This Privacy Policy explains which personal data we process when you visit the website naraa.ai, contact us or join the waitlist. A separate App Privacy Policy applies to the use of the app "naraa".
1. Controller
naraa GmbH Lokstedter Steindamm 33a 22529 Hamburg Germany Managing Director: Pidder Seidl Email: contact@naraa.ai
Data protection contact: Pidder Seidl, contact@naraa.ai
2. Visiting the website
When you visit our website, your browser transmits technically necessary data to the server of our hosting provider Lovable. This includes in particular:
- IP address
- date and time of access
- the page visited and the previously visited page (referrer)
- browser type, operating system and device type
We need this data to deliver the website and to keep it secure and stable. The legal basis is our legitimate interest in a secure and functioning website (Art. 6(1)(f) GDPR). The hosting provider deletes server logs automatically after a short period unless they are needed to investigate a security incident.
3. Browser storage, no analytics or advertising tools
Our website does not set cookies for analytics or advertising and does not use any tracking, analytics or advertising services. Fonts are loaded from our own server.
For individual features we store small entries in your browser's storage (local storage or session storage):
| Entry | Purpose | Duration |
|---|---|---|
| Referral code (naraa_ref) | Carry a referral code from an invite link into the sign-up form | until you close the browser window |
| Sign-up status (naraa_waitlist_joined) | Do not show the waitlist prompt again after you have signed up | until you clear your browser storage |
| Time a notice bar was dismissed | Keep dismissed notice bars hidden for a while | until you clear your browser storage |
These entries are strictly necessary for the features you request (Section 25(2) No. 2 TDDDG). They contain nothing that allows us to identify you. The referral code is only transmitted to us when you submit the sign-up form. You can delete the entries at any time in your browser settings.
4. Contact form and email
When you write to us via the contact form or by email, we process your name, email address and the content of your message in order to answer your enquiry. Messages from the contact form are passed through a server function at Supabase to our email service Resend and delivered to our mailbox. They are not stored in a website database. To prevent abuse, your IP address is briefly processed in memory to limit too many requests in a short time.
The legal basis is the performance of pre-contractual measures where your enquiry relates to a contract (Art. 6(1)(b) GDPR), and otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We delete your message once your enquiry has been dealt with, unless statutory retention obligations apply (e.g. for business correspondence, up to six years).
5. Waitlist
You can join the app's waitlist on our website and will then receive emails about the launch of naraa.
5.1 Data we process
- email address
- selected language and preferred platform (iOS or Android)
- the page on which you signed up
- time and wording of your consent, IP address and browser identifier (user agent) as proof of consent
- confirmation status and time of confirmation
- your position on the waitlist, your personal referral code, the code you were invited with (if any) and the number of confirmed invites
- delivery status of our emails (e.g. delivered or undeliverable)
5.2 Double opt-in
After you sign up, we send you an email with a confirmation link. Your sign-up only becomes effective once you click it. You will not receive any further emails before that. Sign-ups that are not confirmed within seven days are deleted automatically.
5.3 Emails you will receive
Once confirmed, you will receive emails with news about the launch of naraa, for example about the launch date, your access and benefits for waitlist members, and, on request, a link to your personal waitlist page.
5.4 Legal basis and withdrawal
The legal basis is your consent (Art. 6(1)(a) GDPR, Section 7(2) No. 2 UWG). We store the proof data because we are obliged to be able to demonstrate consent (Art. 7(1), Art. 6(1)(c) and (f) GDPR).
You can withdraw your consent at any time with effect for the future, using the unsubscribe link in every email or by emailing contact@naraa.ai. When you unsubscribe, we delete your waitlist entry. The lawfulness of processing carried out before the withdrawal remains unaffected.
5.5 Retention
We store your waitlist data until you unsubscribe, but no longer than six months after the app's launch. After that we delete it, unless you have created an app account with the same email address and taken over your benefits.
6. Referral programme
With your personal referral link you can invite others to the waitlist. If an invited person enters your code, we store the link between you in order to count confirmed invites and assign benefits. You only see the number of your confirmed invites, not the names or email addresses of the people you invited. Please only share your link with people you can reasonably assume would welcome it. We do not send emails to invited people unless they have signed up and confirmed themselves.
The legal basis is the performance of the referral programme under its terms of participation (Art. 6(1)(b) GDPR).
7. Recipients and service providers
We use the following service providers as processors. They process data only on our instructions and under a data processing agreement (Art. 28 GDPR).
| Provider | Purpose | Location | Safeguard for international transfers |
|---|---|---|---|
| Lovable (Lovable Labs) | Hosting and delivery of the website | Sweden; sub-processors also in the USA | Standard Contractual Clauses |
| Supabase Inc. | Waitlist database, server functions for forms and emails | data centre in Frankfurt; provider based in the USA | Standard Contractual Clauses |
| Resend Inc. | Sending confirmation, waitlist and contact emails | USA | EU-US Data Privacy Framework, supplemented by Standard Contractual Clauses |
Beyond this, we only disclose data where we are legally obliged to do so, for example to public authorities. We do not sell personal data.
8. International transfers
Some service providers are based in the USA or use sub-processors there. For the USA, the European Commission has adopted an adequacy decision for companies certified under the EU-US Data Privacy Framework. For recipients that are not certified, we rely on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can request a copy of the safeguards.
9. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)). Please contact contact@naraa.ai.
Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.
10. Right to lodge a complaint
You can lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence or place of work. The authority responsible for us is: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (Hamburg Commissioner for Data Protection and Freedom of Information), Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.
11. No obligation to provide data, no automated decisions
You are not obliged to provide us with any data. Without an email address, however, we cannot add you to the waitlist or answer your enquiry. We do not make automated decisions within the meaning of Art. 22 GDPR.
12. Security
The connection to our website is encrypted with TLS. We protect data with technical and organisational measures, including access restrictions on the waitlist database.
13. Changes
We update this Privacy Policy when our processing or the law changes. The version published here, with the date shown above, applies.