiries.

Messages to hello@stappez.com are routed through Cloudflare Email Routing to an existing Google Workspace inbox. Cloudflare processes message content and delivery information to forward the email. Processing can involve Cloudflare, Inc., United States, and relevant group companies outside the European Economic Area. Cloudflare’s data processing addendum provides contractual safeguards, including standard contractual clauses for restricted transfers.

That inbox is handled using Google Workspace, supplied by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Email processing can involve Google entities and subprocessors outside the European Economic Area. Google’s data processing terms describe its transfer mechanisms, including standard contractual clauses where required. You can contact us for information about the safeguards relevant to your data.

We retain correspondence while it is needed to resolve the enquiry, meet applicable legal retention duties or establish, exercise or defend legal claims. We delete it when these purposes no longer require it. Legal retention is based on Article 6(1)(c) GDPR; necessary claim handling may be based on Article 6(1)(f).

5. Launch signup

Signing up for launch access is voluntary. We process your email address, the consent wording and version, signup and confirmation times, the launch offer version, and secure confirmation and unsubscribe references. We use these details to verify your signup and send the stappez launch information and your 20% discount. This does not subscribe you to an ongoing newsletter. The legal basis for these emails is your consent under Article 6(1)(a) GDPR.

We send a verification email after you request to sign up. You are added to confirmed signups only after you follow its link and confirm on the website. After confirmation, a separate receipt email is queued to acknowledge your confirmed launch offer. Delivery depends on the email provider. The confirmation link expires after 24 hours. Expired unconfirmed entries are deleted by the next cleanup, normally within a further 24 hours. We retain confirmed entries until the launch information and discount have been sent, or until you withdraw consent. We review continued retention if the launch is delayed.

To manage receipt delivery, we store a job associated with the confirmed signup, including its creation time, attempt count, retry and lease times, and delivery acceptance status. We make at most three send attempts within 23 hours, with at least 15 minutes between attempts. Unsent jobs become eligible for cleanup after 23 hours and any active lease has expired; cleanup is designed to run every 15 minutes, but downtime may delay it. Sent job records remain associated with the confirmed signup and are deleted when the signup is removed. Receipt unsubscribe links use a secret based HMAC; only a hash of the derived token is stored, not the raw token.

You can withdraw consent using the unsubscribe link or by emailing hello@stappez.com. Withdrawal stops further launch emails and removes your signup entry. It does not affect the lawfulness of earlier processing. Providing your email address is necessary to sign up, but is not required to browse the website.

Cloudflare is selected to store signup entries under the arrangements described above. Resend, operated by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, United States, is selected to deliver verification and receipt emails on our behalf. Resend receives the recipient address, message content and action links, and may process technical delivery data. Email images are included as inline attachments. Emails also specify the Geist font hosted on our website. If your email client supports and loads that font, it requests the font file from our website; our hosting provider then processes the connection data needed to deliver it, as described in section 2. This generic font request contains no recipient identifier added by us. Unsupported clients use a fallback font. Resend’s data processing addendum describes its processor duties and transfer safeguards, including standard contractual clauses where applicable. Its privacy policy describes its own processing. Processing may take place outside the European Economic Area; selecting a European sending region does not mean all data remains there.

We do not add signup addresses to a separate Resend marketing contact list. Withdrawing consent removes the signup entry and stops future launch emails; provider delivery records may remain under the applicable service retention arrangements. Those settings must be confirmed before public sending. An explicitly enabled local test mode writes test messages to private files instead of delivering them.

To prevent abuse and excessive email requests, we use request limits and a secret protected hash derived from the connection IP address. We do not store the raw IP address in the signup database. These temporary limit records are removed after their limit window expires, normally within a further 24 hours. This protection relies on Article 6(1)(f) GDPR, reflecting our legitimate interest in preventing misuse. Hosting and email providers may also process operational and delivery data under their applicable service arrangements.

When the signup form is opened or shown, Cloudflare Turnstile checks for automated abuse. It processes connection and browser signals such as the IP address, user agent, TLS information, site key and page origin. Our server checks the challenge token before saving a signup or sending its confirmation email. The email address is not included in our Turnstile verification request. Our legal basis is Article 6(1)(f) GDPR, reflecting our legitimate interest in protecting the form from bots and email abuse.

Cloudflare processes these signals on our behalf to secure the form and as a controller to improve its bot detection. Details are in its Turnstile Privacy Addendum. International processing may occur under the arrangements described above. We do not enable clearance cookies for the website through this integration. Turnstile checks for automated activity; email confirmation separately verifies control of the email address. JavaScript is required for the security check.

6. Purchases and the app

The website does not currently accept orders or payments, deliver an installer, create customer accounts, activate licenses or upload app projects. Launch signup does not constitute a purchase. No payment or licensing provider receives data through these controls.

Stripe is the selected payment provider for the future checkout. Depending on the payment method and checkout configuration, processing can include your name, contact and billing details, payment information, order information, transaction identifiers and technical or fraud prevention data. Processing needed to fulfil a purchase relies on Article 6(1)(b) GDPR; legal accounting duties on Article 6(1)(c); necessary fraud prevention on Article 6(1)(f).

Stripe acts as a processor for some activities and as an independent controller for others, including its own compliance and fraud prevention purposes. Its relevant entities and practices are described in the Stripe privacy policy. Stripe’s data processing agreement and linked transfer terms describe processing and international transfer safeguards. The actual account entity, checkout data flow and retention arrangements must be confirmed before sales begin.

Any additional processing introduced by license activation, the released app or an optional AI connection must be explained before that feature is used.

7. Who may receive data

Access is limited to people who need it to operate the website, manage launch signups or handle your enquiry, and service providers processing data for those purposes. We may also disclose information when a legal obligation requires it or when necessary to establish, exercise or defend legal claims. We do not sell personal data collected through this website.

8. Your rights

Subject to the conditions in the GDPR, you may request access, correction, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. If processing relies on consent, you may withdraw that consent at any time without affecting the lawfulness of earlier processing.

You may complain to a data protection authority, including the authority where you live or work. The authority responsible for a controller based in Saxony is the Saxon Data Protection and Transparency Commissioner.

9. Providing data and automated decisions

You do not need to submit personal details to read the website, beyond the connection data needed to deliver it. Signing up for launch access and providing information in an email are voluntary, although we need an email address to send the requested information. This website does not make decisions about you with legal or similarly significant effects through automated processing.

10. Changes and contact

We update this policy when the website or its processing changes. The date above identifies this version. For questions or to exercise a right, email hello@stappez.com.