Privacy

English translation for convenience; the German privacy notice (Datenschutz) is the binding version.

1. Controller

QSwapie, owner Karmel Salah
c/o MDC#1569, Welserstraße 3, 87463 Dietmannsried, Germany
Email: pilot@qswapie.de

We have not appointed a data protection officer; we are not required to. For any privacy question, contact us at the email address above.

2. In short

• This website informs about QSwapie. There is no account and no login here. Only if you join the waitlist yourself (section 6) do we store your details.
• No analytics, no advertising, no tracking, no external fonts, no social media plugins. That is why there is no cookie banner.
• We do not sell data.

3. Hosting at Cloudflare

The website runs at Cloudflare (Cloudflare, Inc., USA, and its affiliates). Cloudflare processes the data on our behalf under its data processing agreement (Cloudflare Customer DPA, Art. 28 GDPR). Requests are received at the nearest data center, which may be outside the EU.

Transfer to the US: Cloudflare is certified under the EU-US Data Privacy Framework; the basis is the European Commission's adequacy decision (Art. 45 GDPR, list of certified companies). In addition, the data processing agreement contains the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

4. Server logs

What: when you open a page, your browser sends technically necessary data: IP address, date and time, the address requested, the previous page (referrer, if your browser sends it), and your browser and operating system (user agent).

Why and legal basis: to deliver the page, find errors and fend off attacks. This is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). We do not combine this data with other data and do not use it for advertising or profiles.

How long: Cloudflare keeps the request logs for us for at most 7 days; after that they are deleted automatically.

5. Contact by email

What: when you write to pilot@qswapie.de (also through the buttons on the home page, which only open your email program), we process your email address, your name if you give it, and the content of your message.

Recipients: the email passes through Cloudflare Email Routing, which only forwards it to our mailbox and does not store it, and is then held by our mailbox provider, Google Ireland Limited (Gmail).

Transfer to the US: Google may also process the data in the US. Google LLC is certified under the EU-US Data Privacy Framework; the basis is the European Commission's adequacy decision (Art. 45 GDPR, list of certified companies).

Why and legal basis: to answer your request, for example as a pilot venue or for the test app. If it concerns a possible contract, the basis is Art. 6(1)(b) GDPR; otherwise our legitimate interest in answering requests (Art. 6(1)(f) GDPR).

How long: until your request is settled. If it leads to a contract or a business letter, we keep it as long as the law requires (Art. 6(1)(c) GDPR).

6. Waitlist on the home page

What: when you send the form "Join the waitlist", we store your email address, whether you are a guest or a venue, your name (if you give it), for venues the venue name, the city and the type (barbershop, café, other), on request the address of the venue (street, number, postcode, country), on request your phone system (Android or iPhone), and on request your phone number. We also store the time of your consent and the version of this text (2026-10-09). We store nothing else.

Why and legal basis: to tell you once, personally, when QSwapie starts for you. The address of a venue is used to contact and visit the venue about the pilot; guests give no address. Your phone number is optional and is used only for calling you back about the pilot. The basis is your consent (Art. 6(1)(a) GDPR), which you give with the tick box in the form. You can withdraw it at any time. We do not send marketing mail or a newsletter from this data.

Who processes it: Cloudflare (Cloudflare, Inc., USA, and its affiliates) receives the request, stores the entry in a database in the EU (Cloudflare D1) and forwards a notification to our mailbox (Cloudflare Email Routing; mailbox: see the section on contact by email). The basis is the data processing agreement (Cloudflare Customer DPA, Art. 28 GDPR). We do not pass the data on and do not sell it.

Security check (Cloudflare Turnstile): against automated signups we use Cloudflare Turnstile. Its script only loads once you click into the form. Cloudflare then sees your IP address and technical features of your browser to tell people from programs. This is our legitimate interest in a form without abuse (Art. 6(1)(f) GDPR). We also limit signups per network per hour; for that we store only a hash of the IP address, for at most one day, never the IP address itself.

How long and deletion: we delete your entry automatically after 12 months at the latest. The phone number and address are deleted with the same entry. We delete it earlier on request: write to pilot@qswapie.de from the address you signed up with. The form is voluntary; without it you can use QSwapie as before, just without an entry on the waitlist.

7. Telegram bot (optional)

What: when you write to our bot on Telegram, we process your Telegram chat ID, your language setting and your messages, only while a conversation is running. This intermediate state is deleted automatically after 30 minutes at most, or at once when you end the conversation. To fend off abuse we count your messages per minute; the counter is deleted after one hour at most.

What we keep: only if you explicitly tap “I agree” at the end do we save, in our list, your email address, your Telegram username (if you have one), the time of your consent and the source “telegram”. If you run a venue, also the business name and the city, and we receive a notification by email. Without your consent nothing is saved. The list sits in a Cloudflare database in the EU region. We use no AI and sell no data.

Telegram: your messages travel through Telegram (Telegram Messenger Inc. and Telegram FZ LLC) and are processed there under Telegram's privacy policy. Telegram also processes data outside the EU. We have no influence on that; do not write to the bot anything you would not trust Telegram with.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you give with the “I agree” button and can withdraw at any time. For the short lived intermediate state and the counter it is our legitimate interest in running the bot securely (Art. 6(1)(f) GDPR).

Deletion and withdrawal: write to pilot@qswapie.de and we delete your entry from the list.

8. Cookies and storage on your device

We set no cookies for analytics, advertising or tracking. Only when you use the DE | EN language switch do we store the “qs_lang” cookie with your language (“de” or “en”) for this visit. It is deleted when you close the browser. The cookie is strictly necessary for the function you chose (§ 25(2) no. 2 TDDDG); no consent is needed for it.

9. Your rights

• Access to your data (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17) and restriction of processing (Art. 18).
• Data portability (Art. 20 GDPR), and withdrawal of a consent at any time with effect for the future (Art. 7(3) GDPR), for example for the waitlist or the Telegram bot.
• Objection to processing based on legitimate interests (sections 4, 5, 6 and 7), on grounds relating to your particular situation (Art. 21 GDPR).
• A complaint to a data protection supervisory authority (Art. 77 GDPR). The authority competent for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), because we run QSwapie from Berlin. You can also contact the supervisory authority where you live or work.

Write to us at the email address above. We do not make automated decisions about you (Art. 22 GDPR).

As of October 2026.