Privacy statement

Who is responsible

DuwelFlow studio (trading as GridTiming) KvK 42187968 Contact: hello@gridtiming.app

What we store

• Your email address.
• Whether you have confirmed it, and when.
• The exact text you agreed to when you signed up, which emails it covers, whether you also ticked the news box, and when.
• When we sent you the beta email and the launch email. If you click "Also send me the email at the full launch" in the beta email, that choice, its exact text and when.
• Where you came from, only as one of: TikTok, Instagram, YouTube or direct.
• When you signed up, when we last emailed you, and when you unsubscribed.

We don't store your IP address, your browser or device, or your name on our own systems. The page sets no cookies. Counting visits stores nothing in your browser: see "Visit statistics" below. After you sign up, the next page keeps your email address in your browser's session storage, only so its "Resend email" button works; it is never in a web address, is not sent to our visit statistics and is gone when you close the tab. If you make a choice about session recordings, your browser keeps that choice (and, if you press "Allow", a random code): see "Session recordings" below.

Why

To send you one email to confirm your address (and, if you have not confirmed after about a day, at most one reminder), an invite when the beta opens, and one email when GridTiming launches. If you ticked the news box, also to email you about other GridTiming news, a few times a year at most.

If you signed up when the form promised one email when GridTiming launches, the beta email is that one email. It has a link to also get the email at the full launch; without that click, we don't email you again. If you ticked the news box then, it covered the beta and other news, so you get both emails.

We only do this because you asked for it (your consent, GDPR article 6(1)(a)). You can withdraw your consent at any time.

We also store where you came from (TikTok, Instagram, YouTube or direct) to learn which of our channels lead to sign-ups (legitimate interest, GDPR article 6(1)(f)).

How long

• Not confirmed within 7 days: we delete your address.
• Beta invite and launch email, without the news box: we delete your address within 30 days after we send the launch email.
• Signed up when the form promised one email at launch, without the news box: the beta email is that one email, and we delete your address within 30 days after we send it. If you click "Also send me the email at the full launch", we keep it until 30 days after the launch email.
• News box ticked: we keep your address until you unsubscribe.
• After you unsubscribe: we delete your address within 30 days.

Contact form

If you use the contact form, we receive your name (if you give it), your email address, the topic and your message by email, so we can answer you. The site itself does not store them. We keep the email in our inbox as long as needed to handle your question, and delete it within 12 months.

We process this to answer you (legitimate interest, GDPR article 6(1)(f)). The same processors and rights apply as described below.

Visit statistics

We measure how the site is used with PostHog, set up without cookies: which pages are viewed, where visitors come from (for example TikTok or Instagram, or the site that linked to us), the type of device and browser, and which parts of the page are used, such as whether someone started the sign-up. These measurements never contain your email address, your name or what you type.

When something on the page breaks, PostHog also gets a short technical error report (what went wrong and on which page), without your email address or what you type.

PostHog makes an anonymous visitor code on its own server from your IP address, your browser details and a secret that changes every day, and then discards your IP address. Nothing is stored on your device, so nobody can be followed from one day to the next or from one site to another. We cannot tell who a visitor is.

We do this because we want to know whether the site works and where visitors come from (legitimate interest, GDPR article 6(1)(f)). We keep the statistics for at most 12 months.

You can object at any time. If your browser sends the Do Not Track or Global Privacy Control signal, we measure nothing. You can also email hello@gridtiming.app. Because the statistics are anonymous, we cannot look up or delete the data of one visitor.

Session recordings

Only if you press "Allow" in the box that asks about it, we also record how you use the page: mouse movement and taps, scrolling, clicks and the pages you see, as a short replay. Everything you type is hidden in the recording, and so is all text inside the sign-up and contact forms, so we never see your email address, your name or your message.

Until you choose, nothing is recorded and the recording tool is not even loaded. We record nothing at all if your browser sends the Do Not Track or Global Privacy Control signal; in that case we don't ask either.

For this, PostHog (EU Cloud) saves a random code in your browser (local and session storage, no cookies) so that one visit stays together in one recording. We also keep your choice (allowed or declined) in local storage, so we don't ask again. We use recordings to find parts of the page that confuse people, and we look at them one at a time, without trying to find out who you are. The legal basis is your consent (GDPR article 6(1)(a)).

You can change your mind at any time with the button below. If you choose "No thanks", we stop recording and delete the random code from your browser; only your choice stays. You can also email hello@gridtiming.app. We keep recordings for at most 30 days.

Who else processes it

• Cloudflare hosts this page and stores the list (Cloudflare Workers and D1).
• Cloudflare Turnstile checks that a form is sent by a person and not by a bot. It starts when a sign-up form comes into view, or when you use the contact form.
• Resend sends the emails.
• PostHog (EU Cloud, servers in Frankfurt, Germany) counts visits and, only if you allow it, stores session recordings, as described above.
• Google (Gmail) holds our inbox: mail to our contact address and messages from the contact form are forwarded there.

Cloudflare, Resend and PostHog work for us under data processing agreements that include the EU standard contractual clauses. All four companies, including Google, are based in the United States and are certified under the EU–US Data Privacy Framework. Our emails are sent from Resend's EU region (Ireland). We don't sell or share your address with anyone else.

To stop abuse, we briefly use your IP address to limit the number of sign-ups. We only keep a scrambled version (a hash with a random key that changes every day) for at most one hour, never the IP address itself.

To check that an email domain can receive mail, we look up only the part after the @ (for example gmail.com) in Cloudflare's public DNS. Your full address is not sent.

Turnstile reads technical signals from your browser and uses your IP address to tell people from bots. We use Turnstile, the sign-up limit and the domain check to protect the site and our emails against spam and abuse (legitimate interest, GDPR article 6(1)(f)).

Your rights

You can ask to see, correct or delete your data, to get a copy of it in a common format (data portability), and to restrict how we use it. You can object to anything we do on the basis of legitimate interest. You can withdraw your consent and unsubscribe at any time with the link in every email. Email hello@gridtiming.app for any request.

If you think we handle your data wrongly, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Age

The list is for people aged 16 or older.