Privacy policy

Last updated: 26 October 2026

1. Who is responsible?

For any privacy questions and to exercise your rights, contact us at peter@ghostcutter.ai.

2. Summary

• This website sets no cookies, uses no analytics or advertising trackers and loads no external fonts.
• We only collect data when you join the waitlist: your email address and, if you like, your Instagram or TikTok handle.
• You can withdraw your consent at any time, using the unsubscribe link in our email or by writing to peter@ghostcutter.ai.

3. Visiting the website (hosting by Cloudflare)

This website is delivered via Cloudflare (Cloudflare Pages and Cloudflare Workers). When you visit it, Cloudflare processes technically necessary connection data: IP address, date and time, requested address, amount of data transferred, browser and device type, and the previously visited page (referrer). This is necessary to deliver the website and protect it against attacks.

The legal basis is our legitimate interest in a secure and functioning website (Art. 6(1)(f) GDPR). We do not analyse this data ourselves and do not keep our own access logs with IP addresses. Cloudflare processes the data as our processor (Art. 28 GDPR).

Provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare is certified under the EU-US Data Privacy Framework; EU Standard Contractual Clauses apply in addition. More: cloudflare.com/privacypolicy.

4. Waitlist

What data?

• Email address (required)
• Instagram or TikTok handle (optional)
• Page language (German or English), time of sign-up, confirmation status (unconfirmed/confirmed), time of the confirmation email and of your confirmation
• technical: a sequential number and non-reversible check values (hashes) for your confirmation and unsubscribe links

What for?

We inform you by email about the launch of Ghostcutter™ and, when the time comes, invite you as a Founding Creator or tester. Your handle helps us assign the first spots. We do not use the data for anything else and do not pass it on for advertising.

Legal basis

Your consent (Art. 6(1)(a) GDPR), which you give by ticking the box in the form. You can withdraw it at any time with effect for the future (Art. 7(3) GDPR); processing carried out before the withdrawal remains lawful. Providing the data is voluntary; without an email address we cannot add you to the list.

Confirmation process (double opt-in)

After you submit the form, we first store your details with the status “unconfirmed”. You then receive an email with a confirmation link. Only when you click the link are you firmly on the waitlist; we store the time of confirmation as proof of your consent. During the launch phase, the confirmation email may arrive a few days after you sign up.

How long?

• Unconfirmed entries are deleted automatically 7 days after the confirmation email was sent if you have not confirmed by then.
• Confirmed entries are kept until you withdraw your consent or the purpose no longer applies, i.e. once we no longer need the waitlist after the launch of Ghostcutter™. We then delete them.
• If you withdraw your consent, we delete your entry immediately.

Where is the data stored?

In a Cloudflare database (Cloudflare D1) restricted to data centres in the European Union (EU data location). Cloudflare acts as our processor (see section 3).

5. Spam protection with Cloudflare Turnstile

To keep bots off the waitlist, we use Cloudflare Turnstile. Turnstile only loads once you use the form. Cloudflare then processes your IP address and characteristics of your browser and device to tell humans from automated access. Turnstile does not set advertising cookies for this.

The legal basis is our legitimate interest in preventing abuse and spam (Art. 6(1)(f) GDPR). The provider is Cloudflare, Inc. (details in section 3). More: cloudflare.com/turnstile-privacy-policy.

6. Protection against too many requests

To limit abuse, we count sign-up attempts per IP address. For this we only store a hashed value of the IP address together with a counter and delete it after 2 days at the latest. Legal basis: Art. 6(1)(f) GDPR.

7. Sending emails with Brevo

We send the confirmation email via Brevo. Brevo processes your email address, the content of the email and technical delivery data (e.g. whether the email was delivered). Brevo acts as our processor (Art. 28 GDPR) and processes the data in the European Union.

Provider: Sendinblue SAS (Brevo), 106 boulevard Haussmann, 75008 Paris, France. More: brevo.com/legal/privacypolicy.

8. Internal notification via Telegram

When someone signs up, our team receives a short Telegram message. It only contains the sequential number, your handle (if provided) and the language, never your email address. The legal basis is our legitimate interest in noticing new sign-ups promptly (Art. 6(1)(f) GDPR). The messenger is provided by Telegram (Telegram Messenger Inc. or Telegram FZ-LLC, Dubai, United Arab Emirates); this may involve a transfer to a country outside the EU for which there is no EU adequacy decision.

9. Recipients at a glance

• Cloudflare, Inc. (hosting, database with EU data location, spam protection)
• Sendinblue SAS / Brevo (sending the confirmation email)
• Telegram (internal notification without email address)

There is no automated decision-making or profiling.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where we process data based on our legitimate interest, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). You can withdraw any consent at any time. An email to peter@ghostcutter.ai is enough.

Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work. Our competent authority is the Estonian Data Protection Inspectorate: Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, Estonia, www.aki.ee.

11. Changes

If our service or the legal situation changes, we will update this privacy policy. The version published here applies.