Privacy policy
This is our first version, written for the website and the waitlist. We'll update it as Pastel Cloud gets closer to launch, and we'll email people on the waitlist about any change that matters to them.
This policy explains what personal data we collect when you visit pastel.cloud or join the waitlist, why we collect it, and what you can ask us to do with it. The short version: we collect as little as we can, and we never sell it.
Who we are
Pastel-Cloud OÜ is a private limited company registered in Estonia (registry code 17571600, Jõe tn 3-312, 10151 Tallinn, Estonia). We run pastel.cloud and the Pastel Cloud waitlist, and we are the controller of the personal data described here.
What this policy covers
This policy covers visits to pastel.cloud and joining our waitlist. The Pastel Cloud service itself will have its own privacy policy when it opens. What we can and can't see inside the service is explained on How privacy works.
What we collect
| When | What we keep | Why |
|---|---|---|
| You join the waitlist | Your email address, your name if you give it, the consent text you agreed to, the page and time you agreed on, the page that sent you to us, and any campaign tags in the link you followed. | To email you about the launch, and to prove you asked us to. |
| You visit a page | The page address, the time, the website that linked to us (its name only), a rough device type, operating system and browser family, and a visitor code made by scrambling your IP address together with the day's date and a secret key, so the code changes every day. | To count visits and see which pages help people. |
We never store your IP address itself or your full browser identification string. Without the secret key the visitor code can't be turned back into an IP address, and codes from different days can't be linked. Our hosting providers' standard server logs may hold your IP address for a short time for security; we don't use them to identify you. We set no cookies of our own.
Waitlist details are stored encrypted, with keys that only we hold, so our hosting providers can't read them. They are readable only briefly while they travel: when you sign up, and when we send you an email. We don't log them.
Our emails don't track which links you click, and they don't track whether you opened them. If we ever offer open tracking, for example so you can be sure you saw an alert about your account, it will be something you switch on yourself.
Our legal basis
- Waitlist emails: your consent (Article 6(1)(a) of the General Data Protection Regulation, GDPR). You can withdraw it at any time.
- Visit counts: our legitimate interest in understanding how the site is used, with the protections described above (Article 6(1)(f) GDPR).
Confirming and leaving the waitlist
After you sign up we send one email asking you to confirm. Until you do, we won't send anything else, and the confirmation link expires after 48 hours. Every email we send has an unsubscribe link that works in one click. When you unsubscribe we keep a note that you did, so we never email you again. Ask us and we'll delete that too.
Who helps us
We use a few providers who process data on our behalf:
- Cloudflare hosts this website.
- Fly.io runs our servers. Our API runs in Frankfurt, Germany.
- AnyPost delivers our emails, so it receives your email address and name.
Some of these companies are based outside the European Economic Area. Where data leaves it, we rely on the safeguards the GDPR requires, such as the European Commission's standard contractual clauses.
How long we keep it
Waitlist details stay until you unsubscribe or ask us to delete them, or until we close the waitlist. Visit records are kept only for a short time. After that only totals remain, such as how many people opened a page on a given day, which can't be tied to anyone. We'll state the exact period here when the service launches.
Your rights
You can ask to see, correct, export or delete your data, to limit how we use it, or object to it being used. Write to privacy@pastel.cloud and we'll answer within one month.
If you think we've handled your data wrongly, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or the data protection authority where you live.
Changes to this policy
If we change this policy we'll update the date at the top. If the change matters for people on the waitlist, we'll email them before it applies.
Contact
Pastel-Cloud OÜ, registry code 17571600, Jõe tn 3-312, 10151 Tallinn, Estonia. privacy@pastel.cloud