Privacy Policy

1. Who is responsible

The controller (Verantwortlicher) responsible for the processing of personal data on this website within the meaning of the EU General Data Protection Regulation (GDPR / DSGVO) is:

Björn Schefzyk
Berlin, Germany
Email: [email protected]

opencanvas is a pre-launch product. This website is a marketing and waitlist page; the product itself is not yet available.

2. What we collect and why

Waitlist email address

If you submit the waitlist form, we collect the email address you enter. We store it in a PostgreSQL database in order to notify you once, when opencanvas launches. Providing your email is entirely voluntary; without it we simply cannot add you to the waitlist.

Server and access logs

When you load this site, our hosting and content-delivery providers may transiently process standard technical data — including your IP address, browser user-agent, the pages requested, and a timestamp — in order to deliver the page and to keep the service secure and available. This is ordinary web-server operation and is not used to build a profile of you.

Cookies and analytics

This site currently sets no non-essential cookies. We do, however, plan to introduce analytics (for example Google / Firebase Analytics) to understand how the site is used and to improve it. If and when we do, any non-essential or analytics cookies will be set only with your prior consent, as required by § 25 TDDDG (the German law formerly known as the TTDSG) and the ePrivacy Directive. You will be able to accept or decline, and we will update this policy to describe the specific cookies involved and the associated Google / Firebase (Google Ireland Limited / Google LLC) processing and international-transfer safeguards.

3. Legal bases

We process personal data on the following legal bases under Article 6(1) GDPR:

• Waitlist email — consent, Art. 6(1)(a) GDPR. By submitting the form you consent to us storing your email to notify you at launch. You may withdraw this consent at any time (see Section 6).
• Server and access logs — legitimate interest, Art. 6(1)(f) GDPR. Our legitimate interest is delivering the website reliably and protecting it against abuse and attacks.
• Analytics cookies (planned) — consent, Art. 6(1)(a) GDPR together with § 25 TDDDG. Any such analytics would only be activated once you have given your prior consent.

4. Hosting and third parties / processors

To operate this website we rely on the following service providers, who may process personal data on our behalf or as part of delivering the site:

• Railway (Railway Corp., USA) — application hosting and the PostgreSQL database in which waitlist emails are stored.
• Cloudflare (Cloudflare, Inc., USA) — DNS, content delivery network, and reverse proxy. Cloudflare sees visitors' IP addresses in order to route and secure requests.
• Google Fonts (Google Ireland Limited / Google LLC) — the page loads fonts from Google's servers, so Google receives your IP address when the page loads.
• Google / Firebase Analytics (Google Ireland Limited / Google LLC) — planned, not currently active. If introduced, it would be enabled only with your prior consent, as described in Section 2 ("Cookies and analytics").

International data transfers

Because these providers are located in or connected to the United States, using them can involve transfers of personal data outside the EU/EEA. Such transfers are safeguarded by the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the providers' certification under the EU–U.S. Data Privacy Framework (DPF).

5. How long we keep data

• Waitlist email: kept until opencanvas launches and you have been notified, or until you ask us to delete it or withdraw your consent — whichever comes first.
• Server and access logs: processed only briefly, for the operation and security of the site, and not retained longer than necessary for those purposes.

6. Your rights under the GDPR

As a data subject you have the following rights regarding your personal data:

• Access — Art. 15 GDPR: to obtain confirmation of, and a copy of, the data we hold about you.
• Rectification — Art. 16 GDPR: to have inaccurate data corrected.
• Erasure — Art. 17 GDPR: to have your data deleted ("right to be forgotten").
• Restriction — Art. 18 GDPR: to have processing restricted in certain cases.
• Data portability — Art. 20 GDPR: to receive your data in a structured, machine-readable format.
• Objection — Art. 21 GDPR: to object to processing based on legitimate interest.
• Withdraw consent — Art. 7(3) GDPR: to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
• Complaint — to lodge a complaint with a supervisory authority. The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI), Berlin. You may also contact the authority in your own place of residence.

7. How to exercise your rights

To exercise any of the rights above — including deleting your waitlist email or withdrawing your consent — simply email us at [email protected]. There is no form to fill in and no account to manage.

8. No automated decision-making or profiling

We do not use your personal data for automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

9. Changes to this policy

As opencanvas moves from waitlist to a live product, our data practices will expand, and we will update this policy accordingly. The "Last updated" date above always reflects the current version. Material changes affecting the waitlist will, where appropriate, be communicated by email.

10. Contact

For any privacy question, or to exercise your rights, contact the controller at [email protected].