Waitlist Privacy Policy

DRAFT — TO BE REVIEWED BY A LAWYER BEFORE LAUNCH

Version of November 7, 2026.

1. Data controller

[PUBLISHER NAME OR COMPANY], [ADDRESS]. Contact for any question about your data: [CONTACT EMAIL].

2. Data we collect

• Email address: to confirm your reservation and let you know when we open.
• Username and country you chose: to reserve your username and show the race of nations (only totals per country are published).
• Language: to write to you in your language.
• Referral link: who invited you, and how many people you invited.
• IP address fingerprint: an encrypted, irreversible fingerprint (never the address itself), to limit abuse and referral cheating.
• Dates of sign-up and confirmation, and your confirmation that you are 18 or older.

We do not collect your name, date of birth or photo during this period.

3. Legal bases

• Performing your reservation request (contract): email, username, country, language, referral.
• Our legitimate interest in preventing fraud: IP fingerprint, attempt limits.

4. What is public

Your username and Founder number appear on share images and on your invite link only if you share them. Your email address is never published, sold or rented.

5. Processors

• Supabase (database) — hosted in the United States (Virginia).
• Vercel (website hosting).
• Resend (email delivery).

Your data is stored and processed in the United States. If you live in the European Union, the United Kingdom or Switzerland, these transfers are covered by the European Commission's standard contractual clauses and, where applicable, the EU–US Data Privacy Framework.

6. Retention

• Unconfirmed reservation: deleted after 48 hours.
• Confirmed reservation: kept until the service opens, then up to 12 months after opening if you do not create an account.
• The secret link contained in the confirmation email is erased from our systems as soon as it is sent.
• Attempt-limit data: 2 days.

7. Your rights

You can access, correct or delete your data, object to its processing, or request a copy. Deletion is immediate from the link you received by email ("Delete my reservation"). For other requests: [CONTACT EMAIL].

If you live in the European Union, you can contact the data protection authority of your country (in France: CNIL, www.cnil.fr).

If you live in California (CCPA/CPRA): we do not sell or share your personal information for advertising; you have the rights of access, deletion and correction described above, without discrimination.

8. Minors

VANITY is for people aged 18 and over. If we learn that a reservation was made by a minor, it is deleted.

9. Cookies

The waitlist uses no advertising or audience-measurement cookies. See the cookie policy.