Legal · Last updated July 24, 2026

Privacy Policy

We take the protection of your personal data seriously. In this Privacy Policy, we inform you pursuant to Art. 13 DSGVO about which data we process, for which purposes and on which legal basis, as well as about your rights. The Queryance list serves exclusively to notify you by email when Queryance launches (launch notification). At launch the product will be open source under the MIT license. There is no newsletter and no marketing emails.

1. Controller

Fabian Schmitt
Henriette-Brey-Str. 41
47608 Geldern, Germany
Email: contact@queryance.com
Phone: +49 176 41105366

2. Purposes and Legal Bases

a) Waitlist Signup (Consent, Art. 6 Abs. 1 lit. a DSGVO)

By submitting the form, we process your email address for the purpose of launch notification registration (notification by email at launch). The legal basis is your consent (Art. 6 Abs. 1 lit. a DSGVO), which you give via the checkbox in the form. You may revoke your consent at any time with effect for the future, e.g. by email to contact@queryance.com. The revocation does not affect the lawfulness of processing carried out before then. Without consent, registration is not possible.

b) Bot Protection with Cloudflare Turnstile (Legitimate Interest, Art. 6 Abs. 1 lit. f DSGVO)

To protect against bots and abuse, we use Cloudflare Turnstile (provider: Cloudflare, Inc., USA). The widget is only loaded after you have ticked the consent checkbox. Technically necessary data (e.g. IP address, browser and device information for abuse detection) is transmitted to Cloudflare in the USA. Our legitimate interest is protecting the service against automated abuse. For the transfer to the USA, the EU Standard Contractual Clauses (SCCs) apply under the Cloudflare Data Processing Addendum (DPA, see Section 5).

c) Server Logs (Legitimate Interest, Art. 6 Abs. 1 lit. f DSGVO)

When you visit the website and when waitlist signups occur, we process server log data (e.g. timestamps, requested URL, status codes, shortened/anonymized connection data) to ensure security, stability, and debugging. Logs are deleted after 30–90 days.

3. Storage and Retention Periods

• Waitlist emails: 12 months from signup (expirationTtl), then automatic deletion. If you revoke your consent, we delete your address earlier (see Section 6).
• Rate-limit hashes: IP hashes max. 1 hour, email hashes max. 24 hours, global daily counters max. approx. 48 hours, Turnstile single-use tokens approx. 10 minutes. IP and email hashes are stored as HMAC-SHA256 with a server-side secret (pepper), not as plaintext.
• Server logs: 30–90 days (Section 2c).

4. Recipients and Sub-processors

We do not share your data with third parties for their own purposes. For hosting and operation, we use the following processor:

5. Data Processing on Behalf / DPA

To the extent Cloudflare processes personal data on our behalf (hosting, KV storage, Turnstile), the Data Processing Addendum (DPA) of Cloudflare, including the EU Standard Contractual Clauses, applies by reference: https://www.cloudflare.com/cloudflare-customer-dpa/. You can find supplementary information on our DPA page.

6. Cookies and Local Storage

The Queryance app itself sets no cookies and uses no local/session storage. Only after your consent (checkbox) does the Turnstile widget from Cloudflare load; technically necessary challenge cookies from Cloudflare may then be set, which are required for bot protection.

7. Your Rights (Art. 12–22 DSGVO)

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing based on Art. 6 Abs. 1 lit. f DSGVO (Art. 21). You may also revoke consent you have given at any time (Art. 7 Abs. 3, see Section 2a).

Data subject rights are processed manually. Please contact contact@queryance.com for this purpose. We respond within one month (Art. 12 Abs. 3 DSGVO). There are no self-service export/deletion features in the product.

8. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 DSGVO). The competent authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW).

9. No Automated Decision-Making

No automated decision-making, including profiling, pursuant to Art. 22 DSGVO takes place. The list merely stores notification requests.

10. No Newsletter

For the avoidance of doubt: signup serves exclusively for notification at launch. We send no newsletter and no marketing emails.