Version 2026-10-20. This policy applies to the Heimvo waitlist.

Privacy policy: Heimvo waitlist

1. Controller

Carlos Carbajal, a private individual based in Palma, Illes Balears, Spain. Postal contact address: General Ramon Despuig 5, Bja A, 07013 Palma de Mallorca, Illes Balears, Spain. Privacy contact: [email protected]. Heimvo is a project in preparation; no company has been formed yet.

2. What we store

• Your email address.
• Your preferred language (EN/DE/ES), only if you choose one.
• Which campaign link brought you here (utm_source, utm_medium, utm_campaign), if the link you used contained them.
• When you signed up and when you confirmed, plus one-way hashes of the confirm and unsubscribe links.

We do not store your IP address, name, device or browser details. To stop abuse, the sign-up form counts attempts per network address for one hour using a keyed one-way hash; these counters are deleted after 24 hours.

3. Why, and on what legal basis

To confirm your sign-up (double opt-in) and then to email you about the launch of Heimvo, based on your consent (GDPR art. 6(1)(a); LSSI art. 21). Campaign data is used only in aggregate to see which channels work. We do not use your data for profiling or automated decisions.

4. How long we keep it

Unconfirmed sign-ups: deleted automatically after 7 days at the latest. Confirmed sign-ups: until you unsubscribe, or at the latest 12 months after Heimvo's public launch, and in any case no later than 31 December 2027. If Heimvo does not launch, we delete the list. Unsubscribing deletes your record immediately. If you create a Heimvo account, your waitlist record is deleted and the app's privacy policy applies.

5. Who processes it for us

Cloudflare, Inc. (website hosting and database) and Brevo SAS, Paris, France (sending emails). Both act under data processing agreements (GDPR art. 28). Cloudflare is based in the USA and certified under the EU-U.S. Data Privacy Framework, which the European Commission recognises as adequate (Decision (EU) 2023/1795); Standard Contractual Clauses apply as a fallback. Brevo stores data in the EU; where its sub-processors access data from outside the EEA, Brevo relies on Standard Contractual Clauses or the EU-U.S. Data Privacy Framework. We do not sell or share your data with anyone else. Emails you send to [email protected] are received via Cloudflare Email Routing and read in a Google (Gmail) mailbox; Google LLC is certified under the EU-U.S. Data Privacy Framework.

6. Cookies

This site sets no cookies and does not store anything on your device.

7. Your rights

You can ask for access, rectification, erasure, restriction or portability, or object, by writing to [email protected]. We reply within one month. You can withdraw your consent at any time, free of charge, using the link in every email; this does not affect processing before withdrawal. You can complain to the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, or to your local data protection authority.

8. Heimvo app

This policy covers the waitlist only. The Heimvo app has its own privacy policy and data-processing terms (landlords: Heimvo is controller for account data and processor for tenant data).