Privacy Policy

Last updated: October 2026

01 — Controller

The controller within the meaning of the GDPR is:

Xtract UG (haftungsbeschränkt)
represented by the managing directors Marc Müller and Paul Weber
Am Römischen Hof 21, 61352 Bad Homburg v. d. Höhe, Germany
Email: contact@thextract.com

02 — Waitlist

When you join the waitlist for the closed beta, we process:

• Email address (required)
• Time of sign-up and your consent

The purpose of processing is to add you to the waitlist and to notify you when places in the beta become available.

The legal basis is your consent pursuant to Art. 6 (1) lit. a GDPR, which you give explicitly by checking the consent checkbox during sign-up. You may withdraw your consent at any time with effect for the future by sending an email to contact@thextract.com.

03 — Contact form

When you write to us through the contact form, we process:

• Name and email address (required)
• Company and message (optional)
• Your request type (demo request or question)

The purpose is to handle your request. The details are sent to us by email and are not stored in a database.

The legal basis is Art. 6 (1) lit. b GDPR where your request aims at a contract (such as a demo), and otherwise Art. 6 (1) lit. f GDPR (legitimate interest in answering enquiries). We delete the details once your request has been handled and no statutory retention obligation applies.

04 — Double opt-in

Waitlist sign-ups are processed using a double opt-in procedure. After submitting your email address, you will receive a confirmation email. Your registration is only activated after you click the confirmation link. We store the timestamp and IP address of the confirmation as proof of consent.

05 — Data processors

We use the following service providers who process personal data on our behalf. A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place with each provider:

• Brevo SAS (France) — Email delivery: double opt-in confirmation, waitlist notifications and delivery of contact requests; servers in the EU
• Cloudflare, Inc. (USA) — Hosting and delivery of the website, storage of the waitlist, bot protection (Turnstile) and request limiting. Transfers to the US are based on the EU-U.S. Data Privacy Framework and, additionally, the EU Standard Contractual Clauses.

06 — Cookies and analytics

We do not set cookies for analytics or advertising and do not use any analytics tools. No cookie banner is therefore required.

07 — Protection against abuse

To protect the forms against automated requests, we use Cloudflare Turnstile. Turnstile evaluates technical characteristics of your browser and your IP address. We also limit the number of requests: for this, the IP address and email address are stored only as an irreversible hash and deleted automatically after one hour or one day respectively.

The legal basis is Art. 6 (1) lit. f GDPR (legitimate interest in the security of our website and protection against abuse).

08 — Retention period

Your data will be stored for as long as you remain on the waitlist. After the waitlist phase ends or upon your request, your data will be deleted promptly, and no later than 12 months.

09 — Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21). To exercise your rights, contact us at contact@thextract.com.

You also have the right to lodge a complaint with the competent supervisory authority in your country of residence.