Privacy Policy

1. Controller

The controller under the General Data Protection Regulation is Marc Lütke, trading as GapLabs, Mühlenstraße 21, 26419 Schortens, Germany.

You can contact us at info@gaplabs.de or by telephone at +49 176 55044671.

2. Website delivery

When you access the website, the relevant hosting provider processes technically necessary access data, in particular your IP address, time, requested URL, referrer, browser and device information, and status or error data.

This processing is necessary to deliver the website securely and reliably, detect attacks, and investigate errors. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure and uninterrupted operation of our service.

3. Demo requests

When you request a demo, we process your first name, last name, business email address, organization, and the message generated from those details. Required fields are necessary to identify and answer your request.

We use Resend to deliver the message. Resend processes the form data on our behalf and sends the request to the configured GonzoCity mailbox. Your email address is also used as the reply-to address of that message.

The legal basis is Article 6(1)(b) GDPR for pre-contractual steps taken at your request; where a request is unrelated to a contract, the basis is Article 6(1)(f) GDPR and our interest in answering business enquiries.

4. Form abuse prevention

To protect the demo form from automated abuse, we use an invisible honeypot field and time-limited request quotas backed by Upstash Redis. Before transmission to Upstash, the IP address and email address are pseudonymized with a secret, purpose-specific HMAC; raw values are not stored as rate-limit keys.

Keys expire with their respective protection window and no later than 24 hours. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is protecting the website, email infrastructure, and other visitors from spam and overload.

5. Content and media from Sanity

Articles, guides, case studies, and related media are delivered from the Sanity Content Lake or Sanity Asset CDN. When a media file is requested, Sanity receives technically necessary access data such as your IP address, the requested file, and browser information.

This processing supports fast and reliable delivery of our public content. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is performant and secure content delivery.

6. Language preference and cookies

When you change the language, we store the technically necessary NEXT_LOCALE cookie for one year. It contains only the language code de or en, is protected with SameSite=Lax, and is not used for advertising or profiling.

We do not use audience measurement, and we do not use marketing or cross-site tracking cookies.

7. Recipients and international transfers

Recipients of personal data may include our carefully selected processors, namely our hosting provider, Sanity, Resend, and Upstash, as well as the responsible GonzoCity founders. They receive access only where necessary for hosting, content delivery, email delivery, abuse prevention, or support.

Where providers process data outside the European Economic Area, transfers are based on an applicable adequacy decision or appropriate safeguards, in particular the EU Standard Contractual Clauses. We review the services we use and enter into required data processing agreements.

8. Retention

We retain demo requests only for as long as necessary to handle the request and establish or perform a business relationship. We then delete or anonymize the data unless statutory retention periods or the establishment, exercise, or defence of legal claims require longer storage.

Pseudonymous rate-limit keys expire no later than 24 hours. Technical logs are deleted or anonymized according to each provider's configured retention period unless they are needed for longer to investigate a specific security incident.

9. Your rights and complaints

Subject to the statutory conditions, you have the right of access, rectification, erasure, restriction of processing, data portability, and objection. You may withdraw any consent at any time with effect for the future.

To exercise your rights, email info@gaplabs.de. We may request additional information where necessary to verify your identity.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the place of your habitual residence, place of work, or the alleged infringement. We update this policy when data flows or legal requirements change materially.