Legal
Privacy Policy
The short version
If you join the waitlist we store one thing: your email address, so we can tell you when BuddyRonnie opens. We don't sell it, share it, or add you to anything else. The only cookies we set are analytics and ad-measurement cookies, and only if you accept the banner — reject it, or ignore it, and nothing is stored on your device. Ask us and we'll delete your address.
1. Who is responsible
The data controller for this website is:
| Name | BuddyRonnie c/o Mathias Holmbo |
|---|---|
| Address | Frederiksborgvej 65B, 4000 Roskilde, Denmark |
| CVR | 36359080 |
| hello@buddyronnie.app |
Write to that address for general questions about this policy. For data requests — any of the rights in section 5, including deleting your waitlist entry — email privacy@buddyronnie.app instead. Either way it reaches a person, not a ticketing system.
2. What we collect, and why
Your email address
| What | The email address you type into the waitlist form. |
|---|---|
| Why | To tell you when access opens, through our waitlist mailing list. That is the only use. |
| Lawful basis | Your consent — GDPR Article 6(1)(a). Submitting the form is the consent; you can withdraw it any time by unsubscribing or asking us to delete the address. |
| Kept for | Until BuddyRonnie launches and we've told you, or until you unsubscribe or ask us to delete it — whichever is first. |
We add your address to our mailing list, run on Mailchimp. Submitting the form adds you to the list directly — there is no separate confirmation email. Every email we send has an unsubscribe link, and you can opt out or ask us to delete your address at any time. Mailchimp is a US provider — see section 4 for the transfer safeguards.
Your IP address, briefly
When you submit the form, our server sees your IP address — as every web server does. We do not store it. It is immediately converted into an irreversible fingerprint (a salted SHA-256 hash) which is used only to count how many sign-ups came from one place, so that nobody can flood the list with fake addresses. Those fingerprints are automatically deleted after one hour.
We cannot turn a fingerprint back into your IP address, and we never store the address itself.
| Lawful basis | Legitimate interests — GDPR Article 6(1)(f): preventing abuse of a public form. Balanced against your interests by never storing the address and deleting the fingerprint within the hour. |
|---|---|
| Kept for | One hour, then deleted automatically. |
Analytics and advertising
With your consent, we use Google Analytics 4 to understand how the site is used — how many people visit, which pages and referrers are popular — and to measure our Google Ads campaigns, so we can see which ads led to waitlist sign-ups. Google Analytics sets cookies on your device and assigns a random identifier; your IP address is anonymised by Google and is never stored by us.
| Lawful basis | Your consent — GDPR Article 6(1)(a). Analytics loads only after you click “Accept” on the cookie banner. Reject it, or ignore it, and nothing from Google loads and no cookie is set. |
|---|---|
| Withdraw | Click Cookie settings in the footer at any time and choose Reject — we clear the cookies and stop. |
| Kept for | Google retains the analytics data for the period set on our GA4 property (up to 14 months). We hold no copy. |
| Where | Google LLC, United States — see section 4 for the transfer safeguards. |
3. Cookies and similar technologies
Until you make a choice on the cookie banner, this site stores nothing on
your device for tracking — no analytics cookies, no fingerprinting. The one thing kept
regardless is a small record of your banner choice itself (in localStorage),
which is strictly necessary so we don't ask you again on every page.
If you accept, Google Analytics sets its cookies — chiefly _ga
and _ga_<id>, which tell repeat visits apart and let us measure our ad
campaigns. They last up to two years. If you reject, none of them are ever
set. You can change your mind either way from Cookie settings in the footer.
Fonts are served from this website rather than from Google Fonts, specifically so that loading a page doesn't hand your IP address to a third party before you've chosen anything.
4. Who else can see your data
We use these service providers, who act as our processors:
| Provider | What for | Where |
|---|---|---|
| Supabase | Hosts the database holding the waitlist | EU (Frankfurt, eu-central-1) |
| Mailchimp (Intuit) | Runs the waitlist mailing list — sends the confirmation, the welcome, and the launch email | United States |
| Google (Analytics / Ads) | Website analytics and ad-campaign measurement — only if you accept | United States |
Waitlist (Supabase). Your email is stored inside the EU/EEA (Frankfurt). Supabase is US-headquartered, so its staff may access data from outside the EU for support and operations — an international transfer under GDPR even though the servers are in Frankfurt. It is covered by Standard Contractual Clauses in our data processing agreement with Supabase, together with their published transfer risk assessment and encryption in transit and at rest.
Mailing list (Mailchimp). Your email address goes to Mailchimp (The Rocket Science Group / Intuit) in the United States to run the waitlist mailing. The transfer relies on Intuit's certification under the EU–US Data Privacy Framework, backed by Standard Contractual Clauses in Mailchimp's data processing addendum. Your address is added when you submit the form; you can unsubscribe or ask us to delete it at any time.
Analytics (Google). If — and only if — you accept analytics, that data goes to Google LLC in the United States. The transfer relies on Google's certification under the EU–US Data Privacy Framework, backed by Standard Contractual Clauses under Google's data processing terms. Nothing analytics-related leaves your browser unless you consent.
We do not sell your data, and we don't share it with anyone else.
5. Your rights
Under GDPR you have the right to:
- Access — ask what we hold about you
- Rectification — have it corrected
- Erasure — have it deleted ("the right to be forgotten")
- Restriction — ask us to stop using it while a dispute is resolved
- Portability — receive it in a machine-readable form
- Object — to processing based on legitimate interests
- Withdraw consent — at any time, without affecting what came before
Email privacy@buddyronnie.app and we'll action it. Deleting your waitlist entry takes one message; you don't have to explain why.
6. Complaints
If you think we've handled your data badly, please tell us first — but you always have the right to complain to the Danish Data Protection Agency:
Datatilsynet
Carl Jacobsens Vej 35, 2500 Valby, Denmark
www.datatilsynet.dk ·
dt@datatilsynet.dk
7. Changes
If this policy changes we'll update the date at the top. If a change materially affects people already on the waitlist, we'll email them rather than rely on them re-reading this page.