Privacy Policy

The controller responsible for the processing of personal data on this website within the meaning of Art. 4 (7) GDPR is:

Controller

Julian Zerback

Address

Lessingplatz 12, 55118 Mainz, Germany

Email

privacy@agoraos.net

No data protection officer has been appointed, as the statutory thresholds of Art. 37 GDPR and § 38 BDSG are not met.

This policy covers the website at agoraos.net and landing.agoraos.net, including api.landing.agoraos.net, which receives the sign-up forms. Its sole purpose at present is to present the Agora project, to collect sign-ups from early adopters and to send a newsletter. The Agora application itself is not yet available, and no user accounts, payments or in-product data exist. As soon as the product launches, this policy will be extended and a separate policy for the application will be published.

This website is built to process as little data as possible. Specifically:

• No analytics without consent. Analytics tools only run if you actively opt in, and are never used to build advertising profiles.

• No advertising. No advertising networks, no remarketing, no cross-site identifiers.

• No account, no payment. The site takes no postal address or payment data — only an email address and, optionally, a name and how you want to get involved, if you choose to sign up as an early adopter or for the newsletter.

• No social media plugins. Links to external services are plain hyperlinks; no social network buttons or embeds are loaded.

The optional analytics tools you can choose to allow are described in the following sections.

Analytics tools on this website only run after you have actively agreed to them in our consent banner. Until you make a choice, no analytics scripts are loaded and no analytics cookies are set. Rejecting is as easy as accepting, and the website works fully either way.

Storing or reading information on your device for analytics is based on your consent pursuant to § 25 (1) TDDDG; the subsequent processing of personal data is based on Art. 6 (1) (a) GDPR.

We remember your choice in your browser’s local storage so that we don’t ask on every visit. This is strictly necessary to respect your decision and does not require consent (§ 25 (2) no. 2 TDDDG). It contains only your choices and the date, and is kept for 12 months, after which we ask again.

Necessary

agora-consent (local storage) · 12 months

Analytics

_ga, _ga_<ID> (Google Analytics) · up to 2 years

Usability

_clck, _clsk, CLID, MUID (Microsoft Clarity) · 1 day to 1 year

You can change or withdraw your consent at any time with effect for the future via “Cookie settings” in the footer of every page. Withdrawal does not affect the lawfulness of processing carried out before it.

If you consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It helps us understand how visitors use this website — which pages are read, where visitors come from and where they leave — so that we can improve it.

Google Analytics processes information about your visit such as the pages viewed, time and duration of the visit, referring website, device type, browser, screen resolution and an approximate location derived from your IP address. In the EU, Google Analytics 4 does not log or store full IP addresses. The data is used in aggregate; we do not combine it with other data about you and do not use it for advertising.

Data may be transferred to Google LLC in the United States. Google LLC is certified under the EU–US Data Privacy Framework; in addition, the EU standard contractual clauses apply. The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR. Event data is retained for 2 months and then deleted automatically.

Further information: policies.google.com/privacy

If you consent, we use Microsoft Clarity, a service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity shows us how visitors interact with the page through heatmaps and session replays, so that we can find and fix usability problems.

Clarity records interactions such as mouse movements, clicks, scrolling and page changes, together with device and browser information and an approximate location. Text you type into form fields is masked and never recorded. Recordings are not linked to your name or email address.

Data may be transferred to Microsoft Corporation in the United States. Microsoft is certified under the EU–US Data Privacy Framework; in addition, the EU standard contractual clauses apply. The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR. Session recordings are kept for 30 days, aggregated heatmap data for up to 13 months.

Further information: privacy.microsoft.com/privacystatement

This website is hosted on a dedicated root server that we operate ourselves. The server is provided by netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany, and is located in netcup’s data centre in Nuremberg, Germany. netcup provides the infrastructure and therefore acts as a processor on our behalf under Art. 28 GDPR, on the basis of a data processing agreement. The website and its database run exclusively in Germany; only encrypted backups of the sign-up database are kept elsewhere in the EU (see below).

Each time the website is accessed, the web server automatically records technical data in log files:

• IP address of the requesting device

• Date and time of the request

• Requested page or file, referrer URL and HTTP status code

• Browser type, version and operating system as transmitted by your browser

This data is required to deliver the website, to ensure its stability and security, and to trace attacks. The legal basis is our legitimate interest in the secure and reliable operation of the website pursuant to Art. 6 (1) (f) GDPR. Log data is deleted no later than 30 days after collection, unless it is required for longer to investigate a specific security incident.

You can sign up as an early adopter of Agora, and you can subscribe to our newsletter. Both are voluntary and independent of each other; without your email address we cannot write to you.

Early adopters

Email address; optionally your name and how you want to get involved (e.g. testing early builds); date and time of sign-up, of the confirmation email and of confirmation

Newsletter

Email address; date and time of sign-up, of the confirmation email and of confirmation

Purpose

Early adopters: invitations to test rounds and early builds, and updates on Agora. Newsletter: updates on what we are building and learning, about once a month

Legal basis

Consent, Art. 6 (1) (a) GDPR

Storage

Our own database on our root server in Nuremberg, Germany

Backup

Encrypted backups on Cloudflare R2 object storage, EU region

Email provider

Resend (Resend, Inc., USA), acting as processor: sends the emails from its EU region (Ireland) and keeps our contact list

Retention

Until you unsubscribe or otherwise withdraw your consent; unconfirmed sign-ups 7 days after the confirmation email

We use the double opt-in procedure: after signing up you receive an email with a confirmation link. Only when you confirm on the page it opens are you added to the list, and we then send you one welcome email. If you don’t confirm, we delete your data 7 days after the confirmation email. Messages are delivered through Resend, a transactional email service provided by Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. To send you a message, your email address, your name if you gave one and the content of that message are transmitted to Resend, which also records delivery events such as successful delivery, bounces and unsubscribes. Resend processes this data solely on our instructions as a processor under Art. 28 GDPR, on the basis of a data processing agreement including the EU standard contractual clauses. We use Resend’s EU region, so messages are processed and sent from servers in Ireland. Resend also keeps our contact list: for every confirmed address, the address, your name if you gave one, and which of our lists you are on. When you unsubscribe from a list, you are removed from it there too, and once you are on none of our lists, your contact is deleted at Resend, usually within minutes. The contact list is not bound to the sending region and may be stored in the United States. As Resend, Inc. is based in the United States, access from the USA cannot be ruled out in any case; such transfers are covered by the standard contractual clauses.

We record the times of sign-up and of confirmation in order to be able to demonstrate your consent. Your data is used exclusively for messages about Agora. It is never sold, rented or passed on for advertising purposes.

You may withdraw your consent at any time with effect for the future — via the unsubscribe link in our emails, where you choose which emails to stop, via your email program’s unsubscribe function, or by emailing us. Following withdrawal, your data will be deleted from the live database and from our contact list at Resend without delay, and will disappear from the backups within 30 days as they rotate. After unsubscribing on our website we send you one last email confirming it. If you tell us there why you unsubscribed, we store only the reason you picked, not your address. The lawfulness of processing carried out up to the point of withdrawal remains unaffected.

Personal data is passed on to third parties only where this is necessary to operate the website, and only to processors bound by a data processing agreement under Art. 28 GDPR:

• netcup GmbH, Germany. Server infrastructure; data centre in Nuremberg.

• Cloudflare, EU region. Encrypted backups of the sign-up database.

• Resend, Inc., USA. Delivery of emails to early adopters and newsletter subscribers, from its EU region (Ireland), and our contact list of them.

• Google Ireland Limited. Google Analytics, with your consent only.

• Microsoft Ireland Operations Limited. Microsoft Clarity, with your consent only.

The website itself and the sign-up database are stored on servers in Germany. Transfers to the United States can occur because our email provider is a US company, even though it sends from the EU, and — only if you consent — for analytics. These transfers are based on the EU standard contractual clauses pursuant to Art. 46 (2) (c) GDPR and, where applicable, on the recipient’s certification under the EU–US Data Privacy Framework. You can find further details in the sections on Google Analytics 4, Microsoft Clarity and on early adopters and the newsletter above.

This website is delivered exclusively over an encrypted TLS connection (HTTPS), recognisable by the lock icon in your browser. Backups are stored in encrypted form. Access to the sign-up database is limited to the controller and protected by multi-factor authentication.

Under the GDPR you have the following rights in respect of your personal data:

• Access (Art. 15). You may request confirmation of whether we process data concerning you, and receive a copy of that data.

• Rectification (Art. 16). You may have inaccurate data corrected and incomplete data completed.

• Erasure (Art. 17). You may request the deletion of your data, provided no statutory retention obligation applies.

• Restriction (Art. 18). You may request that processing be restricted instead of deleted.

• Data portability (Art. 20). You may receive the data you provided in a structured, machine-readable format.

• Objection (Art. 21). You may object to processing based on our legitimate interest.

• Withdrawal of consent (Art. 7 (3)). You may withdraw consent you have given at any time with effect for the future.

To exercise any of these rights, an email to the address given above is sufficient. We will respond within one month.

You also have the right to lodge a complaint with a supervisory authority. The authority competent for us is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate, Hintere Bleiche 34, 55116 Mainz, Germany. You may alternatively contact the supervisory authority of your place of residence.

We will amend this policy when changes to the website or to the law make it necessary — in particular when the Agora application launches. The current version always applies, and is identified by the version number and date at the top of this page.