Privacy Policy

1. Who we are

Delvasta ("we", "us", "our") is an AI-powered platform for building forms, quizzes, surveys, and lead funnels. The service is operated by Thorsten Meyer, Blombergstrasse 11 C, 82393 Iffeldorf, Germany.

We are the data controller for personal data collected through Delvasta.com. For questions about this policy or your data, contact us at contact@delvasta.com.

2. What data we collect

Data you provide directly

• Email address and name when you sign up or join the waitlist
• Account credentials, with passwords stored in hashed form
• Billing information processed through our payment provider
• Content you create within the platform, including forms, quiz questions, and responses
• Communications you send by email or through the contact form

Data collected automatically

• IP address and approximate location at country or region level
• Browser type, operating system, and device information
• Pages visited, features used, and time spent
• Referring URLs and UTM parameters
• Error logs and performance data

Data from respondents

When you publish a Delvasta form, your respondents submit data directly into your account. You are the data controller for this data. We act as a data processor on your behalf and process it only according to your instructions and this policy.

3. How we use your data

• To provide, operate, and improve the Delvasta platform
• To send account confirmations and access links
• To communicate product updates, early access notifications, and relevant announcements
• To process payments and manage subscriptions
• To respond to support requests and inquiries
• To monitor platform security and prevent abuse
• To comply with legal obligations under German and EU law

4. Legal basis for processing

Under GDPR Article 6, we rely on the following legal bases:

• Contract performance: processing necessary to deliver the service you requested
• Legitimate interests: security monitoring, fraud prevention, product improvement, and analytics
• Consent: marketing communications, which you may withdraw at any time
• Legal obligation: processing required by German law, EU law, or a court order

5. Data sharing and third parties

We share data with third-party service providers only where necessary to operate the platform. Processors are bound by data processing agreements and required to comply with GDPR.

Sub-processors

Delvasta is currently in pre-launch. The definitive list of sub-processors will be published before general availability. A current list is available on request at contact@delvasta.com.

We do not share your data with third parties for their own marketing or commercial purposes.

6. Data retention

• Account data is retained for the duration of your account plus 30 days after deletion
• Billing records are retained for 10 years as required by German tax law, § 147 AO
• Form response data is retained according to your account settings, and you control deletion
• Waitlist email addresses are deleted within 90 days of launch if no account is created
• Server logs are retained for up to 30 days

7. Your rights under GDPR

As a data subject under EU or EEA law, you can submit requests to contact@delvasta.com. We respond within 30 days.

• Access, Art. 15: request a copy of the personal data we hold about you
• Rectification, Art. 16: correct inaccurate or incomplete data
• Erasure, Art. 17: request deletion of your data
• Restriction, Art. 18: request that we limit processing
• Portability, Art. 20: receive data in a structured, machine-readable format
• Objection, Art. 21: object to processing based on legitimate interests

You also have the right to lodge a complaint with the competent data protection supervisory authority in Germany.

8. Cookies and tracking

Delvasta uses minimal tracking. We do not use third-party advertising cookies or cross-site tracking.

• Strictly necessary cookies: session authentication and security tokens required for the service
• Analytics: privacy-first aggregate usage analysis without advertising profiles
• Preference cookies: interface preferences such as language where applicable

You can control cookies through your browser settings. Blocking strictly necessary cookies will prevent login.

9. International transfers

We prefer EU-hosted infrastructure where possible. If data is transferred outside the EEA, we use appropriate safeguards, including Standard Contractual Clauses approved by the European Commission under GDPR Article 46. A list of current sub-processors and their data locations is available on request.

10. Contact and complaints

For privacy questions, data subject requests, or withdrawal of consent, email contact@delvasta.com. We will acknowledge your request within 5 business days and respond in full within 30 days as required by GDPR Article 12.