Privacy Policy

Last updated: March 2026

1. Data controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Oleg Butov
ZHAR
Berlin, Germany
Email: privacy@zhar.cc

2. What we collect

2.1 Waitlist and newsletter

When you sign up for the waitlist we collect:

• Email address
• Timestamp of subscription
• IP address (stored as a cryptographic hash for abuse prevention; the plain-text IP is not retained)

2.2 Server log data

Each time you visit the site, our hosting provider (Microsoft Azure) automatically collects information transmitted by your browser:

• IP address of the requesting device
• Date and time of the request
• Referrer URL
• Browser type and operating system

This data is processed solely for secure operation and deleted automatically after no more than 30 days.

3. Legal basis for processing

• Consent (Art. 6(1)(a) GDPR): Signing up for the waitlist and receiving product updates is based on your explicit consent, which you may withdraw at any time.
• Legitimate interest (Art. 6(1)(f) GDPR): Processing server log data is necessary to ensure the security and stability of our website.
• Contractual necessity (Art. 6(1)(b) GDPR): Where processing is required to provide our services.

4. How we use your data

We use your email address exclusively for:

• Beta access notifications
• Product updates and release announcements
• Product-related communications you requested

We do not sell your data. We do not share your email with advertising networks or data brokers.

5. Processors and data sharing

• Microsoft Azure (Microsoft Corporation) — hosting, Azure Table Storage for subscriber records, Azure Blob Storage for media files. Data centre in the EU (West Europe). Data processing agreement per Art. 28 GDPR is in place.
• Brevo (formerly Sendinblue) (Sendinblue GmbH, Berlin) — email delivery for newsletters and product updates. Processing within the EU. Data processing agreement per Art. 28 GDPR is in place.
• Google Analytics (Google Ireland Limited) — only with explicit consent (see Section 7). We use IP anonymisation. Google may process data in the US under EU Standard Contractual Clauses.

6. International data transfers

Where data is transferred to recipients outside the EEA (in particular when Google Analytics is enabled), such transfers are safeguarded by EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) or an adequacy decision of the European Commission.

7. Analytics and cookies

Our website sets no tracking cookies by default. Analytics (Google Analytics) are loaded only after your explicit consent. You may withdraw consent at any time by clearing your browser cookies or contacting us.

Analytics are used solely to understand site quality, not for ad personalisation.

8. Retention

We retain your email address for as long as you remain subscribed to the waitlist or wish to receive product updates. After you withdraw consent or request deletion, your personal data is deleted without undue delay, unless statutory retention obligations apply.

9. Your rights

Under the GDPR you have the right to:

• Access (Art. 15): Request information about the personal data we hold about you.
• Rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Erasure (Art. 17): Request deletion of your personal data, where no statutory retention obligation exists.
• Restriction of processing (Art. 18): Request restriction of processing under certain conditions.
• Data portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format.
• Object (Art. 21): Object to processing based on legitimate interests on grounds relating to your particular situation.
• Withdraw consent (Art. 7(3)): Withdraw any consent you have given, with effect for the future.

10. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement (Art. 77 GDPR).

The supervisory authority for our location is:

Berlin Commissioner for Data Protection and Freedom of Information
(Berliner Beauftragte für Datenschutz und Informationsfreiheit)
Friedrichstr. 219, 10969 Berlin
www.datenschutz-berlin.de

11. Changes to this policy

We may update this privacy policy to reflect changes in legal requirements or our services. The current version is always available on this page.

12. Contact

Privacy requests: privacy@zhar.cc