Privacy policy

Last updated: October 11, 2026. This is a translation of the German Datenschutzerklärung, which is the legally binding version.

We take your privacy seriously and collect as little as possible: this website uses no analytics or tracking tools, no advertising and no embedded content such as videos or externally hosted fonts. The only exception is a spam check by Cloudflare that loads only when you use one of our forms (section 2). Below we explain which data is still processed, why, and what rights you have.

1. Controller

Partners: Robin Holland, Michelle Kosminski

More details in the imprint.

2. Hosting (Cloudflare)

This website is delivered through the platform of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA ("Cloudflare"). Cloudflare runs a global server network that delivers the pages, protects them against attacks and processes our forms. The waitlist database (see section 5) is also hosted by Cloudflare.

Every time you visit the website, Cloudflare processes technically necessary connection data, in particular your IP address, date and time of access, the requested address, the amount of data transferred, the referrer URL and browser and operating system details (user agent). The website cannot be delivered without this data. We do not keep our own access logs and do not analyse this data.

To protect our forms against abuse (e.g. mass signups of other people's email addresses), we briefly count how many requests arrive from an IP address within one minute. The IP address is not stored permanently for this.

To fend off attacks and automated access, Cloudflare may set strictly necessary cookies (e.g. __cf_bm or cf_clearance) that enable bot protection and expire after a short time (__cf_bm after 30 minutes).

The legal basis is our legitimate interest in providing the website securely and reliably (Art. 6(1)(f) GDPR). Storing these security cookies is strictly necessary for this service (§ 25(2) no. 2 TDDDG).

We have a data processing agreement with Cloudflare (Art. 28 GDPR). Data may be transferred to the USA. Cloudflare is certified under the EU-US Data Privacy Framework, which is covered by an adequacy decision of the European Commission (Art. 45 GDPR); EU Standard Contractual Clauses apply in addition. More information: Cloudflare privacy policy.

Spam protection for forms (Cloudflare Turnstile)

To protect the waitlist and contact form against automated abuse, we use Cloudflare Turnstile. Turnstile is only loaded once you click into one of these forms. Cloudflare then checks technical characteristics — such as your IP address, browser and device properties and your interaction with the check — to determine whether the request comes from a human. Information may be stored on or read from your device for this. Usually you won't notice anything; only in doubtful cases does a short check appear for you to click. The data is not used for advertising or tracking.

The legal basis is our legitimate interest in protection against spam and abuse (Art. 6(1)(f) GDPR). Access to your device is strictly necessary to provide the form you are using securely (§ 25(2) no. 2 TDDDG). Data processing and transfers to the USA are covered as described above for Cloudflare. More information: Turnstile privacy notice.

3. Fonts

The fonts used (Geist and Instrument Sans) are served from our own server. Loading the page does not connect to Google or any other font provider.

4. Cookies and local storage

We do not use tracking or advertising cookies. If you actively choose a language with the language switcher (EN/DE), we store that choice in the cookie lf_lang (value "en" or "de", kept for one year) so the site shows up in your language next time. The cookie is only set at your explicit request and is strictly necessary for that (§ 25(2) no. 2 TDDDG); the subsequent processing is based on our legitimate interest in a user-friendly presentation (Art. 6(1)(f) GDPR). You can delete the cookie in your browser at any time. For Cloudflare's strictly necessary cookies, see section 2.

5. Waitlist

When you join the waitlist, we process your email address, the language of the website you used, the time of signup and confirmation, the version of the consent text, and randomly generated codes for your personal confirmation and unsubscribe links.

Purpose: We send you a single message once LifeFactors is available or we are looking for early testers. There is no ongoing newsletter.

Double opt-in: After signing up you receive an email with a confirmation link. You are only added to the list once you click it. This ensures nobody signs up with someone else's email address. Unconfirmed signups are deleted automatically after 7 days.

Legal basis is your consent (Art. 6(1)(a) GDPR, § 7(2) no. 2 UWG). Storing the signup and confirmation times and the consent text version serves as proof of consent and is based on our legitimate interest (Art. 6(1)(f) GDPR).

Withdrawal: You can withdraw your consent at any time with effect for the future — via the unsubscribe link in every email we send, via the contact form or by email to hello@lifefactors.app. Your data is then deleted.

Retention: We delete the list once the announcement has been sent, and at the latest if we discontinue the project.

Storage and delivery: The list is stored in a database at Cloudflare (see section 2). We send the confirmation email via the delivery service Resend and the announcement from our iCloud Mail mailbox (both see section 6).

6. Contact form and email

When you write to us via the contact form or by email, we process the data you provide (email address, optionally your name, your message) to answer your request. Messages from the contact form are not stored in a database; they are forwarded as an email to our mailbox.

For this forwarding and for the waitlist confirmation emails we use the email delivery service Resend, operated by Plus Five Five, Inc., USA. We have a data processing agreement with Resend (Art. 28 GDPR). Resend is certified under the EU-US Data Privacy Framework (adequacy decision under Art. 45 GDPR). More information: Resend privacy policy.

Our mailbox is provided by iCloud Mail, offered in the EU by Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Data may be transferred to Apple Inc. in the USA; Apple Inc. is certified under the EU-US Data Privacy Framework. More information: Apple privacy policy.

The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract, and otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We delete your message once your request has been fully dealt with, unless statutory retention obligations apply.

7. Your rights

Within the limits of the law, you have the right at any time to

• access the data we hold about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdraw consent with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): Where we process data based on legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation.

For any of these, an informal message to hello@lifefactors.app or via the contact form is enough.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your residence, place of work or the place of the alleged infringement.

8. Further information

Providing your data is not required by law or contract. Without your email address, however, we cannot add you to the waitlist or reply to you. No automated decision-making or profiling takes place.

This website uses TLS encryption for security (recognisable by "https://" in the address bar).

We update this privacy policy when the website or the law changes. The version published here applies.