Privacy

This page covers the Lama waitlist only. It says what we store when you join, why, for how long, and how to get it deleted.

Who is responsible

Eron Feka
Contact: eronfeka28@gmail.com

What we store

• Your email address, and a simplified form of it that we use to recognise the same inbox written differently (for example with dots or a +tag in Gmail).
• The language you want to learn, and your native language if you chose one.
• The language of the page you signed up on (Albanian or English), so our emails and pages reach you in that language.
• Where you came from, if the link you used said so (for example "tiktok").
• When you signed up, when you agreed to the launch emails, when you confirmed your email, when we last sent you a confirmation email and how many we sent, and whether your address could not receive mail.
• If an email to you bounces or you mark it as spam, our email provider (Resend) tells us. We then stop emailing that address; a spam report counts as unsubscribing.
• A scrambled form (a hash) of the link we emailed you, so we can recognise it when you click it. The link itself is not stored.

To stop spam and abuse, the server looks at your IP address when you send the form or open our links. It is kept only in the server's memory for up to a day, to count attempts. Our own logs never contain your IP address, email or links: they record a short scrambled code of the IP address, the page you asked for, the time and the result. Our host keeps these logs for up to 90 days. The host's own network logs (Railway) also contain your IP address, your browser type and the page you opened (without the codes in our links); Railway keeps them for up to 90 days.

We use no cookies, no analytics and no tracking pixels. The page loads nothing from other companies.

Why

Only to email you when Lama launches. Our legal basis is your consent (GDPR Art. 6(1)(a)), which you give with the checkbox and confirm with the link in our email. You can withdraw it at any time.

Counting attempts per IP address and keeping logs protects the waitlist from spam and abuse. That is our legitimate interest (GDPR Art. 6(1)(f)).

How long we keep it

• The confirmation link works for 48 hours. If you never confirm, we delete your signup after 30 days, or once the last link we sent you has expired or an email still waiting to go out to you has been sent, if that is later.
• If you confirm, we keep it until Lama launches and we have sent the launch email, or until you unsubscribe.
• When you unsubscribe, we delete your signup from our database right away, together with any other signup for the same inbox. To stop someone else from signing you up again, we keep a scrambled fingerprint of the inbox for 30 days. It is a keyed fingerprint that only lets us recognise the same inbox again: without our secret key nobody can link it to an address. Keeping it is our legitimate interest (GDPR Art. 6(1)(f)), because it protects you from being signed up again against your will. During that time we send no emails to that inbox.
• We keep backup copies of the database for 7 days, in case something goes wrong. Data we delete disappears from the backups too, normally at the latest 7 days later. If a backup run fails, we keep the older copies until it works again (we are alerted when that happens). The backups are stored with Railway, in the EU.
• Unsubscribing does not reach copies outside our database: our host's logs (which never contain your email address) expire on their own, and Resend keeps its own records of the emails it delivered for a limited time.

Who helps us

• Railway hosts the website and the database, in the EU.
• Resend sends our emails. It receives your email address and the email's content.
• Sentry receives error reports when something breaks. We remove emails, IP addresses, links and request data from those reports before they are sent.

Railway, Resend and Sentry are companies based in the United States. Our data is stored in the EU, but these companies may process it in the United States under the safeguards the GDPR requires for such transfers.

Your rights

You can ask us what we store about you, ask us to correct or delete it, or withdraw your consent. The quickest way to leave the waitlist and delete your signup is the unsubscribe link at the bottom of every email we send. For anything else, including copies kept by the companies above, write to the contact above. You can also complain to your data protection authority.

Age

The waitlist is for people aged 16 and over.