Waitlist Privacy Policy

Updated at 2026-09-01

This Waitlist Privacy Policy explains how Astropilot ("we," "our," or "us") collects, uses, shares, and protects personal information when you visit the Astropilot waitlist website or join the waitlist (the "Waitlist").

Joining the Waitlist does not constitute an offer of a product or service, provide access to the Astropilot application, or by itself create a contractual or customer relationship with Astropilot. In a region where only the Waitlist is available, Astropilot does not currently offer or provide its product or services in that market. We operate the Waitlist there for market research, including to understand regional interest and demand and to inform whether Astropilot may enter that market in the future.

Astropilot is the data controller for the processing described in this policy.

1. Who we are

Astropilot is operated by:

Astropilot
Østerbrogade 226, st. 1
2100 København Ø
Denmark
Registration number: DK28942362

You can contact us at info@astropilot.com.

2. Information we collect

2.1. Information submitted through the waitlist form

When you join the Waitlist, we collect and process:

  • Your email address;
  • The consent wording shown to you, a hash of that wording, and the date and time of your consent as reported by your browser;
  • The region and language configured for the page;
  • The address of the page where you submitted the form, limited to its origin and path;
  • A shortened IP address, browser user-agent, and country derived from the request;
  • Technical identifiers, including a request identifier and identifiers for the versions of the website and waitlist software involved; and
  • The outcome of the waitlist registration and welcome-email delivery.

We assign the waitlist contact an opaque, randomly generated consent reference identifier. The identifier is stored with the email contact and in a separate consent log. New consent-log records use this identifier instead of storing your email address or a hash of your email address. The consent log is append-only and hash-chained so that the integrity of the consent evidence can be checked.

The waitlist form does not set cookies or use local storage. It does not store your complete IP address, URL query strings or fragments, or the contents of the hidden anti-bot field.

2.2. Website analytics

Our waitlist website uses Clicky, a website analytics service provided by Roxr Software Ltd in the United States, to understand how the site is used. Clicky processes analytics information on our behalf and according to our instructions.

We have configured Clicky's visitor privacy feature to apply to all visitors. With this configuration, Clicky:

  • Anonymizes visitor IP addresses;
  • Does not set tracking cookies or assign a persistent unique visitor identifier; and
  • Offers a service-wide opt-out at https://clicky.com/optout.

Clicky may still process the address and title of pages you view, the address and title of links you click, the referring page, browser user-agent and device information, screen resolution, language, and mouse-event coordinates used to produce aggregate usage reports.

If you use a VPN or private-relay service, Clicky may log that service's full IP address because your own IP address is already hidden from us and Clicky.

We use this information only for website statistics and improvement. We do not combine Clicky analytics with your waitlist information to track you across other companies' websites or use it to build advertising profiles.

3. How and why we use your information

We use waitlist information to:

  • Register you for the Waitlist;
  • Conduct market research, including assessing regional interest and demand and informing possible future market-entry decisions;
  • Send a welcome receipt, waitlist communications, product updates, and, if we decide to offer the product in your market, a possible invitation to access or purchase it;
  • Provide a working unsubscribe method;
  • Prevent and investigate misuse;
  • Operate and troubleshoot the Waitlist; and
  • Retain limited evidence of the consent you gave.

Joining the Waitlist does not guarantee that Astropilot will enter your market or invite you to access or purchase the product. Any future access or purchase would require a separate step and would be governed by the terms and privacy policy applicable at that time.

We process your email address and send waitlist communications based on your consent (GDPR Art. 6(1)(a)). You may withdraw that consent at any time by using the unsubscribe link in a waitlist email or contacting us. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

We process limited technical information and consent evidence based on our legitimate interests (GDPR Art. 6(1)(f)) in securing the Waitlist and establishing, exercising, or defending legal claims. We limit the information and its retention as described in this policy. You may object to this processing by contacting us.

We process analytics information based on our legitimate interest in understanding and improving the waitlist website. Clicky is configured to minimize the information used for that purpose as described above.

4. How we share information

We do not sell or rent your personal information. We disclose it only as described in this policy, to operate the Waitlist, or where disclosure is required or permitted by law.

4.1. Waitlist service providers

We use the following service providers:

  • Mailjet (Sinch) provides contact-list management and delivery of ongoing waitlist communications. Mailjet receives the email address, opaque consent reference identifier, signup source and time, configured region and language, and coarse country. It also processes delivery information and may maintain email engagement records, such as whether an email was opened or a link was clicked.
  • Amazon Web Services Simple Email Service (AWS SES) delivers the transactional confirmation of your waitlist signup. AWS SES receives your email address and the confirmation-email content and processes delivery and operational information, such as delivery status and technical message identifiers.
  • Vercel hosts the waitlist API and handles requests to it. Vercel provides the coarse country associated with a request and processes operational information such as request identifiers and function logs. Our application logs are designed not to contain email addresses. Vercel's log retention depends on the service plan in use.
  • Supabase provides the PostgreSQL database that holds the append-only consent log. The log contains consent and limited request evidence linked by the opaque consent reference identifier. Supabase uses sub-processors, including Amazon Web Services (AWS), for infrastructure, and the database holding the consent log is hosted within the EU/EEA.
  • Clicky (Roxr Software Ltd) provides the privacy-configured website analytics described above.

These providers process information on our behalf to provide their respective services and are subject to their applicable contractual and data-processing terms.

We may also disclose information where reasonably necessary to comply with a legal obligation or valid legal process; protect our rights or the rights and safety of others; investigate fraud, abuse, or security incidents; or complete a merger, acquisition, reorganization, or sale of all or part of our business. A recipient involved in a business transfer must use the information consistently with this policy unless applicable law permits otherwise.

5. International processing

Some providers may process information outside your country, including in the United States. Where the GDPR or similar transfer rules apply, we use legally recognized safeguards as required, such as an applicable adequacy decision, participation in the EU-US Data Privacy Framework, or standard contractual clauses.

Clicky processes analytics information in the United States. Roxr Software Ltd states that it participates in the EU-US Data Privacy Framework and its UK and Swiss extensions and offers standard contractual clauses. We rely on applicable safeguards for this transfer.

Mailjet, AWS SES, and Vercel may process contact, email-delivery, or operational information outside the EU/EEA depending on how their services and sub-processors are used. Their applicable contractual safeguards and data-processing terms govern that processing. The Supabase database holding the waitlist consent log is hosted within the EU/EEA.

6. Retention, unsubscribe, and deletion

Mailjet keeps your waitlist contact information while you remain on the Waitlist. Using the unsubscribe link removes you from future waitlist mailings. You may also ask us to delete the contact record by contacting info@astropilot.com. Unsubscribing and deleting the contact record are separate actions; unsubscribing does not necessarily erase the provider's contact record.

AWS retains SES delivery and operational information according to our AWS account configuration and its applicable service and data-processing terms.

We retain waitlist consent-log records for 1,096 days (approximately three years), after which they are automatically pruned. We retain this limited evidence based on our legitimate interest in establishing, exercising, or defending legal claims. Because the log is append-only, individual records are not altered or selectively removed during that period. When the Mailjet contact is deleted, the opaque consent reference identifier remaining in a new-format log record is no longer linked to an identifiable person through Mailjet.

Vercel's operational-log retention depends on the service plan in use. Clicky retains analytics information according to our configured account settings and its applicable service terms. We delete or anonymize information when it is no longer needed for the purposes described here, subject to legal obligations and the specific retention rules above.

7. Your privacy rights

Depending on where you live, you may have the right to:

  • Request access to and a copy of your personal information;
  • Correct inaccurate information;
  • Request deletion of information;
  • Restrict or object to certain processing;
  • Receive information you provided in a portable format;
  • Withdraw consent at any time; and
  • Lodge a complaint with a data-protection authority.

Contact info@astropilot.com to exercise a right. We may request information reasonably necessary to verify your identity and protect your information. We use the email address supplied with a verified request to locate the Mailjet contact and its consent reference identifier. Deleting the Mailjet contact may prevent us from subsequently associating a new-format consent-log record with you.

These rights may be subject to exceptions under applicable law, including where limited information must be retained to establish, exercise, or defend legal claims. We aim to respond within one month and will tell you if applicable law permits or requires additional time.

If you are in the EU/EEA and believe your rights have been violated, you may complain to the supervisory authority where you live, work, or where the alleged infringement occurred. Contact details are available from the European Data Protection Board. You may also contact us first so we can investigate your concern.

8. Cookies and similar technologies

The waitlist form does not set cookies or use local storage. Our website analytics is configured not to set tracking cookies or assign a persistent visitor identifier, so it operates without storing analytics identifiers on your device.

We will show a cookie consent banner before using any future non-essential feature that stores cookies or similar information where consent is required. The banner and its preference controls will identify the relevant purposes and providers.

You may configure your browser to block or delete cookies and similar storage. This does not prevent the cookie-free analytics processing described above. You may opt out of Clicky analytics at https://clicky.com/optout.

9. Do Not Track and third-party tracking

We do not collect personally identifiable information about your online activities over time and across third-party websites or online services. Because we do not carry out that kind of tracking, we do not respond to browser "Do Not Track" signals.

We do not permit third parties to use the waitlist website to collect personally identifiable information about your activities over time and across different websites. Clicky is configured not to set tracking cookies or assign a persistent visitor identifier.

10. California privacy disclosures

10.1. CCPA and CPRA

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), applies to businesses that meet statutory thresholds relating to annual revenue, the number of California consumers or households whose personal information they process, or the share of revenue derived from selling or sharing personal information.

Astropilot does not currently meet those thresholds, so the CCPA does not currently apply to us. We review this at least annually and when our business changes materially.

Regardless of current applicability, we honor reasonable verified requests to access, correct, or delete waitlist personal information, subject to the limits described in this policy. We will not discriminate against you because you exercised a privacy right. Deleting information needed to provide the Waitlist may mean that we can no longer provide it to you.

We do not sell personal information or share it for cross-context behavioral advertising as those terms are defined by California law. We therefore do not provide a "Do Not Sell or Share My Personal Information" link or process opt-out preference signals such as Global Privacy Control for that purpose. We will update this policy and provide required mechanisms if our practices or legal obligations change.

10.2. CalOPPA

For purposes of the California Online Privacy Protection Act (CalOPPA):

  • The categories of personally identifiable information collected through the Waitlist and the categories of providers receiving it are described under "Information we collect" and "How we share information."
  • You may review or request changes to your information by contacting info@astropilot.com as described under "Your privacy rights."
  • The effective date is stated at the top of this policy.
  • Material changes will be communicated as described under "Changes to this policy."
  • Our response to Do Not Track signals and our practices concerning third-party collection across websites are described above.

11. Children's privacy

The Waitlist is intended for a general audience and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe a child has provided personal information, contact info@astropilot.com. If we learn that we collected such information without required parental consent, we will take steps to delete it.

12. Security and data breaches

We use reasonable technical and organizational measures intended to protect waitlist information against unauthorized access, loss, alteration, or disclosure. Access to personal information is restricted to people and providers that need it for the purposes described in this policy. No transmission, storage, or security system can be guaranteed to be completely secure.

If a personal-data breach occurs, we will investigate it and notify affected individuals and authorities when required by applicable law.

13. Links to other websites

The waitlist website may contain links to websites that we do not operate. This policy does not cover those websites, and we are not responsible for their content or privacy practices. Review the privacy notice of another website before providing information to it.

14. Changes to this policy

We may update this policy when the Waitlist, our providers, our practices, or legal requirements change. The updated date at the top shows when the current version took effect. If a change materially affects how we use information already collected, we will provide notice as required by law and seek consent where required.

15. Governing law and jurisdiction

This policy and your use of the Waitlist are governed by Danish law, without regard to conflict-of-law rules. Disputes are subject to the competent courts of Denmark, including Copenhagen City Court where applicable. This does not limit any mandatory rights or remedies you have under the law where you live.

16. Contact us

For questions, requests, or complaints concerning this policy or the Waitlist, contact:

Astropilot
Østerbrogade 226, st. 1
2100 København Ø
Denmark
Registration number: DK28942362
Email: info@astropilot.com