Privacy Policy
Stay Bright (staybright.app)
Controller: Arkenstone Labs GmbH
Last updated: September 27, 2026
Support / privacy contact: [email protected]
1. Controller (Art. 13 GDPR)
Arkenstone Labs GmbH (formerly OKpanda GmbH)
Albrechtstr. 112 F
12167 Berlin
Germany
(c/o Yoav Pasovsky)
Email: [email protected]
Register: Amtsgericht Charlottenburg (Berlin), HRB 186358 B
USt-IdNr.: DE312254441
Geschäftsführer: Yoav Pasovsky
Further details: see Impressum.
2. What this policy covers
This policy describes how we process personal data when you visit staybright.app and when you join the Stay Bright Waitlist. The Waitlist has no paid account and no in-app product on this Site.
3. Data we process
| Data | When | Purpose | Legal basis |
|---|---|---|---|
| Email address | You submit the Waitlist form | Add you to the Waitlist; confirm signup; tell you when early access opens | Art. 6(1)(b) GDPR (steps at your request to join the Waitlist) and/or Art. 6(1)(a) if we rely on consent for a specific email type stated beside the form |
| Signup time, technical metadata needed to run the form (e.g. IP, user agent, referrer) | Form submit | Operate the form, prevent abuse, debug failures | Art. 6(1)(f) legitimate interests (security and reliable Waitlist operation) |
| Server / CDN logs | Site visit | Security, performance, abuse prevention | Art. 6(1)(f) |
| Cloudflare Web Analytics (or similar) events | Site visit, if enabled | Aggregate traffic and performance | Art. 6(1)(f) and, where TDDDG §25 requires consent for non-essential storage/access, consent |
| Meta Pixel events | Only if Pixel is enabled after consent UI | Ad measurement / remarketing as disclosed in the consent UI | Art. 6(1)(a) consent; TDDDG §25 where applicable |
We do not collect health data, medical history, or payment card data on the Waitlist page.
If Meta Pixel is not live: we do not use Meta Pixel on this Site, and the Meta row above does not apply until we enable it with a consent UI that includes reject and withdraw.
4. Recipients and processors
- Hosting / CDN / Waitlist storage: Cloudflare (Workers, Pages, KV or D1 as configured)
- Support mail: emails to [email protected] are forwarded to [email protected]
- Accountants / advisors: only if needed for company operations, not for Waitlist marketing
Some providers may process data outside the EU/EEA. Where required, we use appropriate safeguards such as Standard Contractual Clauses.
5. Retention
- Waitlist emails: until you ask us to delete them, or until we close the Waitlist and no longer need the list for launch notice, then delete or anonymize within 90 days after Waitlist closure or within 12 months after the last launch-related notice, whichever comes first (unless a longer period is required by law or you become a customer under a new policy)
- Security / server logs: typically up to 90 days, longer only if needed for an active security incident
- Analytics aggregates: per tool settings; we prefer short retention and no advertising ID where possible
6. Your rights
Under GDPR (and similar laws where they apply) you may request access, rectification, erasure, restriction, portability, and objection. You may withdraw consent at any time without affecting prior lawful processing.
Email [email protected].
You may lodge a complaint with a supervisory authority (in Germany: your state data protection authority, or BfDI where competent).
7. California notice (CalOPPA-style)
If you are a California resident visiting the Site: we state what we collect and why above. We do not sell Waitlist emails for money. Contact [email protected] for privacy requests. We will respond as required by applicable law.
8. Children
The Waitlist is aimed at adults. We do not knowingly collect emails from children under 16. Contact [email protected] to request deletion if you believe we have.
9. Cookies and similar tech
Essential hosting and security tech may run without consent where allowed. Non-essential analytics or advertising tech requires consent where TDDDG §25 / GDPR so require. Any future consent UI will offer reject and later withdraw options. Cloudflare Analytics will be assessed separately under TDDDG §25 before relying on it without consent.
10. Changes
We will post updates with a new date. For material changes that need fresh consent or agreement, we will ask again where required. We do not treat silent continued browsing alone as consent to new non-essential tracking.
11. Contact
Arkenstone Labs GmbH
[email protected]
See Impressum for full company identity.