Privacy Policy

1. Who we are

The controller responsible for the personal data described here is the operator of this website, established in Germany. "We" and "us" below mean that operator. We decide the purposes and means of the processing set out in this policy and are accountable for it under Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and the German Federal Data Protection Act (BDSG).

Our contact details are in the final section. Because we are established in Germany, our lead supervisory authority is the data protection authority of the German federal state in which we are established. You may also complain to the supervisory authority of the EU or EEA country where you live or work, or where you believe an infringement occurred — you do not have to come to Germany to raise a concern.

2. What this site does

We publish research about business opportunities created by new European regulation. Most pages describe a product that does not exist and offer a waitlist. Some pages offer a written analysis for sale.

There are two, and only two, kinds of personal data involved: what you type into a waitlist form, and what we can tell about a visit from the request your browser makes. Both are described below.

3. Waitlist data

If you join a waitlist we collect your email address and a record of your consent — the date and time it was given and the notice that was shown to you at the time.

That is all. We do not ask for a name, we do not create an account, and we do not collect any special category of data within the meaning of Article 9 GDPR.

4. Why we may write to you, and on what basis

We use your email address for one purpose: to contact you about the specific product whose waitlist you joined — chiefly to tell you if it is ever built.

The legal basis is your consent, Article 6(1)(a) GDPR. Consent is entirely voluntary, and refusing it costs you nothing but the email.

You may withdraw your consent at any time, with no effect on the lawfulness of anything we did before you withdrew it. Use the unsubscribe link in any message we send, or write to us using the details in the last section. We will stop processing your address for this purpose promptly on request.

5. Counting page views

Every page view on this site is counted on our server, so that we know which of the research we publish is actually read.

For each view we record: which page was requested, the country and region derived from the IP address, a coarse device category (mobile, tablet or desktop), the domain name of the website that referred you, if any, and a flag noting whether the request looked like an automated crawler rather than a person.

We do not store your IP address. We do not record a precise location, a postal code, or the name of your internet provider. We place no cookie and no similar technology on your device for this, and we read nothing from your device: every field above is derived from the information your browser had to send in order for us to deliver the page at all.

The legal basis is our legitimate interest under Article 6(1)(f) GDPR. Our interest is knowing which published research anyone reads, which is the only way a project like this can decide what to work on next. We consider the impact on you to be minimal precisely because no identifier is created or stored on your device, and you can object at any time (see the section on your rights).

6. Telling a repeat visit from a new one

To distinguish a returning reader from a new one without identifying either, we compute a one-way cryptographic hash from your IP address and your browser's user-agent string, using a random secret key.

That key is replaced every 24 hours and permanently destroyed after 48. Once it is gone, the hash cannot be reversed, recomputed or matched against anything — by us or by anyone else. In practice this means visits stop being linkable to one another after a day, and no stable identifier for you is ever created.

The inputs to the hash are the same request information described in the previous section. Nothing is read from your device to produce it.

7. Measuring how a page is read — only if you accept

If, and only if, you accept the banner shown on your first visit, we additionally record how long you actively spend reading a page, how far down it you scroll, and clicks on a small number of specifically marked elements such as the sign-up button.

The legal basis is your consent, Article 6(1)(a) GDPR. Refusing changes nothing about the site: every page behaves identically, and you will not be asked again.

Your choice is stored locally in your browser. Keeping a record of a consent decision is strictly necessary in order to honour it, so that storage does not itself require consent. You can reverse the choice at any time by clearing this site's data in your browser, which brings the banner back.

If your browser sends a Global Privacy Control signal, we treat that as a refusal, do not show the banner, and do not measure interaction — regardless of any earlier choice.

8. What we deliberately do not do

We run no advertising and we work with no advertising network. We do not track you across other websites or across your devices. We build no profile of you, and we make no automated decision about you. We do not sell, rent or share your personal data.

There is no third-party analytics script on this site, and no social-media or advertising pixel of any kind.

9. How long we keep things

Waitlist data: no longer than necessary, and in practice no more than 24 months after your last meaningful interaction with us. After that, or on withdrawal of consent, the address and its consent record are deleted.

Analytics: the detailed statistics described in sections 5 to 7 are kept for approximately three months. After that only monthly totals remain — aggregate counts that identify nobody and cannot be traced back to any visit.

10. Who processes the data for us

Cloudflare, Inc. hosts this website and stores the analytics described above, acting as our processor under a data processing agreement. Cloudflare serves this site from data centres in the European Union wherever possible; where any transfer outside the EEA occurs, it is covered by the European Commission's Standard Contractual Clauses.

A small number of other providers act as processors for email delivery and storage, each under a data processing agreement that permits them to act only on our instructions. Nobody receives your data for their own purposes.

11. Your rights

Under the GDPR you have the right to access your personal data, to have inaccurate data corrected, to have your data erased, to have processing restricted, and to receive your data in a portable form.

Where we rely on consent — the waitlist, and interaction measurement — you may withdraw it at any time, as described above.

Where we rely on legitimate interest — the page-view counting in sections 5 and 6 — you have the right to object under Article 21 GDPR. To object, write to us at the address in the next section and we will stop counting requests attributable to you. You can also enable Global Privacy Control in your browser, which we honour as an objection to the interaction measurement.

You may lodge a complaint with a supervisory authority at any time, in Germany or in your own country of residence, and you do not need to contact us first.

12. Contacting us

Write to privacy@claritano.com with any request under this policy, including access, deletion, or an objection to analytics. We answer within one month, as the GDPR requires, and we will tell you if we need longer.

To make a request about your waitlist entry, please write from the address you signed up with, or tell us which address it was — that is the only identifier we hold, so it is the only way we can find your record.