// privacy

Privacy Policy

Last updated: 6 August 2026

This policy explains what personal data we process when you visitkusta.io or join our waitlist, why, and what rights you have. kusta is built EU-first: our infrastructure and your data stay within the EU.

1. Who is responsible

The controller within the meaning of the GDPR is:
Lars Keggenhoff
c/o Bürogemeinschaft EG, Widdersdorfer Straße 127A, 50825 Köln, Germany
Email: lars@kusta.io

Full provider details are in our imprint.

2. What we collect, and why

a) Waitlist sign-up

When you join the waitlist we process the email address you enter, plus the timestamp and confirmation of your opt-in. We use a double opt-in: you receive a confirmation email and are only added after you click the link.

• Purpose: to add you to the waitlist and send you a single notification when kusta launches (plus, if you consent, occasional product news).
• Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time (see §5) — every email includes an unsubscribe link.
• Retention: until launch and your onboarding, or until you unsubscribe/withdraw consent, whichever comes first. Unconfirmed sign-ups are deleted after a short period.

b) Server logs

When you load the site, our servers automatically record technical data (IP address, date/time, requested resource, referrer, browser/OS) for a short time.

• Purpose: to deliver the site securely and detect/​defend against abuse.
• Legal basis: our legitimate interest in a secure, functioning website (Art. 6(1)(f) GDPR).
• Retention: log data is kept for a short period (up to 14 days), then deleted or anonymised.

3. Cookies & tracking

This site sets no tracking or advertising cookies and uses no third-party analytics or trackers. Fonts are self-hosted — we do not load Google Fonts or other external CDNs.

Usage statistics

To understand which pages are useful, we run Umami, an open-source analytics tool, on our own servers (analytics.stack25.com, EU infrastructure). Nothing is sent to an analytics company; the data never leaves our hosting. The same applies to the kusta console.

• What is recorded: the page visited, the referring page, and coarse technical data (browser, operating system, device type, screen size, language, and an approximate location derived from your IP — country and region). In the console we record thepage type only (e.g. “server detail”), never the identifiers or tokens contained in a link.
• No cookies, no fingerprint: nothing is stored on or read from your device. Your IP address is used only in the moment of the request, to derive that approximate location and a daily rotating, non-reversible hash that counts you as one visitor for that day. The IP itself is never stored. There is no cross-site tracking and no advertising profile.
• Objecting: these statistics rest on our legitimate interest, so you can object at any time (see §5) — write to us and we will exclude you. We do not evaluate browser “Do Not Track” signals: the standard was never finalised and browsers handle it inconsistently.
• Legal basis: our legitimate interest in understanding and improving our own site (Art. 6(1)(f) GDPR). Because we store nothing on your device and read nothing from it, no consent banner is required (§ 25 TDDDG) — which is exactly why we chose this setup.
• Retention: individual page views are stored under that daily hash. Since the hash changes every day and cannot be reversed, they cannot be traced back to you or joined up across days.

4. Processors & recipients

We only share data with processors bound by a data processing agreement (Art. 28 GDPR):

• Brevo (Sendinblue GmbH / Brevo, EU) — stores the waitlist and sends the confirmation and launch emails. Data is processed on EU infrastructure.
• Hosting — the site runs on EU infrastructure (Hetzner Online GmbH, Germany). Server logs and the usage statistics from §3 are processed there.

Note that our analytics is not in this list: it runs on our own servers, so there is no analytics provider receiving your data.

We do not sell your data and do not transfer personal data outside the EU/EEA. Should that ever change, we will rely on an appropriate transfer mechanism (e.g. EU Standard Contractual Clauses) and disclose it here.

5. Your rights

Under the GDPR you have the right to:

• access your data (Art. 15), and to rectification (Art. 16) or erasure (Art. 17);
• restriction of processing (Art. 18) and data portability (Art. 20);
• object to processing based on legitimate interests (Art. 21);
• withdraw consent at any time with effect for the future (Art. 7(3)) — this does not affect prior processing;
• lodge a complaint with a supervisory authority (Art. 77).

To exercise any of these, email us at lars@kusta.io.

6. Changes

We may update this policy as the product evolves (e.g. when we add features or a new processor). The current version always lives at this URL, with the date at the top.

7. Contact

Questions about your data? Email lars@kusta.io or write to the address in §1.