Privacy Policy

Note: This English version is provided for convenience. The German version is legally binding.

This privacy policy covers the website saya-sleep.com and the early-access waitlist. The SAYA app has its own App Privacy Policy.

1. Controller

Name and address: Lukas Bröll Bodmanstr. 23 87439 Kempten Germany

Contact: Email: l.broell@freenet.de

2. The short version

This website processes your personal data minimally and privacy-first:

  • No cookies. We do not set any cookies.
  • Privacy-friendly analytics. We use a cookieless, privacy-friendly analytics tool (Umami) to measure reach. It sets no cookies, stores no personal data, and does not track you across websites or build user profiles.
  • Self-hosted resources. Fonts and other assets are served from our own hosting — no connection to Google Fonts or similar services.
  • Minimal collection. Beyond technically required server logs, data only flows when you actively join the waitlist.
  • Stored in the EU. Waitlist data is stored in a data center in Frankfurt, Germany. To send the waitlist emails, your email address and delivery log data are additionally processed by a US provider (see section 4).

3. Hosting and server logs

This website is hosted by:

IONOS SE Elgendorfer Str. 57 56410 Montabaur, Germany

Server log files

On every visit, the hosting provider automatically records the following in server log files:

  • IP address of the requesting device
  • Date and time of access
  • File name and URL of the requested page
  • User agent (browser information)
  • Referrer (the page that linked you here)

Purpose: operation, stability and security of the hosting.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating a secure and stable website).

Retention: Log files are retained by the hosting provider according to its deletion policy and deleted afterwards. Details are available in IONOS's privacy policy.

Data processing agreement: A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place with IONOS.

4. Waitlist (early access)

Data processed

When you join the waitlist, we process:

  • Email address
  • Selected language (German/English)
  • Time of sign-up
  • Whether and when you confirmed your address (double opt-in)
  • Your IP address at the time you signed up. We store this permanently alongside your entry in order to be able to demonstrate your consent, as Art. 7(1) GDPR requires of us. It is used for no other purpose and is deleted together with your entry.
  • Referral data: a referral code assigned to you, the code you were referred through if any, and the status of any resulting reward. This lets us credit "first month free" to the right person and detect abuse (e.g. self-referrals or reciprocal loops).

Purpose and legal basis

Purpose: notifying you about availability and early access to the SAYA app, plus occasional product updates.

Legal basis: Art. 6(1)(a) GDPR (consent). By joining the waitlist you consent to the processing of your email address for these purposes.

Confirmation of your address (double opt-in)

After signing up you receive an email asking you to confirm your address. Your entry only becomes active once you follow that link. This documents your consent and prevents anyone from entering an address that is not theirs. An unconfirmed entry receives no emails from us other than a repeat of this confirmation request.

Withdrawal and unsubscribing

You can withdraw your consent and leave the waitlist at any time with effect for the future — by emailing l.broell@freenet.de or via the unsubscribe link included in every email we send. Using that link deletes your entry immediately and permanently. Processing carried out before withdrawal remains lawful.

Storage system and location

Your waitlist data is stored in Google Cloud Firestore. Our contracting party is:

Google Ireland Limited Gordon House, Barrow Street Dublin 4, Ireland

Storage location: The database runs in the Google Cloud region europe-west3 (Frankfurt, Germany).

Third-country access: Even with EU storage, access by US-based Google group companies (e.g. for support or maintenance) cannot be fully excluded. Appropriate safeguards are in place for such cases: Google LLC is certified under the EU-US Data Privacy Framework, and the EU Standard Contractual Clauses apply as part of the Google Cloud Data Processing Addendum (a data processing agreement pursuant to Art. 28 GDPR).

Email dispatch

Waitlist emails — the confirmation request and, where applicable, the notice that someone joined through your referral link — are sent via Resend. Our contracting party is:

Plus Five Five, Inc. (trading as "Resend") 2261 Market Street #5039 San Francisco, CA 94114, USA

For this purpose, your email address, your selected language and the delivery status of the message are processed.

Sending route and storage location: Dispatch runs through Resend's eu-west-1 (Ireland) region. That region setting only determines where the emails are sent from — it does not determine where the data is stored. According to Resend, account data including email metadata, logs and API records is stored in the United States, regardless of the sending region selected.

Third-country transfer: Data is therefore transferred to the United States. The safeguard under Art. 46 GDPR is provided by the EU Standard Contractual Clauses, which are incorporated into Resend's data processing agreement (Art. 28 GDPR). That agreement takes effect upon acceptance of Resend's terms of service.

Retention

Your data is stored until you withdraw your consent or unsubscribe, and at the latest until the waitlist is discontinued. It is then deleted.

4a. Feedback and pricing survey

On the feedback page, and in the block at the bottom of the home page, you can voluntarily take part in a short survey.

Data processed

  • Your ratings of individual planned features (1–5 scale)
  • Your willingness-to-pay answers for several price points (1–5 scale)
  • Your free-text answer about missing features (max. 2,000 characters)
  • Your email address
  • Chosen language and time of submission
  • Whether you ticked the follow-up contact box

The short variant at the bottom of the home page collects no willingness-to-pay answers and no contact box.

Purpose and legal basis

Purpose: to understand which features matter to you and what price would be appropriate, so we can shape the product accordingly.

Legal basis: Art. 6(1)(a) GDPR (consent), which you give by submitting the form. If you also tick "SAYA may contact me for follow-up questions about the app", you additionally consent to being contacted about your answers. That box is optional — the survey can be submitted without it.

Storage location and retention

Answers are stored in Google Cloud Firestore in the region europe-west3 (Frankfurt am Main, Germany); the details in Section 4 apply equally. We keep them until the evaluation is complete, and at the latest until the app launches, after which they are deleted or anonymized.

Withdrawal and deletion: email l.broell@freenet.de and we will delete your answers.

5. Website analytics (reach measurement)

To understand how this website is used — for example the number of visits, the country visitors come from, the approximate time spent on a page, and how many visitors join the waitlist — we use Umami, a privacy-friendly, cookieless web analytics tool.

Data processed

  • Anonymized usage data: pages viewed, date and time, referrer, approximate location (country/region derived from the IP address), and browser/device type, as well as whether a waitlist sign-up took place.
  • Your IP address is used only transiently to derive the approximate location and an anonymous session identifier; it is not stored by Umami.
  • Umami sets no cookies, stores no personal data, and does not track you across other websites or build user profiles.

Purpose and legal basis

Purpose: privacy-friendly measurement of reach and usage, to operate and improve the website.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a needs-based, privacy-friendly analysis of website usage). As Umami stores no information on your device (no cookies or comparable technologies), no consent under § 25 TTDSG is required.

Processor and data transfer

Analytics is provided on our behalf by Umami Software, Inc. (USA). A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place. Umami Cloud offers data hosting in the EU; where data is transferred to the USA, the EU Standard Contractual Clauses are incorporated as part of the DPA. Details: Umami Data Processing Agreement.

Objection

You can object to this processing at any time with effect for the future (Art. 21 GDPR) — for example by using a browser or extension that blocks the analytics script, or by contacting us at the address above.

6. Your privacy rights

Regarding your personal data, you have the right to:

  • Access (Art. 15 GDPR): ask whether and which data we process about you.
  • Rectification (Art. 16 GDPR): have inaccurate data corrected.
  • Erasure (Art. 17 GDPR): have your data deleted under the statutory conditions.
  • Restriction (Art. 18 GDPR): have processing restricted.
  • Data portability (Art. 20 GDPR): receive your data in a common, machine-readable format.
  • Objection (Art. 21 GDPR): object to processing based on legitimate interests.
  • Withdrawal of consent (Art. 7(3) GDPR): at any time with effect for the future.
  • Complaint: lodge a complaint with a data protection supervisory authority, e.g. the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

To exercise these rights or for any privacy questions, contact us at l.broell@freenet.de.

7. Information for users outside the EU

This website is operated from Germany and follows the EU General Data Protection Regulation (GDPR) — one of the strictest privacy standards in the world. If you visit from outside the EU (including the United States), the same protections apply to you: minimal data collection, no advertising trackers, no sale of personal data, EU-based storage. We honor requests to access or delete your data regardless of where you live — just contact the address above.

8. Status of this privacy policy

This privacy policy was last updated in August 2026. We will update it whenever the data processing on this website changes.