Privacy policy
Last updated: 28 September 2026
This policy explains what personal data this website collects, why, and what rights you have under the EU General Data Protection Regulation (GDPR). The short version: we collect only what you type into the waitlist form, plus the technical request data every web server receives. There are no cookies, no analytics, no tracking pixels and no advertising.
1. Who is responsible (controller)
Ajay Pravin Mahale, Germany. Email: mahale.ajay01@gmail.com.
2. What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Waitlist form: email (required); name, company, plan interest and message (optional) | To contact you about Glassbox access and onboarding, at your request | Art. 6(1)(b) GDPR (steps taken at your request before a contract) |
| Technical request data: IP address, time, requested URL, browser user agent | Delivering the website securely and defending against abuse | Art. 6(1)(f) GDPR (legitimate interest in a secure, working website) |
We do not use your data for automated decision-making or profiling, do not sell it, and do not use it for third-party marketing.
3. Cookies and similar technologies
This website sets no cookies and uses no local storage for tracking. Fonts are hosted on our own domain, so loading the page does not send your IP address to a font provider. For this reason no cookie banner is shown.
4. Who processes data for us
- Vercel Inc. (USA) hosts the website and the waitlist endpoint and processes technical request data.
- Resend (USA) delivers the notification email that tells us about a new waitlist signup.
- Upstash (Vercel KV storage) stores waitlist entries, if storage is enabled for the deployment.
- GitHub Inc. (USA) hosts the source code and may serve a copy of this site via GitHub Pages.
These providers act as processors under data processing agreements. Where data is transferred to the USA, the transfer relies on the safeguards named in the provider's agreement (the EU–US Data Privacy Framework and/or EU Standard Contractual Clauses).
5. External links
Links to GitHub, PyPI, arXiv and the Hugging Face demo are ordinary links. Nothing from those sites is loaded until you click, and their own privacy policies apply once you do.
6. How long we keep data
Waitlist data is kept until you ask us to delete it or until it is no longer needed for the purpose above, whichever comes first. Technical request logs are kept only as long as the hosting provider's standard log retention.
7. Your rights
You can request access (Art. 15), correction (Art. 16), deletion (Art. 17), restriction (Art. 18) and portability (Art. 20) of your data, and you can object to processing based on legitimate interest (Art. 21). Email the address above; we answer within one month.
You also have the right to complain to a data protection supervisory authority, for example the one responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz.
8. Is providing data required?
No. Joining the waitlist is voluntary. Without an email address we simply cannot contact you about access.
9. Changes
If this policy changes, the date at the top changes too.