← Back to the home page

Privacy policy

As of October 2026. This translation is provided for convenience; the German Datenschutzerklärung is authoritative. It covers the EntroPilot website and waitlist. The EntroPilot platform itself is not yet publicly available.

1. Controller

Muhammed Enes Bayraktutan
Frankfurter Landstraße 63
64291 Darmstadt
Email: muhammed-enes.bayraktutan@h-da.de

No data protection officer has been appointed, as there is no legal obligation to do so.

2. In short

• This website sets no cookies and uses no tracking, analytics or advertising services.
• No external fonts, scripts or third-party content (CDNs) are loaded.
• We only process personal data when you join the waitlist or email us – and as technically required to deliver the page.

3. Website hosting (Cloudflare Pages)

The website is delivered via Cloudflare Pages, provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you visit the page, Cloudflare processes technically necessary connection data, in particular your IP address, date and time, the requested file and browser and device information, in order to deliver the page and protect it against attacks.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and stable provision of the website. A data processing agreement (Data Processing Addendum) is in place with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework; the EU Standard Contractual Clauses apply in addition. A transfer to the USA is therefore possible. We do not analyse access logs ourselves.

4. Waitlist

What data?

Your email address is required. Your name, your situation (e.g. studying, founding, advising) and your university or organisation are optional. We also store the page language, the time of sign-up, the wording of your consent and – if present – a campaign tag from the link (e.g. “innoday26” if you arrive via an event QR code). This tag contains no personal data.

For what purpose?

Solely to inform you about the launch of EntroPilot and early access and – in aggregated form – to understand which groups are interested. We do not sell data or pass it on for advertising.

Legal basis

Your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future (Art. 7(3) GDPR) by simply emailing muhammed-enes.bayraktutan@h-da.de. The lawfulness of processing up to that point remains unaffected.

Where is the data stored?

The waitlist is held in a database at Supabase, Inc., which we use as a processor under Art. 28 GDPR. The database runs in the Frankfurt am Main region (EU). When you submit the form, Supabase also processes your IP address for technical reasons. Where Supabase or its sub-processors may access data from third countries in individual cases (e.g. for support or operations), this is based on the EU Standard Contractual Clauses that form part of Supabase’s data processing agreement.

How long?

Until we have informed you about the launch and early access and the purpose has been fulfilled, or until you withdraw your consent – whichever comes first. If the project is discontinued, we delete the waitlist entirely.

5. Contact by email

If you email us, we process your email address and the content of your message in order to reply (Art. 6(1)(b) or (f) GDPR). The message is deleted once it has been dealt with and no retention obligations apply.

6. Browser storage

The page sets no cookies. If you actively switch the language, your browser remembers this choice in local storage (localStorage, key “entropilot-lang”). A campaign tag from the link is kept only for the current session in session storage (sessionStorage). These entries do not leave your browser – except for the campaign tag, which is saved with a waitlist sign-up – and are required for the function you requested (§ 25(2) no. 2 TDDDG). You can delete them in your browser at any time.

7. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). An email to the address above is enough.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the Hessian Commissioner for Data Protection and Freedom of Information (datenschutz.hessen.de).

8. No automated decisions

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

Note: This privacy policy is a carefully prepared template, not legal advice. Before going live, the postal address must be added and the details on service providers (contracts, region, transfer mechanisms) must be checked.