← Back to the home page

Privacy policy

As of October 2026. This translation is provided for convenience; the German Datenschutzerklärung is authoritative. It covers the EntroPilot website and waitlist. The EntroPilot platform itself is not yet publicly available.

1. Controller

Muhammed Enes Bayraktutan
Frankfurter Landstraße 63
64291 Darmstadt
Email: [email protected]

No data protection officer has been appointed, as there is no legal obligation to do so.

2. In short

• This website sets no cookies, builds no user profiles and uses no advertising services. For anonymous visit statistics we use Cloudflare Web Analytics (see section 3).
• No external fonts or third-party content (CDNs) are loaded. The only exception is Cloudflare’s statistics script.
• We only process personal data when you join the waitlist or email us – and as technically required to deliver the page.

3. Website hosting (Cloudflare Pages)

The website is delivered via Cloudflare Pages, provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you visit the page, Cloudflare processes technically necessary connection data, in particular your IP address, date and time, the requested file and browser and device information, in order to deliver the page and protect it against attacks.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and stable provision of the website. A data processing agreement (Data Processing Addendum) is in place with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework; the EU Standard Contractual Clauses apply in addition. A transfer to the USA is therefore possible. We do not analyse access logs ourselves.

Visit statistics (Cloudflare Web Analytics)

To see how many people visit the page and how they found it (e.g. via a QR code at an event), we use Cloudflare Web Analytics. The page loads a small script from Cloudflare that records page views, the page visited, the referring page as well as country, browser and device type in aggregated form. It sets no cookies, stores nothing on your device and builds no profiles across websites; we only see totals, not individual people.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is understanding the reach of the page and of events. The data processing agreement and transfer safeguards named above apply. You can object (Art. 21 GDPR) or block the script with a content blocker; the page keeps working as before.

4. Waitlist

What data?

Your email address is required. Your name, your situation (e.g. studying, founding, advising), your biggest hurdle in founding (chosen from a list), your university or organisation and – for advice centres – whether you are interested in a pilot conversation are optional. We also store the page language, the time of sign-up, the wording of your consent and – if present – a campaign tag from the link (e.g. “innoday26” if you arrive via an event QR code). This tag contains no personal data.

Confirmation (double opt-in)

After you sign up we send you an email with a confirmation link. Only when you click it are you on the waitlist; we store the time of confirmation. If you do not confirm, we delete the sign-up automatically after 7 days. With the “Unsubscribe” link in the email you can delete yourself at any time. For sending we use Resend (Resend, Inc., USA) as a processor, sending via servers in the EU (Ireland); the EU Standard Contractual Clauses in Resend’s data processing agreement apply.

For what purpose?

Solely to inform you about the launch of EntroPilot and early access and – in aggregated form – to understand which groups are interested. We do not sell data or pass it on for advertising.

Legal basis

Your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future (Art. 7(3) GDPR) by simply emailing [email protected]. The lawfulness of processing up to that point remains unaffected.

Where is the data stored?

The waitlist is held in a database at Supabase, Inc., which we use as a processor under Art. 28 GDPR. The database runs in the Frankfurt am Main region (EU). When you submit the form, Supabase also processes your IP address for technical reasons. Where Supabase or its sub-processors may access data from third countries in individual cases (e.g. for support or operations), this is based on the EU Standard Contractual Clauses that form part of Supabase’s data processing agreement.

How long?

Until we have informed you about the launch and early access and the purpose has been fulfilled, or until you withdraw your consent – whichever comes first. If the project is discontinued, we delete the waitlist entirely.

5. Contact by email or contact form

When you write to us, we process your email address, your name (if given), the chosen topic and the content of your message in order to answer it (Art. 6(1)(b) or (f) GDPR).

Messages from the contact form are stored in our database at Supabase in Frankfurt am Main (see section 4) and forwarded to us by email. For sending we use the service Resend (Resend, Inc., USA) as a processor; the transfer is based on the EU Standard Contractual Clauses in Resend’s data processing agreement. To prevent abuse, we limit the number of messages per email address and hour.

We delete messages once they are dealt with, at the latest after six months, unless retention obligations apply.

6. Browser storage

The page sets no cookies. If you actively switch the language, your browser remembers this choice in local storage (localStorage, key “entropilot-lang”). A campaign tag from the link is kept only for the current session in session storage (sessionStorage). These entries do not leave your browser – except for the campaign tag, which is saved with a waitlist sign-up – and are required for the function you requested (§ 25(2) no. 2 TDDDG). You can delete them in your browser at any time.

7. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). An email to the address above is enough.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the Hessian Commissioner for Data Protection and Freedom of Information (datenschutz.hessen.de).

8. No automated decisions

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

Note: This privacy policy is a carefully prepared template, not legal advice. Before going live, the postal address must be added and the details on service providers (contracts, region, transfer mechanisms) must be checked.