Privacy notice

Who is responsible

destbo labs is the data controller. Access to waitlist entries is limited to destbo labs and the service providers needed to operate the services described below.

privacy@destbo.com

What we collect

The waitlist collects first name, email address, signup date, a signup identifier, your consent choices, the notice version and the website source. Company and role are optional. We include them only with your separate permission.

If you contact us, we receive your message, email address and any information you choose to include. Service providers also process technical information, such as IP addresses, request times and browser details, to deliver and secure the website and database. We do not add these technical details to the waitlist table.

Why we use it and your choices

Pilot contact: with your consent under GDPR Article 6(1)(a), we use your first name and email to manage your signup and contact you about Handover pilot or early-access availability. Contact consent is required to join, but not to browse the website.

Customer-interest research: with separate optional consent under Article 6(1)(a), we use company and role to understand which businesses and roles are interested and inform product development. Leaving this unticked does not affect your place on the waitlist.

Enquiries and service security: we rely on our legitimate interests in answering business enquiries and operating a reliable, secure service under Article 6(1)(f). Article 6(1)(b) applies where you ask us to take steps towards a contract. These consents do not sign you up for a general newsletter. We do not make solely automated decisions about waitlist members that have legal or similarly significant effects.

Withdrawing consent

Email privacy@destbo.com at any time to leave the waitlist, withdraw permission for customer-interest research, or both. You do not need an account. Withdrawing research consent removes company and role without removing you from the contact waitlist. Withdrawal does not affect processing that was lawful before it.

How long we keep information

We keep waitlist information only while needed for the stated purposes, for a maximum of 24 months from signup. We delete it earlier if you withdraw the relevant consent, request deletion where applicable, or the waitlist purpose ends. We do not automatically extend this period when we send you an email.

We keep ordinary enquiries for as long as needed to resolve them and for no more than 24 months after the last substantive contact. Specific records may be kept longer where necessary to meet a legal obligation or establish, exercise or defend a legal claim; access and use are then limited to that purpose.

destbo labs handles deletion and withdrawal requests. Deleted information may remain in restricted recovery backups until the provider replaces or expires them. If a backup is restored, applicable deletions must be reapplied. Providers retain technical service data under their own documented security, operational and legal retention criteria; we do not use those logs for customer-interest research.

Service providers

Supabase stores the waitlist in our selected Central EU (Frankfurt) database. Your browser sends form entries directly to Supabase. Google Workspace / Gmail handles correspondence. Vercel hosts this website; signup fields are not sent through a Vercel form handler. Cloudflare provides domain registration and DNS, configured as DNS only rather than proxying website traffic.

Providers process information needed to deliver and protect their services. Some technical service data is processed by providers for their own purposes under their privacy notices. We do not sell waitlist information or share it with the prospective Handover team for independent use.

Locations and international transfers

The waitlist database is in Frankfurt. Provider support, infrastructure and subprocessors may also process information outside the EU/EEA, including in the United States. The database location alone does not guarantee that every processing activity remains in the EU.

Supabase and Google describe EU Standard Contractual Clauses and applicable adequacy mechanisms in their data-processing terms. Vercel describes its international-transfer safeguards in its privacy notice. You can read the relevant provider documents below or contact privacy@destbo.com for information about safeguards and copies where applicable.

• Supabase — Data Processing Addendum
• Google — Cloud Data Processing Addendum
• Vercel — Privacy Notice
• Cloudflare — Privacy Policy

Cookies and website analytics

This website adds no cookies, browser storage, advertising pixels or website analytics. Fonts are served with the site, and the language choice is in the page URL. Technical service logs still exist. Reviewing voluntarily supplied company and role information is separate from tracking website visits.

Your rights

Where the GDPR conditions apply, you can request access, correction, deletion, restriction and data portability. You can object to processing based on legitimate interests and withdraw consent. Contact privacy@destbo.com. We may ask for proportionate information to verify your identity.

We normally respond within one month. For complex or numerous requests, we may extend this by up to two further months and will explain the extension within the first month. You can complain directly to Datatilsynet; contacting us first is optional.

Contact Datatilsynet

Scope and changes

This notice covers the website and pilot waitlist, not worker audio/video capture or customer production documents in the future platform. Those activities require separate information and arrangements. If a future group business takes over responsibility, we will inform affected people and establish the appropriate arrangements before transferring their information. Material changes to this notice will be communicated as appropriate.