Privacy policy
1. What this document covers
This policy covers the glucolantern.com website only, and specifically the early-access signup form. It does not describe the mobile app or the GlucoLantern device — those are separate processes built around a user account, which someone joining the waiting list does not yet have.
2. Who the data controller is
The controller for data collected through this site is KolajFX Tomasz Kolaj, a sole proprietorship registered in Poland, at Filice 87, 13-200 Działdowo.
For anything concerning personal data, write to privacy@glucolantern.com. The mailbox is monitored by the controller. We answer requests about your data within one month of receiving them; for complex requests that period may be extended by a further two months, and we will tell you if it is.
3. What we collect and why
Everything below comes from one place: the signup form on the homepage. The site collects nothing at all from visitors who do not submit that form.
| Data | Purpose | Legal basis |
|---|---|---|
| Email address | Contacting you about early access and sending your signup confirmation | Consent — GDPR Art. 6(1)(a) |
Signup type (waitlist or tester) |
Telling a waiting-list signup apart from a tester-programme application | Consent — GDPR Art. 6(1)(a) |
| Market and role (e.g. "Poland", "parent / carer") — tester applications only | Selecting participants for the tester programme | Consent — GDPR Art. 6(1)(a) |
Page language (pl / en) |
Sending your confirmation in the right language | Consent — GDPR Art. 6(1)(a) |
Entry source, referring page and campaign parameters
(utm_source, utm_medium, utm_campaign,
utm_content, utm_term)
|
Understanding which of our materials actually reach people | Legitimate interest — GDPR Art. 6(1)(f) |
| Date and time of signup | Position on the list, and evidence of when consent was given | Legitimate interest — GDPR Art. 6(1)(f) |
| IP address | Solely to cap submissions from one address (5 per hour) and protect the form from bots. It is not included in any email and is never linked to your email address. | Legitimate interest — GDPR Art. 6(1)(f) |
The form also contains a hidden decoy field for bots and measures how long the form took to fill in. Both are used only to reject a submission; neither is stored anywhere.
4. Who we share it with
Data reaches two providers, both acting as processors on our behalf:
- Cloudflare — website hosting, plus the short-lived counter that holds your IP address for about an hour.
- Resend — delivery of two emails: a signup notification to the site owner and a confirmation to you.
We do not sell your data, and we do not share it with third parties for marketing.
Both providers also process data outside the European Economic Area. A data processing agreement is in place with each of them, incorporated into their service terms. Cloudflare is certified under the EU-US Data Privacy Framework and its agreement additionally contains Standard Contractual Clauses. Resend relies on Standard Contractual Clauses. Google, as the provider of the controller’s destination mailbox, acts under its own data processing terms.
5. How long we keep it
- IP address — about an hour, after which the counter expires by itself.
- Your signup — kept until you withdraw consent, until the purpose is exhausted (the launch notice sent and a short follow-up window closed), or for a maximum of 24 months from signup — whichever comes first. After that we delete it. If the project is abandoned, we delete signups promptly.
6. Your rights
Under the GDPR you have the right to:
- access your data and receive a copy of it,
- have inaccurate data corrected,
- have your data erased ("right to be forgotten"),
- restrict processing,
- data portability,
- object to processing based on legitimate interest,
- withdraw consent at any time — without affecting the lawfulness of processing carried out before the withdrawal.
To exercise any of these, write to privacy@glucolantern.com. We respond within 30 days. To leave the list, one sentence is enough — we will not ask you for a reason.
You also have the right to lodge a complaint with a supervisory authority. In Poland that is the President of the Personal Data Protection Office (PUODO). You may also complain to the supervisory authority of the country where you habitually live or work.
7. Cookies and browser storage
This site sets no cookies and runs no analytics or tracking of any kind. There is no Google Analytics, no Facebook pixel, nothing comparable — which is why you are not being asked to accept a cookie banner.
One value is kept in your browser's local storage: glucolantern-locale, the
language you picked. It is never sent to a server and disappears when you clear your
browsing data.
We serve our typefaces from our own server. Browsing this site, your browser makes no requests to any third party.
8. Security
The connection to this site is encrypted (HTTPS). The form accepts submissions only from the glucolantern.com domain and is protected against automated submissions.
9. Changes to this policy
If we change what we collect or why, we will update this document and change the date at the top of the page.