Privacy Policy

1. Controller

Thomas Emanuel Bechtold (Einzelunternehmer / Sole Proprietor)
Nikolaus-Fey-Straße 6
97241 Bergtheim
Germany

Contact
Email: info@bandscoreai.com
Phone: +49 (0) 1525 9870943

Supervisory Authority
Bavarian State Office for Data Protection Supervision
Promenade 18, 91522 Ansbach, Germany
https://www.lda.bayern.de

Under Art. 37 GDPR, we are currently not required to appoint a Data Protection Officer.

2. General Information & Legal Bases

We process personal data in accordance with the General Data Protection Regulation (GDPR) and the German Telecommunications-Digital Services Data Protection Act (TDDDG).

Personal data is processed only where legally permitted, based on:

• Consent (Art. 6(1)(a) GDPR)
• Legitimate interest (Art. 6(1)(f) GDPR)
• Legal obligation (Art. 6(1)(c) GDPR)

3. Hosting & Server Logs

Our website is hosted via Cloudflare. When you access our website, technical connection data such as IP address, date and time of access, requested resources, browser type, and operating system are processed automatically.

This processing is necessary to ensure website security, technical stability, and reliable operation.

Retention period
Server log data is stored for up to 7 days and then deleted or anonymized, unless longer retention is required for security-related investigations or statutory obligations.

Legal basis
Art. 6(1)(f) GDPR (legitimate interest).

4. Cookies, Analytics & Similar Technologies

We do not use advertising cookies, social-media pixels, or other consent-requiring tracking technologies on this website for visitors in the EU/EEA. We therefore do not use a cookie consent banner. Strictly necessary technical processing by our hosting and security provider may still occur where required to deliver and protect the website.

Cloudflare Web Analytics outside the EU

Cloudflare Web Analytics is used only for visitors outside the EU, subject to applicable local law. It is configured to exclude visitors from the EU. It is a privacy-focused performance analytics service that does not use tracking cookies, local storage, or individual profiles. It measures aggregated page-performance metrics such as page views and loading performance.

Provider
Cloudflare, Inc., United States

Cloudflare states that Web Analytics does not collect visitors' personal data. Raw beacon data is retained by Cloudflare for up to seven days and may then be retained only in aggregated form, according to Cloudflare's current product documentation.

5. Waitlist Registration

Collected Data

When registering for the waitlist, we collect the following data:

• Email address (mandatory)
• Pseudonymous email hash and verification data used to prevent duplicate registrations and protect the waitlist process
• Preferred plan (optional)
• Additional feedback, ideas, or suggestions (optional)

Verification & Processing

Your email address is verified via a confirmation email (double opt-in). The pending registration and verification data are stored in Cloudflare D1. To send the confirmation email, the email address and the necessary message data are sent through an AWS API Gateway endpoint in the United States to Amazon Simple Email Service (SES). After successful verification, the confirmed waitlist entry remains stored in Cloudflare D1.

Purpose
Managing the waitlist, verifying your email address, contacting you about the product launch and early access, and providing the advertised first week of premium practice free of charge when the service launches, subject to the launch terms communicated at that time.

Legal basis
Art. 6(1)(a) GDPR (consent).

You may withdraw your consent or request deletion of your waitlist entry at any time by emailing info@bandscoreai.com. We will process the request without undue delay and normally within one month, unless a statutory retention obligation or the establishment, exercise, or defence of legal claims requires otherwise.

6. Email Communication

Your email address is used for waitlist verification and, if you have joined the waitlist, for launch, early-access, and free-trial information related to Bandscore AI. We do not send unrelated newsletters or advertising emails. You may withdraw your consent at any time by contacting info@bandscoreai.com.

7. Service Providers

We use the following service providers as processors under Art. 28 GDPR:

• Cloudflare, Inc., United States – hosting, CDN, security services, Cloudflare D1, and (outside the EU only) Web Analytics
• Amazon Web Services, Inc. (AWS), United States – API Gateway and email delivery via Amazon Simple Email Service (SES)

The applicable data processing terms and agreements are maintained for the service providers used for this processing.

8. Data Transfers to Third Countries

Where personal data is transferred to the United States, the transfer relies on an applicable adequacy mechanism, such as the EU–U.S. Data Privacy Framework where the recipient is covered, or otherwise on Standard Contractual Clauses and any additional safeguards required under Art. 46 GDPR. Details of the applicable safeguards can be requested from us.

9. Retention Periods

Personal data is stored only as long as necessary for the respective processing purposes and in accordance with statutory retention obligations:

• Server logs: up to 7 days
• Cloudflare Web Analytics beacon data outside the EU: raw data for up to 7 days, followed by aggregation according to Cloudflare's product retention
• Pending waitlist registrations: until email verification or expiry of the verification process
• Confirmed waitlist data: until the waitlist and launch/free-trial purpose has been fulfilled or the user requests deletion, subject to statutory retention obligations

10. Your Rights

You have the right to request access, rectification, erasure, restriction of processing, data portability, and to object to processing, as well as to withdraw consent at any time.

Requests can be submitted to info@bandscoreai.com. We respond within one month. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

11. Children’s Privacy

This website and the waitlist are intended for users aged 16 years and older. We do not knowingly collect personal data from children under 16. If you are under 16, please do not join the waitlist without the required consent of a parent or legal guardian under applicable law.

12. Changes to This Privacy Policy

We may update this Privacy Policy to reflect legal or technical changes. The current version is always available on this website.