Privacy policy
Last updated: 31 October 2026
1. Controller
Kalo Software GmbH, Zollamtstraße 9, 67663 Kaiserslautern, Germany
Represented by its managing director, Brennan Michael Nunamaker
Email: info@kalo.build
We have not appointed a data protection officer.
2. Summary
- We use no cookies and no tracking pixels, so you won't see a cookie banner.
- When you join the waitlist, we keep your email address only once you've confirmed it (double opt-in). We delete it on 30 November 2026 at the latest.
- AI agents working on behalf of Kalo Software GmbH write and run this website and our emails. Kalo Software GmbH remains responsible. The agents never see your signup data, only aggregated figures such as the number of signups.
- Our service providers, Cloudflare and Resend, are US companies. Transfers to them rely on the EU Standard Contractual Clauses and the EU-US Data Privacy Framework (section 7).
3. Visiting the website (hosting)
The website runs on Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (Cloudflare Workers and a Cloudflare D1 database). When you visit, Cloudflare processes the data it technically needs: your IP address, the date and time, the page you request, your browser and device type, and the referrer. Without this data the page can't be delivered or protected from attacks. We don't store your IP address ourselves.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working website). Cloudflare is our processor (Art. 28 GDPR).
4. Cookieless analytics
We use Cloudflare Web Analytics. It sets no cookies, stores nothing on your device (no localStorage) and builds no user profiles. All we see are aggregated figures such as page views, referring sites and countries.
Our server also keeps daily totals, for example page views per campaign tag or clicks on a button. These counters hold no IP address, cookie or identifier and can't be linked to anyone.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding how our website is used). We don't access your device, so no consent under § 25 TDDDG is needed.
5. Waitlist (double opt-in)
If you join the waitlist, we process:
- your email address,
- when you gave consent and when you confirmed it, and the version of the consent text,
- the page language,
- status (pending / confirmed),
- campaign tags from the link (e.g. utm_source) and the domain of the page you came from,
- hashed check values of the confirmation and unsubscribe links,
- when we sent you the product email.
Purpose: we first send you a confirmation email. You're only on the list once you click the link in it and confirm. After that you get one email from us when the product can be bought. The campaign tags tell us which channel works. We send nothing else and don't share your address.
Legal basis: your consent, Art. 6(1)(a) GDPR. We log consent and confirmation as proof (Art. 7(1) GDPR).
Withdrawal: at any time, using the unsubscribe link in every email or by emailing info@kalo.build. Your entry is then deleted immediately.
Retention:
- Unconfirmed entries are deleted automatically no later than 5 days after your most recent signup.
- Confirmed entries are deleted 14 days after the one product email, and on 30 November 2026 at the latest.
- If you unsubscribe, we delete your entry immediately.
Giving your email address is voluntary, but without it we can't notify you.
6. Email delivery
Our emails are sent by Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA, through its EU region (Ireland). Resend processes your email address, the content of the email and delivery events. According to Resend, these logs are deleted 30 days after sending. Resend is our processor (Art. 28 GDPR).
7. Recipients and transfers outside the EU
Only our processors receive your data: Cloudflare (sections 3–5) and Resend (section 6). Both are US companies. Transfers rely on the EU-US Data Privacy Framework adequacy decision (Art. 45 GDPR) where the provider is certified, and additionally on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). We don't sell data and don't use advertising networks.
8. Abuse protection
To prevent mass use of the signup form, we limit requests per IP address with a Cloudflare feature. The IP address isn't stored for this. Legal basis: Art. 6(1)(f) GDPR (protection against abuse).
9. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20 GDPR). You can withdraw your consent at any time, with effect for the future (Art. 7(3) GDPR).
Right to object: where we process data under Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).
To exercise these rights, write to info@kalo.build. You can also complain to a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz), Hintere Bleiche 34, 55116 Mainz, Germany.
10. No automated decisions
We don't make decisions about you based solely on automated processing that have legal effects (Art. 22 GDPR).
11. Changes
Before we extend the service, for example with a free check or purchases, we'll update this policy. The version published here is the one that applies.