Privacy policy
The short version
- This site collects what you type into the founding-group form, plus how you found the site. That’s it.
- No cookies, no ad trackers, no tracking pixels. Visitor counts come from Plausible, which is cookieless and stores no personal data.
- I use your answers to reply to you, invite you to a call and decide what to build. Nothing is sold or shared for marketing.
- If I stop the project, I delete the waitlist within 30 days.
- Email me anytime to see, fix or delete your data.
1. Who is responsible
The controller of your personal data is Filippo Santarelli, Łódź, Poland, contact: hello@velunehq.com.
Velune is currently a project in validation run by one person, not a registered company. If that changes, I’ll update this policy and tell everyone on the waitlist who the new controller is.
2. What this policy covers
This website, the founding-group waitlist, and the emails and calls that follow from it. It does not cover the Velune product itself. When the product launches, agencies will sign separate terms and a data processing agreement: for the data inside client portals, the agency decides what is processed and Velune acts only on its instructions.
3. What I collect, why, and for how long
| Data | Why | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Form answers: name, work email, agency website, number of retainer clients, tools, how you track value, your free-text answer, interest in founding pricing | Reply to you, schedule a call, offer a founding place, decide whether and what to build | Steps you asked for before a possible contract (Art. 6(1)(b)); my legitimate interest in validating the product (Art. 6(1)(f)) | 12 months after our last contact, or 30 days after the project stops, whichever comes first |
| How you arrived: referring page and campaign tags (UTM) in the link, time of sign-up | Know which channels bring relevant agencies | Legitimate interest (Art. 6(1)(f)) | Same as form answers |
| Build updates (only if you ticked the box) | Send occasional progress emails, at most one a month | Your consent (Art. 6(1)(a)), withdrawable anytime | Until you unsubscribe or the project stops |
| Emails and call notes | Continue the conversation; product research | Legitimate interest (Art. 6(1)(f)) | Same as form answers. Calls are not recorded unless I ask at the start and you agree. |
| Deposit (only if you agree to pay one on a call): name, email, amount, date. Card details go to Stripe and I never see them | Hold your founding place and refund it if you ask | Steps before a contract and the contract itself (Art. 6(1)(b)); accounting and tax obligations (Art. 6(1)(c)) | As long as tax and accounting law requires |
| Site statistics (Plausible) | Count visits and sign-ups in aggregate | Legitimate interest (Art. 6(1)(f)) | Only aggregate numbers are kept. Your IP address is used briefly to create a daily-changing anonymous identifier and is not stored. |
| Technical logs kept by the hosting provider (IP address, browser, time) | Deliver the site and keep it secure | Legitimate interest (Art. 6(1)(f)) | Up to 30 days (Netlify’s access logs) |
Only your email is required, because I can’t reply without it. Everything else is optional. Please don’t include your clients’ names or personal details in the free-text answer.
Where I rely on legitimate interest, I’ve weighed it against your interests: the data is limited to what an agency owner would expect when joining a waitlist, and you can object at any time.
4. What I don’t do
- No cookies. The only thing stored in your browser is your light or dark theme choice, if you pick one.
- No advertising networks, social media pixels or session recording.
- No selling, renting or sharing your data for others’ marketing.
- No automated decisions or profiling with legal or similar effects.
5. Who processes data for me
These providers handle data on my behalf, under data processing terms:
| Provider | What for | Where |
|---|---|---|
| Netlify, Inc. | Serving this website | Global network, US company (see section 6) |
| Supabase, Inc. | Storing form submissions | EU region |
| Make (make.com) | Sending me an email when someone joins, with the form answers | EU region |
| Porkbun LLC and Google (Gmail) | Forwarding and receiving email | US companies (see section 6) |
| Cal.com, Inc. | Booking a call, only if you choose to | US company (see section 6) |
| Stripe | Taking and refunding the deposit, only if you pay one | EU (Stripe Payments Europe, Ireland) |
| Plausible Insights OÜ | Cookieless visit statistics | EU |
| BunnyWay d.o.o. (Bunny Fonts) | Delivering the fonts on this page; your IP address is used to deliver the files | EU |
6. Transfers outside the EU
I choose EU-hosted options where they exist. If a provider can access data from outside the European Economic Area, for example for support, the transfer is covered by an EU adequacy decision (such as the EU–US Data Privacy Framework) or by the European Commission’s Standard Contractual Clauses.
7. Your rights
You can ask me to:
- show you the data I hold about you and give you a copy (access, portability);
- correct it (rectification);
- delete it (erasure) or pause its use (restriction);
- stop using it where I rely on legitimate interest (objection);
- withdraw consent for build updates, without affecting anything sent before.
Email hello@velunehq.com. I’ll answer within one month, usually much sooner. If you think I’ve handled your data wrongly, you can complain to the Polish data protection authority, the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl, or to the authority in the country where you live or work.
8. Security
Access to waitlist data is limited to me, on accounts protected by two-factor authentication. If a breach is likely to put your rights at risk, I’ll notify the supervisory authority within 72 hours and tell you directly if the risk is high.
9. Age
This site is for businesses. It is not meant for anyone under 16, and I don’t knowingly collect their data.
10. Changes
Each sign-up records the policy version in force at the time. If I change this policy in a way that matters, I’ll update the version date above and email the waitlist before the change applies.