Privacy Policy

Last updated: 2026-08-11 · Consent version: 2026-07-v1

Who we are (data controller)

The controller of your personal data is Firmament Lab (the Exciter Mini project), reachable at [email protected].

What we collect and why

• Email address — to send you a confirmation and, later, launch/preorder news.
• Name (optional) — to address you personally.
• Country (declared) and device model — to gauge demand and plan shipping.
• IP address and IP-derived signals — your IP address, the approximate country/city/region and timezone it maps to, its network operator (ASN/ISP), and whether it appears to be a VPN, proxy or data-center address. We use this to prevent fake and automated signups and to build aggregate per-country demand statistics. It is stored alongside your record and deleted with it (see retention below). IP addresses that show abusive behaviour (automated or fraudulent submissions) may be kept on a blocklist, with details of the abuse, for as long as necessary to protect the service.
• Campaign tags (UTM) and the referring site — to understand where signups come from.
• Timestamps of signup and confirmation, plus the consent version you agreed to — as proof of consent.
• Signup attempt log — every submission of the form (including rejected ones) is recorded with its outcome, the submitted email, IP address and browser identifier, kept for 30 days for abuse monitoring and troubleshooting.

Lawful basis

We process your data based on your consent (GDPR Art. 6(1)(a)), captured via a double opt-in: you confirm via a link we email you. You can withdraw consent at any time (see below); withdrawal does not affect prior processing. IP-based anti-fraud checks (VPN/proxy detection, rate limiting) are processed under our legitimate interest (GDPR Art. 6(1)(f)) in keeping the signup list free of automated and fraudulent entries.

How long we keep it

Unconfirmed signups are deleted after 14 days. Confirmed subscribers are kept until you unsubscribe or ask us to delete your data, or until the preorder programme ends.

Where your data is processed (international transfers)

Subscriber records are stored at rest in the EU (Hetzner, Germany). To run the site we also use processors that may handle some personal data outside the EU, under the EU–US Data Privacy Framework and/or Standard Contractual Clauses:

• Cloudflare — network/tunnel, bot protection (Turnstile), rate limiting, IP geolocation headers and cookieless analytics (global edge).
• proxycheck.io (UK) — receives only your IP address, to check whether it is a known VPN/proxy/data-center address (fraud prevention).
• Brevo (EU) — sends our confirmation and update emails.
• PostHog (EU region, data hosted in the EU) — product analytics, heatmaps and session replay, loaded only after you consent. Your form inputs (including your email) are masked and never recorded.

Analytics & cookies

We use no advertising cookies and never sell your data. With your consent — asked via a banner on your first visit — we use PostHog (hosted in the EU) to understand how the page is used: which sections you view, where you click, and how far you scroll, including anonymised heatmaps and session replays. This stores analytics identifiers in your browser. Form fields, including your email, are masked and never recorded. If you decline, no analytics are loaded at all; you can change your mind later by clearing this site's data in your browser. Cloudflare Turnstile (the bot check) runs on the signup form and does not track you across sites.

Your rights

You can access, correct, export, or delete your data, and object to or restrict processing. To unsubscribe, use the link in any email or write to us. To request deletion or exercise any other right, email [email protected]. You may also complain to your local data protection authority.

Contact

Firmament Lab · [email protected]