Privacy Policy

Note: this is an English translation provided for convenience only. The legally binding version is the German version, available at tuplita.ai/datenschutz.

Last updated: July 13, 2026

Protecting your personal data is important to us. This Privacy Policy explains which personal data we collect and how we process it when you visit our website, contact us, or sign up for our waitlist or newsletter. We process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable German data protection law.

Privacy at a Glance

Who is responsible?

The controller responsible for data processing is Tuplita GmbH. The controller’s contact details can be found in the section “Information on the Controller” of this Privacy Policy.

Which data do we process?

  • when you visit the website: technical data (in particular server log data)
  • when you contact us: your email address and the contents of your message
  • for the waitlist/newsletter: your email address and consent/sign-up records

What do we process data for?

  • operation, security, and stability of the website, as well as spam and bot protection
  • handling of inquiries
  • sending waitlist/product updates (only with your consent)

What are your rights?

You have, among others, the right to access, rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent you have given (see the section “Your Rights” for details).

Information on the Controller

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

Tuplita GmbH

Herzogin-Elisabeth-Str. 3, 34346 Hann. Münden
Germany
Phone: +49 1515 9486516
Email: info@tuplita.ai

For privacy inquiries and to exercise your rights, you can reach us at:
Email: privacy@tuplita.ai

Which Personal Data We Process

a) Website access (server log data)

When you visit our website, our hosting provider processes technical data in so-called server log files, in particular:

  • IP address
  • date and time of access
  • page/file accessed (URL)
  • browser and device information
  • referrer URL
  • error and security logs (where applicable)

b) Contacting us (e.g. by email)

When you contact us, we process:

  • your email address (and your name, if provided)
  • the contents of your message
  • any further information you voluntarily provide

c) Waitlist / newsletter

When you subscribe to our waitlist or newsletter, we process:

  • email address (required)
  • optional information you provide voluntarily (e.g. name, organization, role, use case, feedback)
  • sign-up and consent records (e.g. timestamps, confirmation logs)

d) Cookies and similar technologies

We use cookies and similar technologies.

We deliberately do not display a cookie banner: “We use only technically necessary cookies and similar technologies (Section 25 (2) of the German TDDDG) and no tracking, analytics, or advertising cookies.”

  • Necessary cookies and similar technologies: e.g. to store your cookie settings and to provide basic functionality, security, and spam/bot protection.
  • Cookies/device access requiring consent: If we (now or in the future) use cookies or comparable technologies that are not strictly necessary, this will only be done with your consent.

Purposes and Legal Bases of Processing

We process personal data only where a legal basis under the GDPR applies:

  • Consent (Art. 6 (1) (a) GDPR): in particular for the waitlist/newsletter and, where applicable, cookies/technologies requiring consent.
  • Legitimate interests (Art. 6 (1) (f) GDPR): operation, protection, and improvement of the stability/security of the website.
  • Contract / pre-contractual measures (Art. 6 (1) (b) GDPR): handling inquiries in connection with a (potential) contractual relationship.
  • Legal obligation (Art. 6 (1) (c) GDPR): where statutory retention obligations apply.

Hosting

HostPress

Our website is hosted by HostPress. HostPress is a managed hosting provider specialized in WordPress, with its registered office and server locations in Germany. When the website is accessed, HostPress processes server log data.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure and stable operation).

Data processing agreement: We have concluded a data processing agreement with HostPress pursuant to Art. 28 GDPR.

Spam and Bot Protection

Cloudflare

We use Cloudflare for spam and bot protection via Cloudflare Turnstile. In this context, technical data may be processed, in particular IP address, browser and device information, header information, timestamps, as well as interaction and verification signals.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in the security of our website and in protecting against spam, bots, and abusive automated access).

Data processing agreement: Insofar as Cloudflare processes personal data on our behalf, this is done on the basis of a data processing agreement pursuant to Art. 28 GDPR.

Waitlist & Newsletter

Brevo

For sending waitlist/newsletter emails and managing contacts, we use Brevo. Brevo (Sendinblue / Brevo SAS) is a European provider based in France; processing takes place in the EU. Sign-up uses a double opt-in procedure: after signing up, you receive an email with a confirmation link; your subscription only becomes effective once confirmed.

Purposes: Sending waitlist and product updates (only if you have requested/consented to this), managing subscriptions and preferences.

Legal basis: Art. 6 (1) (a) GDPR (consent).

Data processing agreement: Brevo processes data as a processor on the basis of an agreement pursuant to Art. 28 GDPR.

Unsubscribing/withdrawal: You can withdraw your consent at any time via the unsubscribe link in our emails or by contacting us. The withdrawal applies to the future; processing carried out until that point remains lawful.

Email Communication via Google Workspace (EU Data Region)

Email communication takes place via Google Workspace (Business Plus Edition). We have configured Google Workspace to use the “Europe (EU)” data region.

Legal basis: Art. 6 (1) (b) GDPR (handling your inquiry / pre-contractual measures) or Art. 6 (1) (f) GDPR (general communication and organizational purposes), depending on the context.

Data processing / contractual clauses: Google provides a data processing addendum for Workspace (including contractual safeguards).

Recipients of Personal Data / Processors

We only pass on personal data where this is necessary for the performance of a contract, where we are legally obliged to do so, where you have consented, or where we have a legitimate interest. Where service providers act on our behalf, this is done as processing on behalf of the controller pursuant to Art. 28 GDPR.

Processors we use (in particular):

  • HostPress (hosting)
  • Cloudflare (bot detection / Turnstile)
  • Google (Google Workspace)
  • Brevo (newsletter/CRM)

International Data Transfers (Outside the EU/EEA)

Insofar as personal data is processed outside the EU/EEA (e.g. in the USA), we ensure appropriate safeguards, for example through:

  • adequacy decisions (where available) and/or
  • Standard Contractual Clauses (SCCs) as well as additional measures where required.

Retention Period

We store personal data only for as long as necessary for the purposes described, or where a legal obligation requires longer storage.

Typical retention periods:

  • Server logs: short-term, for security and error analysis purposes (typically days to a few weeks).
  • Contact inquiries: until the matter has been resolved; longer where statutory retention obligations apply.
  • Waitlist/newsletter: until you unsubscribe or withdraw your consent; consent records may be stored longer where necessary.

Your Rights

Under the GDPR, you have in particular the following rights:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection (Art. 21 GDPR)
  • Withdrawal of consent (Art. 7 (3) GDPR)

Withdrawal of your consent

Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. The lawfulness of the data processing carried out until the withdrawal remains unaffected by the withdrawal.

Right to object (Art. 21 GDPR)

Where the processing of your personal data is based on Art. 6 (1) (e) or (f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation.

Where your personal data is processed for direct marketing purposes, you have the right to object at any time to processing for the purposes of such marketing.

Contact for exercising your rights:

Email: privacy@tuplita.ai

Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement.

SSL/TLS Encryption (Security)

For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognize an encrypted connection by the browser’s address bar beginning with “https://” and by the padlock symbol shown in the browser bar.

We also implement appropriate technical and organizational measures (e.g. access controls, updates) to protect personal data against loss, misuse, and unauthorized access.

Changes to this Privacy Policy

We may update this Privacy Policy if our processing activities change or if legal requirements change. The current version will always be published on our website.