Privacy policy

The controller for the personal data described here, within the meaning of Article 4(7) GDPR, is:

Clément Antoine Champau
Spittastraße 15, 10317 Berlin
Germany
admin@olin-rituals.com

Full contact details are on the imprint. There is no statutory obligation to appoint a data protection officer at this size, and none has been appointed — write to the address above for anything data-related.

• Launch-list email address. If you submit the "Join the launch list" form, we collect the email address you type — and nothing else. The form has one field; we do not ask for your name. We use it for one purpose: telling you when Olin launches. Legal basis: your consent, Art. 6(1)(a) GDPR, which you can withdraw at any time.
• Reservation data. If you reserve a Super Early Bird spot, the $1 payment is taken on Stripe's own checkout page. Your card number never reaches our servers and we never see or store it. We do handle your email address: it is sent to us when you start checkout, passed to Stripe so you don't have to retype it, and returned to us by Stripe once the payment succeeds. We then store your email address together with your reservation number and the time you reserved, so we can tell you your place in line, email you when the campaign opens, and refund you. Legal basis: performance of the reservation agreement, Art. 6(1)(b) GDPR, and our legal obligation to keep accounting records, Art. 6(1)(c).
• Usage statistics and behavioural analytics. We use PostHog and Vercel Analytics to understand how the site is used: pages viewed, referring site, approximate region derived from your IP address, device and browser type, and which elements you click and how far you scroll. PostHog captures interactions automatically (autocapture) and builds heatmaps from them. Neither of these two is used to build an advertising profile of you; that is what the Meta pixel described below does, and it is separate from both. Legal basis: our legitimate interest in understanding and improving the site, Art. 6(1)(f) GDPR.
• Session recordings (replay). PostHog also records playbacks of site visits — cursor movement, clicks, scrolling, and the structure of the pages you saw — so we can see where the site confuses people. Recording starts automatically when the page loads. Text typed into form fields is masked before it leaves your browser, so a recording should not contain the email address you type; the recording does however capture your IP address, device, and the sequence of everything you did on the site, which can identify you. Legal basis: our legitimate interest in improving the site, Art. 6(1)(f) GDPR. You can object to this at any time — see your rights below.
• Advertising measurement. We run the Meta pixel so we can tell which ads bring people here and what they do next. It records every page you open, plus four specific moments — joining the launch list, opening the reservation offer, starting checkout, and completing the $1 payment — and sends each one to Meta with your IP address, your browser and device, the address of the page you were on, and an identifier stored in a cookie named _fbp on this domain, plus a second cookie named _fbc if you reached us by clicking one of our ads. If you have a Facebook or Instagram account, Meta can match those identifiers to it and use them to show you ads. Three of those moments — joining the launch list, starting checkout, and completing the payment — are also sent a second time from our own server, so that they still reach Meta when your browser blocks the pixel. Those server messages carry the same information, plus your email address hashed with SHA-256: we send a fingerprint of the address rather than the address itself, and Meta can match it only against addresses it already holds. We do not send Meta your name, your postal address, or anything else you type into this site. Legal basis: your consent, Art. 6(1)(a) GDPR and §25(1) TDDDG. None of this happens unless you say yes. We ask the first time you arrive, and until you answer nothing is loaded and nothing is stored: the pixel's script is never fetched, and our own server does not write the two Meta cookies either, so no _fbp and no _fbc reaches your device. The three messages from our server are held back as well — your email address is not even hashed unless you have agreed. If you say no, all of that stays true; we record your answer in a cookie so we do not have to ask you again, and if either Meta cookie is already on your device we delete it. If you say yes, you can change your mind at any time using "Cookie settings" at the foot of any page, with the same effect. One thing worth knowing if you use an ad blocker: once you have accepted, we write the _fbp and _fbc cookies from our server as we send you the page, before any script runs, so that an ad click is still credited when your browser blocks the pixel. An extension therefore stops the page-by-page tracking but not those two identifiers — your answer here is what controls them, and refusing cookies from this site stops them too. An extension also cannot stop the three messages our server sends, because those never pass through your browser; again your consent is what stops those, and even with it they are only sent when you deliberately join the launch list or start a reservation, never for ordinary browsing. If something has already been reported about you and you want it undone, email us and we will pass that to Meta as an erasure request. We would rather write all of that down here than let you find it in the page source.
• Support chat. The chat bubble is run by Crisp. It stores nothing unless you open it: then it sets a session identifier in your browser so a conversation survives a page reload, and stores whatever you write to us plus any email address you give us to reply to. Legal basis: our legitimate interest in answering questions from people considering Olin, Art. 6(1)(f) GDPR.
• Cookies and local storage. A functional cookie remembers the language you picked; it holds no personal data. A second one, named olin_consent, records your answer to the advertising question above — whether you said yes or no, when, and which version of this policy you were shown — so that we can prove what you chose and stop asking. It is set only once you have answered, holds no identifier, and expires after six months, at which point we ask again. It is exempt from the consent requirement itself under §25(2) TDDDG: a record of your choice is what makes honouring that choice possible. The analytics above set their own cookies containing a random identifier so one visit can be told from the next. Two more come from Meta and are written by our server as the page is sent: _fbp, the identifier your visits are reported under, and _fbc if you arrived from one of our ads, which identifies the click. Both last 90 days, and neither is written unless you accept; both are deleted if you later refuse. The reservation flow briefly keeps the email address you entered in your browser's session storage, so Stripe's checkout can be pre-filled; it is scoped to the tab and is gone when you close it.

We do not sell your personal data. We do now run one cross-site advertising pixel — Meta's, described above; an earlier version of this page said we ran none, and that stopped being true when we installed it. It is the only one. That earlier version also promised we would say so here before we began sending conversions to Meta from our own server: we have now started doing that, and the paragraphs above are that notice. If we add another tracker, or begin sending Meta anything beyond what is described above, we will say so here and revise the date at the top before it goes live.

These providers process personal data on our behalf as processors under Art. 28 GDPR, each under a data processing agreement:

• Stripe — payment processing for the $1 reservation, including card data, which is handled entirely on Stripe's systems. Stripe also acts as its own controller for fraud prevention and regulatory purposes.
• Resend — the launch list itself and the confirmation email sent from it. Resend stores the email addresses on the list.
• Vercel — website hosting, plus Vercel Analytics and Speed Insights. As host, Vercel processes server logs including IP addresses.
• PostHog— product analytics, heatmaps, and session replay, on PostHog's EU infrastructure. Analytics traffic is routed through our own domain before reaching PostHog, which means it is not blocked by ad blockers; it is the same data either way.
• Railway — the reservation ledger, a hosted Postgres database holding your reservation number, your email address, and the time you reserved. The database runs in Amsterdam.
• Meta — Meta Platforms Ireland Limited, which operates the advertising pixel and receives the conversions our server sends. For the ad measurement described above Meta is not only our processor: it also decides for itself how to use what it collects, so for that part we and Meta are joint controllers under Art. 26 GDPR.
• Crisp — the support chat, operated from France.

PostHog data is held on EU infrastructure, the reservation ledger runs on Railway in Amsterdam, and Crisp operates from France. Our contract for the pixel is with Meta's Irish entity, but Meta transfers both the pixel data and the conversions our server sends to the United States. Stripe, Resend and Vercel are US-headquartered and may process personal data in the United States; Railway is US-headquartered but stores this data in the EU. Where data is transferred outside the EU or EEA, those transfers rely on the European Commission's Standard Contractual Clauses, and where applicable on the provider's certification under the EU–US Data Privacy Framework.

You should know that US law may give US public authorities access to data held by US providers, and that the level of protection there is not identical to the GDPR's.

• Launch-list emails — until the launch campaign ends or you unsubscribe, whichever comes first, then deleted.
• Reservation records — kept for as long as the reservation is live, and afterwards for as long as German commercial and tax law requires records of the transaction to be retained.
• Reservation ledger — your reservation number and email address are kept until the campaign ends or your reservation is refunded, then deleted, except where accounting law requires the transaction record to be kept longer.
• Session recordings— expire automatically on PostHog's retention schedule; we do not extend it.
• Analytics — aggregated statistics are kept for trend analysis.
• Chat conversations — kept while they are useful for supporting you, then deleted.

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data deleted (Art. 17);
• restrict how we process it (Art. 18);
• receive it in a portable, machine-readable form (Art. 20); and
• object at any time to processing based on our legitimate interests — which covers the analytics, the heatmaps, the session recordings, and the chat (Art. 21).

Email admin@olin-rituals.com and we will sort it out. We do not charge for this and we will respond within one month.

Where we rely on your consent — the launch list, and the Meta pixel — you can withdraw it at any time, with no reason and no consequence.

For the advertising measurement, use the "Cookie settings" link at the foot of any page. It reopens the same question you were asked on your first visit and shows what you chose last time; choosing "Reject" stops the tracking there and then, deletes Meta's two cookies from your browser, and stops our server sending anything further. Refusing is one click, exactly like accepting.

For the launch list, use the unsubscribe link in any email we send you, or email admin@olin-rituals.com. Withdrawing consent does not affect the lawfulness of what we did with your data before you withdrew it.

You can also set your browser to refuse cookies, and most browsers offer a "do not track" or tracking-protection setting; blocking cookies from this site will stop the analytics and the Meta pixel described above from identifying your visits as related. Meta also offers its own controls over how it uses activity from sites like this one, in your Facebook or Instagram account settings.

If you think we are handling your personal data unlawfully, you have the right to lodge a complaint with a supervisory authority — in your country of residence, your place of work, or where the issue occurred. Ours is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61, 10555 Berlin, Germany
datenschutz-berlin.de

If our data practices change — new processors, advertising, or a change in how the reservation works — we will update this page and revise the date at the top.