Privacy Policy

This policy covers the Sovyn website (sovyn.eu, including the redirect from sovyn.de) — the information pages and the waitlist form. For the Sovyn app, see section 8.

1. Controller

IT-Labs GmbH
Schwabacher Straße 510, 90763 Fürth, Deutschland
Represented by: Güven Evren Karakuzu
Email: hallo@sovyn.eu
Phone: +49 911 47758150
Register: Amtsgericht Fürth, HRB 18807
VAT ID: DE313297761

For access requests, withdrawal of consent, erasure, or any other data protection matter, an informal email to hallo@sovyn.eu is enough. We have not appointed a data protection officer; the legal thresholds for doing so are not met.

2. What this website does not do

The website is statically served HTML. It sets no cookies and stores nothing in your browser — neither local nor session storage. There is no analytics, no tracking, no advertising pixels, no social media plugins, no embedded videos or maps. Fonts are served from our own server, not from Google Fonts or any other CDN. There is no cookie banner, not out of negligence, but because there is nothing to consent to.

We therefore process personal data in two cases only: when the pages are technically retrieved (section 3) and when you actively join the waitlist (section 4).

3. Hosting and access logs

The website runs on servers operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, located in Falkenstein, Germany. The provider processes data solely on our behalf under a data processing agreement pursuant to Art. 28 GDPR.

Each page request is logged by the web server as:

• date and time of the request
• the method and requested address — without the parameters after it —, status code, and amount of data transferred
• the referring page, if your browser sends one
• browser and operating system identifier (user agent)

Your IP address is not in there. Delivering the pages requires it — no server can answer without a sender — but our web server runs a log format that has no field for it. It is not truncated or removed later; it is never written down in the first place. These entries therefore cannot be attributed to a person, and we do not have to promise you a deletion period for something we do not keep.

The purpose is delivering the pages, keeping the service stable, and defending against attacks. The legal basis is our legitimate interest in a secure and functioning website (Art. 6(1)(f) GDPR). These logs are not analysed and not combined with other data.

Submitting the waitlist form is the exception: that request does not go to the website but to our application at app.sovyn.eu, whose access log does contain the IP address. It is deleted there after 14 days at the latest. That we also store the IP address of your signup as proof of consent is covered in section 4 — that record is deleted together with your entry.

4. Waitlist

Sovyn opens in waves. If you fill in the form on this website, you join a queue and are notified once a spot becomes available.

4.1 What we store

• your email address — the only thing you enter. We ask for no name, salutation, company, or phone number.
• the page you submitted the form from, as a short origin label (such as “home” or “lovable-lp”). It tells us which content leads to signups; it does not follow you across pages.
• referral codes: one of your own, so you can invite others, and — if you arrived through a referral link — a reference to the entry that referred you.
• IP address and time of signup and of confirmation, as proof of your consent (see 4.2).
• timestamps of status changes — confirmed, invited, registered.

Your position in the queue is recalculated on every view and never stored.

4.2 Purposes and legal bases

• Running the waitlist and notifying you when a spot opens: your consent under Art. 6(1)(a) GDPR. You give it by submitting the form and confirm it by clicking the link in the confirmation email (double opt-in). Without that click your entry never enters the queue, and you receive no further email from us.
• Storing the two IP addresses and timestamps: we must be able to demonstrate consent (Art. 7(1) GDPR). Without that pair, a confirmation is just a timestamp we wrote ourselves. It also protects you: entering someone else's address leaves a trace.
• Origin label and referral codes: our legitimate interest in understanding which content leads to signups and in attributing referrals (Art. 6(1)(f) GDPR). Referral links set no cookie; a ?ref= in the address bar is only read at the moment you submit.

Providing your email address is voluntary. Without it we cannot notify you; no other disadvantage arises.

4.3 Recipients

To send confirmation and invitation emails and to keep the waitlist contact list, we use Brevo GmbH, Cologne, Germany (parent company: Brevo SAS, Paris, France), as a processor under Art. 28 GDPR. What is transmitted: your email address, the origin label, your referral code, and your waitlist status. Processing takes place on servers within the EU.

No transfer to third countries takes place. Beyond this we do not share your data, do not sell it, and do not use it for third-party advertising.

4.4 Retention, withdrawal, and erasure

You may withdraw your consent at any time with effect for the future — informally, by email to hallo@sovyn.eu. This does not affect the lawfulness of processing carried out until then.

We delete your entry

• upon your withdrawal or erasure request,
• after 30 days if you never clicked the confirmation link — an unconfirmed entry never enters the queue,
• after 24 months without any further interaction,
• and when we end the waitlist because registration is open.

Deleted means fully deleted, including the stored IP addresses: we keep no proof fragments once the entry is gone. If you register, the entry becomes part of your account and is governed by section 8 from then on. Your address in our email provider's contact list is removed in the same step.

5. Contacting us by email

If you write to us, we process your address and the content of your message in order to reply — based on Art. 6(1)(b) GDPR where a contract or its initiation is concerned, otherwise based on our legitimate interest in responding (Art. 6(1)(f) GDPR). We delete the exchange once it is settled and no statutory retention obligations apply.

6. Security

The connection to this website is encrypted with TLS throughout; form input cannot be read in transit. We also limit how many signups a single sender or a single address can make, so that our form cannot be used as a tool for sending unwanted email to third parties.

7. No automated decision-making

There is no automated individual decision-making, including profiling, within the meaning of Art. 22 GDPR. The order of the waitlist follows from the time of your confirmation and from confirmed referrals; it has no legal effect concerning you.

8. The Sovyn app

This policy describes the website. Using the app at https://app.sovyn.eu involves further processing — account, teams, projects, deployments. We inform you about it during registration and in the terms of use, including the Art. 28 GDPR processing agreement covering the data you process in your own applications.

9. Your rights

In relation to us you have the right to

• access to the data stored about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on legitimate interests (Art. 21 GDPR),
• withdraw consent with effect for the future (Art. 7(3) GDPR).

An email to hallo@sovyn.eu is enough; there is no particular form to use. Independently of this, you may lodge a complaint with a data protection supervisory authority at any time (Art. 77 GDPR) — the authority of your habitual residence, your place of work, or of our registered office.

10. Changes to this policy

We update this policy when the processing described here changes — for example when the waitlist ends because registration is open. The version published here is the one that applies.

Last updated: 12 August 2026. This is a translation of the German version, which prevails in case of discrepancy.