Datenschutzerklärung

1. Introduction

Thermio ("we", "us", "our") is a hardware project building ultralight trail-ready sensors for temperature, humidity, and pressure. This Privacy Policy explains how we collect, use, and protect your personal data when you interact with our website at getthermio.com and related services.

We are committed to protecting your privacy and complying with applicable data protection regulations, including the EU General Data Protection Regulation (GDPR).

2. Data We Collect

We collect the data you voluntarily provide through our website forms, plus a limited amount of usage and attribution data described below.

Waitlist signup

• Email address
• Product interest (Thermio / Thermio Mini / Not sure yet)
• Use case (optional — hiking type)
• Language preference (detected from your browser locale)
• Referral code (if you arrived via a referral link)
• Campaign attribution, if you arrived via a marketing link or advertisement: UTM parameters (source, medium, campaign, content, term) and advertising click identifiers (Google "gclid", Meta "fbclid")

Website analytics (automatically collected)

We run our own first-party analytics to understand how visitors use the site. For each interaction (page view, section view, form open/submit, FAQ open, link click, scroll depth) we record:

• A random identifier generated in your browser and stored in local storage (not linked to your name or email)
• The page visited, your language, and the referring page
• Device type (mobile/desktop) and operating system, derived from your browser's user-agent string
• Campaign attribution (UTM parameters and advertising click identifiers), if you arrived via a marketing link

We do not store your IP address or full user-agent string in our analytics, and analytics events are not linked to your waitlist record.

We also use Vercel Web Analytics, a privacy-friendly, cookieless service that collects aggregated page-view statistics without building visitor profiles.

Abuse prevention (automatically collected)

• IP address — used solely for rate-limiting to prevent abuse. Automatically deleted within minutes; not stored permanently.

3. How We Use Your Data

• Waitlist communication: Sending you product updates, development milestones, early access invitations, and preorder opportunities.
• Product development: Understanding our audience's needs (e.g., preferred use cases, conditions, priorities) to build a better product.
• Website analytics: Measuring how the site is used (pages viewed, features used, where visitors come from) so we can improve it. Analytics data is pseudonymous and not linked to your identity.
• Advertising measurement: If you joined the waitlist after clicking one of our ads, we report that conversion back to the advertising platform (Google Ads or Meta) so we can measure whether our ads work. See Section 5 for details.
• Abuse prevention: Rate-limiting form submissions to prevent spam.

We will never sell, rent, or share your personal data with third parties for marketing purposes.

4. Legal Basis for Processing

Under the GDPR, we process your data based on:

• Consent (Art. 6(1)(a)): You voluntarily submit your data through our forms. You can withdraw consent at any time by unsubscribing or contacting us.
• Legitimate interest (Art. 6(1)(f)): Rate-limiting and abuse prevention to maintain service integrity; pseudonymous first-party analytics to understand and improve our website; and measuring the effectiveness of our advertising campaigns. You can object to processing based on legitimate interest at any time (see Section 7).

5. Third-Party Services

We use the following services to operate our website. Each is used minimally and only for the stated purpose:

• Neon (Neon, Inc.) — Hosts the database that stores waitlist and analytics data securely. Neon Privacy Policy
• Resend (Resend, Inc.) — Sends transactional emails (welcome emails, confirmations). Your email address is shared with Resend for delivery. Resend Privacy Policy
• Upstash (Upstash, Inc.) — Provides rate-limiting via Redis. Only your IP address is temporarily processed; no personal data is stored. Upstash Privacy Policy
• Vercel (Vercel, Inc.) — Hosts our website and provides Vercel Web Analytics, a cookieless service that produces aggregated visitor statistics. Standard server logs may include IP addresses. Vercel Privacy Policy
• Slack (Slack Technologies, LLC) — We receive an internal notification in our private Slack workspace when someone joins the waitlist. The notification includes the submitted form data (e.g., email address and name). Slack Privacy Policy
• Google Ads (Google Ireland Ltd. / Google LLC) — Only if you arrived via a Google ad: when you join the waitlist, we report the conversion to Google using the click identifier (gclid) from the ad. We do not send your email address or name to Google. Google Privacy Policy
• Meta (Meta Platforms Ireland Ltd. / Meta Platforms, Inc.) — Only if you arrived via a Facebook or Instagram ad: when you join the waitlist, we report the conversion to Meta via its server-side Conversions API using the click identifier (fbclid) and a hashed (SHA-256) version of your email address for ad-attribution matching. We do not use the Meta Pixel or any Meta cookies on our site. Meta Privacy Policy

6. Data Retention

We retain your data for as long as it is needed for the purposes described above:

• Waitlist data: Until the product launches and you either purchase or unsubscribe.
• Analytics events: Retained while we prepare and launch the product, for at most 24 months from collection. Analytics data is pseudonymous and not linked to your identity.
• Rate-limiting data: Automatically expires within minutes.

When you unsubscribe, we mark your record accordingly and cease all email communication. You may also request full deletion (see below).

7. Your Rights

Under the GDPR and applicable data protection laws, you have the right to:

• Access — Request a copy of the data we hold about you.
• Rectification — Request correction of inaccurate data.
• Erasure — Request deletion of your data ("right to be forgotten").
• Restrict processing — Request that we limit how we use your data.
• Data portability — Request your data in a structured, machine-readable format.
• Withdraw consent — Unsubscribe from emails at any time via the unsubscribe link in every email, or by contacting us.
• Lodge a complaint — Contact your local data protection authority if you believe your rights have been violated.

To exercise any of these rights, email us at hello@getthermio.com. We will respond within 30 days.

8. Cookies and Local Storage

Our website sets no third-party tracking or advertising cookies — no Google Analytics script, no Meta Pixel, no ad-network trackers. Essential cookies may be set by our hosting provider (Vercel) for basic functionality such as load balancing; these are strictly necessary and do not track you.

We do use your browser's local storage for our own first-party analytics and attribution:

• A random identifier so we can count returning visits without knowing who you are
• Campaign attribution from the link you arrived on (UTM parameters, Google/Meta click identifiers), if any

These values are sent only to our own analytics database — except that if you join the waitlist after clicking an ad, the advertising click identifier is reported to the respective ad platform as described in Section 5. They are not used to build advertising profiles and are not linked to your name or email in our analytics. You can remove them at any time by clearing your browser's site data for getthermio.com.

9. Data Security

We take reasonable measures to protect your data, including:

• All data transmitted over HTTPS (TLS encryption)
• API keys and secrets stored securely as environment variables
• Rate-limiting to prevent abuse and unauthorized access
• Secure, token-based unsubscribe links to prevent unauthorized modifications

10. International Data Transfers

Some of our third-party service providers (Neon, Resend, Upstash, Vercel, Slack, Google, Meta) are based in or transfer data to the United States. Data transfers to the US are conducted in accordance with applicable legal frameworks, including the EU–US Data Privacy Framework and EU Standard Contractual Clauses (SCCs) where required.

11. Children's Privacy

Our website and services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make significant changes, we will notify waitlist members by email. The "Last updated" date at the top reflects the most recent revision.

13. Contact

If you have questions or concerns about this Privacy Policy or how we handle your data, please contact us:

Email: hello@getthermio.com