Privacy Policy

1. Data controller and contact

This policy explains how we process personal data when you visit this website, contact us or submit a waitlist request.

arflo GmbH
Managing Directors: Tobias Geiger and Florian Graßl
Nobelstraße 15
70569 Stuttgart
Germany

Email: florian.grassl@arflo.io. You can use this address for privacy questions and to exercise your rights.

2. Hosting and website security

Our website is hosted by Vercel Inc. To deliver pages and protect the service, Vercel processes technical request data, including IP address, requested page, request time, browser and operating-system information, and information about errors or suspected misuse.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are operating a reliable website, detecting technical problems and preventing abuse.

To limit repeated form submissions, we also use short-lived, pseudonymised counters based on the requesting IP address and recipient email address. They apply for ten-minute windows and do not include the contents of your enquiry.

We serve fonts and brand graphics locally. Information about Vercel's processing is available in its Privacy Notice.

3. Contact and waitlist requests

When you contact us, we process your name, email address, any company details and the message you provide to answer your enquiry and handle follow-up questions. A waitlist request is used to respond to your interest in arflo and discuss availability or a suitable next step.

Processing relating to a contract or steps you request before entering into a contract is based on Article 6(1)(b) GDPR. For other enquiries, the basis is Article 6(1)(f) GDPR and our legitimate interest in responding to business correspondence. Where we request a separate consent for a specific purpose, the basis for that purpose is Article 6(1)(a) GDPR.

Providing information is voluntary. The fields marked as required are needed to process the respective request; without them we cannot handle the request through the form. Company details are optional. You can also contact us directly by email.

Submitting a request does not automatically subscribe you to a marketing newsletter. We do not make decisions with legal or similarly significant effects about you by automated means on this website.

4. Email delivery and recipients

We use Resend, a service operated by Plus Five Five, Inc., to deliver contact and waitlist notifications to our contact inbox and send receipt confirmations to the address you provide. Resend processes the submitted contact details, message content and delivery information for this purpose.

The website does not maintain a separate database of form submissions. Correspondence is delivered by email and is processed through the hosting, email-delivery and mailbox services used to handle your enquiry.

The legal basis for delivering these messages follows the purpose of your request described above. Further information is available in the Resend Privacy Policy.

According to Resend's GDPR information, its Article 28 data-processing agreement applies to every account and is executed on registration. The agreement includes the EU Standard Contractual Clauses for international transfers.

5. Browser storage and optional analytics

We store your privacy selection, including whether you allow analytics and when you made that choice, in your browser's local storage. This is used to remember and respect your selection. It remains there until you change the selection or clear the website's browser data.

This necessary preference storage relies on Section 25(2)(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG). The associated processing is based on Article 6(1)(f) GDPR and our interest in respecting your privacy choices.

Vercel Web Analytics is activated only after you consent. It measures use of the website using information such as page URL, referrer, request time, browser, operating system, device type and approximate location derived from the request. Vercel describes visitor recognition using a request-derived hash that is discarded after 24 hours; this period concerns visitor recognition, rather than the retention of all statistics.

The basis for optional analytics is Article 6(1)(a) GDPR and, where information is stored on or accessed from your device, Section 25(1) TDDDG. Vercel states that Web Analytics works without third-party cookies. See Vercel Web Analytics privacy information for its description of the data processed.

You can refuse analytics, or withdraw or change your consent at any time, using the "Cookie Settings" button at the edge of the page. Withdrawal applies to future processing and does not affect the lawfulness of processing before withdrawal.

6. International processing

Vercel and Resend are US-based service providers. Their services can involve processing of personal data outside the European Economic Area, including in the United States.

Resend states that message content and delivery logs are stored in the United States. Choosing a European sending region changes email routing, not the storage location. Its Data Processing Addendum describes the EU Standard Contractual Clauses used for these transfers.

Vercel describes its international processing and transfer safeguards in its Data Processing Addendum. Please contact us for information about the safeguards applicable to your data and to request a copy.

7. Retention

We retain contact and waitlist correspondence for as long as it is needed to handle the request and its follow-up. If correspondence becomes part of a contractual relationship, legal retention obligations and the need to establish, exercise or defend legal claims can require longer retention. Data that is no longer needed for these purposes is deleted.

For our current email-delivery plan, Resend documents a 30-day retention period for email and log data and a seven-day backup retention period. These periods concern Resend's delivery copies and do not determine when correspondence is deleted from our mailbox. Earlier removal of a particular message can be requested through us.

For hosting runtime logs, retention depends on the hosting plan and enabled observability options, as described in Vercel's runtime-log documentation. Optional analytics has separate reporting windows; these windows do not establish when every copy of analytics data is deleted. You can contact us for information about the retention of your particular data.

8. Your rights

Subject to the applicable legal requirements, you have the right to access your personal data, obtain a copy, request correction or erasure, restrict processing and receive data in a portable format.

You can object to processing based on Article 6(1)(f) GDPR for reasons relating to your particular situation. Where processing is based on consent, you can withdraw that consent at any time with effect for the future.

You may lodge a complaint with a data-protection supervisory authority, in particular in the country where you live or work or where you consider an infringement to have occurred. The authority for Baden-Württemberg provides a complaint form and contact information.