Privacy Policy

1. Controller

Sinisa Milojevic
Birkbuschstr. 11
12167 Berlin, Germany
Email: info@it-metis.com

2. What data we process

Category	Examples
Waitlist and contact data	Email address, referral/source, UTM parameters, referrer, timestamps, invite status.
Account data	Email address, password hash, user ID, tier, account timestamps, notification preferences.
Session and security data	Session IDs, token-related session state, service logs, abuse-prevention and diagnostic data.
Subscription data	Stripe customer ID, Stripe subscription ID, plan/tier status, billing state metadata.
Technical usage data	HTTP request metadata, IP-address-derived server logs, operational telemetry, and email delivery logs.
Browser storage	The authenticated app stores sign-in state in browser local storage under auth-storage.

3. Why we process data and legal bases

• Waitlist handling and contact updates - Article 6(1)(b) and 6(1)(f) GDPR.
• Account creation, authentication, and subscription delivery - Article 6(1)(b) GDPR.
• Security, fraud prevention, and service operations - Article 6(1)(f) GDPR.
• Billing, tax, and recordkeeping obligations - Article 6(1)(c) GDPR.
• Optional communications where consent is required - Article 6(1)(a) GDPR.

4. Processors and recipients

Provider	Purpose
Amazon Web Services (AWS)	Hosting, storage, databases, Lambda compute, and email delivery infrastructure in the EU region eu-west-1.
Stripe	Checkout, subscription billing, payment-related customer and subscription metadata.

5. International transfers

Some providers, particularly Stripe, may process personal data outside the EEA. Where applicable, processing relies on contractual and organizational safeguards intended to protect personal data in accordance with GDPR requirements.

6. Retention

• Waitlist records - retained while the waitlist remains active, until deletion is requested, or until the record is no longer operationally relevant.
• Account and subscription records - retained for the life of the account and thereafter as needed for legal, tax, fraud-prevention, and audit obligations.
• Sessions - short-lived and automatically expire according to service configuration.
• Operational logs - retained only as long as reasonably necessary for security and troubleshooting.

7. Cookies and local storage

The public landing pages are not designed around marketing cookies. The authenticated app uses browser local storage to keep sign-in state. If you clear browser storage or sign out, that local state is removed from your browser.

8. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or objection in relation to your personal data. You may also lodge a complaint with a supervisory authority, including the Berlin Commissioner for Data Protection and Freedom of Information.

9. Contact

For privacy-related questions or requests, email info@it-metis.com.

10. Changes

This policy may be updated from time to time to reflect product, legal, or operational changes. The date above indicates the latest revision.