Privacy Policy
Last updated: 2026-10-28
This policy explains which personal data we process when you visit this website, join the launch waitlist or contact us, and which rights you have under the EU General Data Protection Regulation (GDPR) and the German Telecommunications Digital Services Data Protection Act (TDDDG).
1. Controller
Heiko Rothkranz (Heyomatic)
Noerer Str. 19
24251 Osdorf
Germany
Email: hey@heyomatic.com
Further details are available in our imprint.
2. Summary
- We do not use analytics, advertising, social media plugins or tracking cookies.
- Fonts, images and our own scripts are served from our own domain. The waitlist and contact forms also load Cloudflare Turnstile from challenges.cloudflare.com.
- We only process the data needed to deliver and protect the website, to confirm your waitlist sign-up and send you a single launch email if you ask for it, and to answer your messages.
3. Visiting this website
This website is hosted on Cloudflare Workers. When you open a page, Cloudflare processes technical data that your browser sends automatically: IP address, date and time of the request, requested URL, referrer URL, browser type and version, operating system, and connection and routing data. Without this data, the website cannot be delivered to your device.
We also use Cloudflare Workers Logs to detect errors and attacks. These logs contain technical request data and are deleted automatically after at most 7 days.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a secure, stable and fast website.
4. Protection against attacks and cookies
To protect the website against attacks and automated abuse, Cloudflare may show a security check ("challenge") to some visitors. If you pass it, Cloudflare stores the following cookies in your browser:
| Cookie | Purpose | Lifetime |
|---|---|---|
cf_clearance | Proves that you passed the check, so you are not asked again | 30 minutes |
cf_chl_rc_i, cf_chl_rc_ni, cf_chl_rc_m | Used internally by Cloudflare to detect technical problems with the check | Short-lived, deleted after the check |
Storing these cookies is strictly necessary to provide the website you have requested (§ 25(2) No. 2 TDDDG). The related processing of personal data is based on Art. 6(1)(f) GDPR. Our legitimate interest is protecting the website and its visitors against attacks.
5. Spam protection on forms (Cloudflare Turnstile)
Our waitlist and contact forms use Cloudflare Turnstile to check whether a submission comes from a human. Turnstile runs in your browser and reads technical signals such as your IP address, browser and device properties, the TLS fingerprint and the page on which the form is embedded. Based on these signals, Cloudflare issues a one-time token that our server verifies before accepting your submission. Turnstile is only used together with these forms, not on other parts of the website.
Reading this information from your device is strictly necessary to provide the form you want to use (§ 25(2) No. 2 TDDDG). The processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is protecting our forms against spam and abuse. Cloudflare also uses this data to improve its bot detection. For details, see the Turnstile privacy addendum.
6. Launch waitlist
Sign-up and confirmation (double opt-in)
Joining the waitlist takes two steps. When you submit the form, we store your email address together with the date and time of your request, and send you a confirmation email with a link. Only after you open this link and confirm on the page do we add you to the waitlist and record the date and time of your confirmation. If you do not confirm within 48 hours, we delete your address automatically.
The confirmation step ensures that nobody can add someone else's address to the waitlist. Legal basis for sending the confirmation email: Art. 6(1)(f) GDPR. Our legitimate interest is verifying that the owner of the address really requested the sign-up.
Launch email
We use your confirmed address only to send you one email when Heyomatic launches. We do not share it with anyone for their own purposes.
Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future by emailing hey@heyomatic.com. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.
Deletion and proof of consent
We delete your email address once the launch email has been sent, if you withdraw your consent, or if we decide not to launch. To be able to prove that you gave your consent, we then keep only a cryptographic hash of your address (a one-way fingerprint that does not reveal the address itself), together with the dates and times of your sign-up and confirmation. If a question about your consent comes up, we can calculate the hash from your address and look up this record.
We keep this record until the end of the third calendar year after your address was deleted, which corresponds to the regular limitation period under German law (§§ 195, 199 BGB), and then delete it. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is being able to demonstrate your consent (Art. 7(1) GDPR) and to defend ourselves against legal claims.
Storage and sending
We store waitlist data in a Cloudflare D1 database that is restricted to the EU. Confirmation and launch emails are sent through the EU service of SMTP2GO, which processes them in its data center in Amsterdam. We do not track whether you open these emails or click their links.
SMTP2GO stores delivery data (recipient address, date and time, delivery status) for up to 35 days and then deletes it. SMTP2GO also uses this delivery data as an independent controller for its own purposes, such as investigating security issues, preventing abuse and improving its service. For details, see the SMTP2GO privacy policy.
7. Contact form and email
If you use our contact form, we process your name, email address, the topic you selected, your message and the time of submission. A Cloudflare Worker checks the submission and sends the message through the EU service of SMTP2GO to our mailbox. We do not keep a copy on the server after it has been sent. SMTP2GO's handling of delivery data is described under "Storage and sending" above. If you email us directly, we process your email, including its content, your email address and any other details you provide.
We use this data only to answer your request. Legal basis: Art. 6(1)(b) GDPR if your request relates to a contract or to steps before entering into one (for example, early access), otherwise Art. 6(1)(f) GDPR. Our legitimate interest is answering inquiries sent to us.
We delete your message once your request has been fully resolved, unless statutory retention obligations (for example, under German tax law) require us to keep it longer.
8. Service providers
We use the following service providers. They process personal data only on our behalf and according to our instructions, under data processing agreements as required by Art. 28 GDPR. Where a provider also uses data for its own purposes, we explain this in the relevant section above.
| Provider | Service | Location of processing |
|---|---|---|
| Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA | Web hosting and content delivery, server logs, attack and spam protection (challenges, Turnstile), form processing, waitlist database | The data center closest to you, which may be outside the EU. Waitlist database: EU only. |
| Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Les Acacias (Geneva), Switzerland | Mailbox for hey@heyomatic.com and for contact form messages | Switzerland |
| Sand Dune Mail Limited (SMTP2GO), 96–106 Manchester Street, Christchurch 8011, New Zealand | Sending waitlist confirmation and launch emails, and contact form messages | EU (Amsterdam) |
9. Transfers to countries outside the EU
Cloudflare, Inc. is based in the USA and may process data in data centers outside the EU. Cloudflare is certified under the EU-U.S. Data Privacy Framework, so transfers are based on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). In addition, we have agreed on the EU Standard Contractual Clauses with Cloudflare. You can check the certification on the Data Privacy Framework list.
Infomaniak Network SA processes data only in data centers in Switzerland. The European Commission has recognised Switzerland as providing an adequate level of data protection (decision 2000/518/EC, Art. 45 GDPR).
SMTP2GO sends our emails from its data center in the EU. The company itself is based in New Zealand, which the European Commission has also recognised as providing an adequate level of data protection (decision 2013/65/EU, Art. 45 GDPR).
10. Is providing data required?
You are not legally or contractually required to provide personal data. Without an email address, however, we cannot add you to the waitlist or reply to your message. We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
11. Your rights
Regarding your personal data, you have the right to:
- access (Art. 15 GDPR),
- rectification (Art. 16 GDPR),
- erasure (Art. 17 GDPR),
- restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR),
- withdraw any consent you have given, with effect for the future (Art. 7(3) GDPR).
To exercise your rights, email us at hey@heyomatic.com.
Right to object (Art. 21 GDPR)
Where we process your data based on legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation. We will then stop processing your data, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. To object, email hey@heyomatic.com.
Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state where you live or work, or where the alleged infringement took place. The authority responsible for us is:
Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD)
Holstenstraße 98
24103 Kiel
Germany
www.datenschutzzentrum.de
12. Security
This website is served exclusively over an encrypted connection (TLS). We use technical and organisational measures to protect your data against loss, misuse and unauthorised access.
13. Changes
We will update this policy when the website or our services change, for example at launch. The current version is always available on this page.