Privacy policy

Draft — not yet suitable for publication as a final privacy notice. Outstanding issues concerning data-processing arrangements, international transfers and the legal basis for analytics are listed in the final section.

This privacy policy describes how personal data is processed on reflow.ink. The website presents the project and offers a non-binding waitlist. A usable reflow application, processing of your Notion documents and payments are not currently part of this offering.

Controller

The controller under the General Data Protection Regulation (GDPR) is:

Jakob Mühlberger
Im Obstgarten 12
4209 Engerwitzdorf, Austria
Email: jakob@diemuehlbergers.at
Phone: +43 676 814282541

You can also use these contact details for privacy enquiries. In this privacy policy, “we”, “us” and “our” refer to Jakob Mühlberger as the operator of reflow.ink.

Website delivery and security

The website is hosted by Vercel Inc., USA. When you visit, your IP address, the requested address, the time and technical request details are processed. Depending on the request, this includes browser information, the referring page, response status and error data. This processing is necessary to deliver the website, investigate faults and prevent abuse.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website. The website cannot be delivered without the connection data required for transmission.

For waitlist signups, the transmitted IP address is also used to limit excessive requests. The counter evaluates ten-minute windows. The association is held in the memory of the relevant server instance and may remain until that instance terminates; deletion after ten minutes is not guaranteed.

On the Vercel Hobby plan currently used, the documented window for runtime logs is one hour. No external log exports are configured. This is not a promise that all operational and security data processed by Vercel is deleted within that period. Information about Vercel’s own processing is available in its Privacy Notice.

Language preferences and fonts

If you open a page without a language in its address, the website uses the language preference your browser sends with each request (the Accept-Language header) to show the German or English version. This setting is not stored separately. You can change it in your browser or switch language on the website at any time.

The session cookie NEXT_LOCALE, containing de or en, may be stored to remember your selected language. It contains no unique visitor identifier and has no fixed expiry time; its actual lifetime also depends on your browser’s session restoration. You can delete or block it in your browser settings. Your language selection may then no longer be remembered.

Language detection and storage serve your language preference and relies on the exemption for necessary storage under Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021). To the extent personal data is processed, the legal basis is Article 6(1)(f) GDPR; the legitimate interest is providing your selected language version.

The current website uses a fixed light appearance and does not create new theme cookies or theme entries in local browser storage for that purpose.

Fonts are delivered with the website. Loading them does not establish a connection to Google Fonts.

Vercel Web Analytics and Speed Insights

Vercel Web Analytics measures website usage. Data includes page address, referrer, time, approximate location, browser and device information. Vercel states that it uses no analytics cookies and discards a request-derived visitor identifier after 24 hours. This does not mean all statistics are deleted after 24 hours. See Vercel’s Web Analytics information.

Vercel Speed Insights measures loading speed and responsiveness. Data includes page address, performance metrics, browser, device, network type and country. Vercel describes these measurements as not associated with individual people. See Vercel’s Speed Insights information.

Both services are enabled and load when you visit, without a prior consent prompt. The website does not send waitlist email addresses as custom analytics events.

The Hobby plan provides a one-month reporting window for Web Analytics; Vercel expressly states that data may be retained for longer. The free version of Speed Insights currently offers views covering up to seven days. These display windows are not binding deletion deadlines.

Outstanding before publication: The legal basis for this specific analytics configuration and any consent requirement under Section 165(3) TKG 2021 still need to be assessed. The absence of cookies and the provider’s description of anonymisation do not, by themselves, establish an exemption from consent. This draft therefore claims neither that consent has been obtained nor that reliance on legitimate interests has been conclusively assessed as lawful.

Waitlist and product updates

When you join the waitlist, the following information is stored:

• your email address;
• your selected language and the signup source “website”;
• the time of signup and of the consent given;
• a technical confirmation-delivery status.

This information is used to manage the waitlist, avoid duplicate entries and prepare to send your invitation and occasional reflow product updates. The legal basis is your consent under Article 6(1)(a) GDPR; Section 174(3) TKG 2021 also applies to marketing emails. Signup is voluntary. Without your email address and consent, we cannot add you to the waitlist, but you can still use the website.

Entries are sent through the website server and stored in Google Sheets. The spreadsheet currently belongs to a personal Google account. The provider for EEA users is Google Ireland Limited, Ireland; Google LLC, USA, and other Google service providers may also be involved in processing. Only the controller named above administers the waitlist; this does not exclude technical processing by the providers named here. See Google’s Privacy Policy and the outstanding contractual issues at the end of this draft.

Email delivery has not started. In particular, there is currently no automatic confirmation email with a verification link. The stored delivery status is not proof of confirmation by the owner of the email address.

You can withdraw your consent at any time with effect for the future, for example by emailing jakob@diemuehlbergers.at. No reason is required. Withdrawal does not affect the lawfulness of processing before withdrawal. No further invitations or product updates will be sent after withdrawal.

Active waitlist storage ends when you withdraw consent or the waitlist closes, and in any event no later than twelve months after your signup. Deletion is performed manually. Your details will not automatically be transferred to a different mailing list later.

Contact by email or phone

If you contact us, we process your contact details and the information you provide to answer your enquiry. Emails may also contain attachments and sending and receipt information. The mailbox is hosted directly by Microsoft through Microsoft 365 / Exchange Online.

For general enquiries, the legal basis is Article 6(1)(f) GDPR; our legitimate interest is answering your enquiry. Where your request concerns specific steps prior to entering into a contract, Article 6(1)(b) GDPR applies.

Ordinary contact enquiries are deleted no later than six months after they have been resolved. Information about Microsoft’s processing is available in the Microsoft Privacy Statement. The contractual terms applicable to this particular mailbox still need to be confirmed before publication.

Recipients and international transfers

The providers named above receive data as needed for hosting, analytics, spreadsheet administration or email communication. Where required by legal obligations or specific legal claims, competent authorities, courts or legal advisers bound by professional confidentiality may also receive data.

Processing by Vercel, Google and Microsoft may take place outside the European Economic Area, particularly in the USA. Storage exclusively in Austria or the EU is not promised.

Such transfers require an applicable basis under Articles 44 et seq. GDPR, such as a relevant adequacy decision or validly agreed standard contractual clauses with any necessary supplementary safeguards. The basis covering the accounts used here has not yet been conclusively confirmed. General provider information does not replace that verification. Existing provider information is available from Vercel, Google and Microsoft. You can request further information and, where applicable, a copy of the relevant safeguards using the contact details above.

Retention and deletion

The relevant periods are stated for each processing activity. Where individual records are required to fulfil a legal obligation or establish, exercise or defend specific legal claims, only the necessary data will be retained for longer, separately from the active mailing list. Depending on the case, the legal basis is Article 6(1)(c) or (f) GDPR. Retention is determined by the specific legal obligation or the applicable limitation period and the duration of any ongoing proceedings; records are deleted afterwards. They are not used for further marketing.

Provider backups and technical deletion cycles may differ from deletion from active storage. Immediate removal from every backup system is not promised; the applicable contractual deletion terms are among the outstanding issues.

Your rights

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You can withdraw consent at any time with effect for the future.

Right to object: Where processing relies on Article 6(1)(f) GDPR, you can object on grounds relating to your particular situation. Processing will then stop unless overriding compelling legitimate grounds apply or the processing is needed for legal claims. You can object to processing for direct marketing at any time without giving a reason; processing for that purpose will then stop.

To exercise your rights, email jakob@diemuehlbergers.at. You will normally receive a response within one month. If a legally permitted extension is necessary, we will inform you of the reasons within that month.

No decisions based solely on automated processing that produce legal or similarly significant effects within the meaning of Article 22 GDPR are made.

You can lodge a complaint with a data protection supervisory authority, particularly in the country of your habitual residence, place of work or the alleged infringement. In Austria, this is the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at.

Outstanding issues in this draft

Before publication as a final notice, the following must be addressed and the affected sections updated:

• Clarify the contractual basis for Vercel Hobby or move to a suitable offering. Vercel’s published DPA names Pro and Enterprise as covered plans.
• Establish suitable data-protection arrangements for Google Sheets in the personal account, or move the waitlist to a service with appropriate arrangements. This draft does not claim that a Google Workspace agreement exists.
• Confirm the data-processing terms for Microsoft 365 / Exchange Online, and the transfer safeguards and deletion terms actually applicable to the services used.
• Assess the legal basis and any required consent controls for Web Analytics and Speed Insights, and implement them. A privacy notice alone does not replace this assessment or implementation.
• Before sending the first waitlist emails, establish the delivery method, evidence of consent and an easy way to unsubscribe. Put the agreed manual deletion periods into operational practice.