Privacy Policy — Website

1. Controller

Mobistro
Alexander Schäfer
Nauheimer Weg 9a
65550 Limburg
Germany

Email: kontakt@mobistro.app

Authorised representative: Alexander Schäfer

2. Data protection officer

No data protection officer has been appointed because the requirements of Article 37 GDPR do not apply. Please send data protection enquiries to datenschutz@mobistro.app.

3. Overview of processing

This Privacy Policy applies to the marketing website at mobistro.app and www.mobistro.app. You cannot log in or create an account on this website. It provides information about Mobistro, lets you join the waitlist or subscribe to product information, and lets you contact us through the contact form.

4. Access data (server logs)

4.1 Description and scope

When you visit our website, the web server automatically records:

• IP address (which may be truncated)
• Date and time of the request
• Requested URL / page name
• Amount of data transferred
• HTTP status code
• Referrer URL (the previously visited page)
• Browser and operating system used

4.2 Legal basis

Article 6(1)(f) GDPR (legitimate interests). Our legitimate interest is ensuring technical operation and protection against misuse.

4.3 Retention

Server logs are retained only as long as necessary for technical operation, troubleshooting and website security. They are generally deleted within 30 days.

5. Waitlist / newsletter form

5.1 Description and scope

Our website includes a form for subscribing to product information or joining the waitlist. We process the email address you enter, the website language and technical evidence for the double opt-in process (in particular time, IP address, referrer and user agent).

Registration is sent through a Supabase Edge Function in the Frankfurt region to CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany. CleverReach manages the recipient list and sends the confirmation message. The address is activated for product information only after you confirm the link in that message.

To protect against repeated misuse, the normalised email address is pseudonymised using a secret key. Rate limiting stores only this HMAC value and aggregated counters, not the email address in plain text. Each activity sets an expiry marker of no more than 48 hours; expired entries are physically removed opportunistically the next time the protection function is called.

5.2 Legal basis

• Article 6(1)(a) GDPR (consent), where you wish to receive product information, early access notices or launch updates.
• Article 6(1)(b) GDPR (steps prior to entering into a contract), where your enquiry concerns using Mobistro or working with us.

5.3 Retention and withdrawal

CleverReach stores your confirmed email address until you withdraw consent or the purpose of processing no longer applies. Every product information message includes an unsubscribe option. You may also request deletion at any time at datenschutz@mobistro.app.

5.4 Protection against automated misuse (reCAPTCHA Enterprise)

The public waitlist form uses reCAPTCHA Enterprise as a visible checkbox security check. The integration loads the browser script enterprise.js from www.google.com lazily: it is not loaded on our homepages or when the waitlist page first opens, when you focus or type in fields, or when you scroll. The script and then the widget load only when you submit the form with an email address that passes client-side validation. Before then, the form visibly informs you of this possible activation.

After deliberate activation, your browser communicates directly with Google. Google may process network and request metadata and browser, device, interaction, security and risk signals. Google documents that the technically necessary _GRECAPTCHA cookie may be set when risk analysis runs. This provider processing is distinct from the fields Mobistro actively sends to the Google Cloud reCAPTCHA Enterprise API.

The generated token is sent to our Supabase Edge Function and evaluated once through CreateAssessment. The active assessment body contains only { event: { token, siteKey } }. Mobistro does not actively send Google an IP address, user agent, JA3/JA4 fingerprints, email address or expectedAction. Mobistro neither stores the token permanently nor logs it. Registration can be forwarded to CleverReach only with a valid token and an exactly allowlisted hostname.

The production configuration fails closed: quota, allowance and other provider errors stop registration before internal rate limiting and before any transmission to CleverReach. Technical verification was completed before the cutover.

According to current reCAPTCHA provider information, since 2 April 2026 Mobistro is the sole controller for reCAPTCHA customer data and Google acts as processor for that data. Google processes it to provide, maintain and secure the service under the Google Cloud Terms, reCAPTCHA Service Specific Terms and Cloud Data Processing Addendum. This clarification of roles does not replace the evidence required before activation that the contractual documents apply to the specific production account.

Legal bases: We rely on Article 6(1)(f) GDPR for processing personal data. Our legitimate interest is protecting others from unsolicited confirmation messages and protecting the form, sending quotas and infrastructure. Access to or storage of information on your device is separately based on Section 25(2)(2) TDDDG, because it is strictly necessary for the form submission you expressly request.

You may object to processing based on Article 6(1)(f) GDPR at datenschutz@mobistro.app. Without a successful security check, public form submission is technically impossible; alternatively, joining the waitlist can be considered individually following a contact enquiry.

For the Google Cloud project mobistro, Alexander Schäfer is documented as the customer/account holder with Germany as the billing country; Google Cloud EMEA Limited is the contracting party. On 11 July 2026, the operator reviewed the documented classification and remaining legal risks and approved its use; this does not claim external legal advice. reCAPTCHA Enterprise has been active in production since 11 July 2026. Relevant provider information includes the reCAPTCHA privacy information, the reCAPTCHA Enterprise API documentation and the Google Cloud Data Processing Addendum.

The Enterprise API key is set exclusively on the server as the Supabase secret RECAPTCHA_ENTERPRISE_API_KEY and is restricted to the reCAPTCHA Enterprise API. The production key is set; the public checkbox site key is not secret and is delivered to the browser. The integration uses no service account JSON file; the unused service account was deleted before cutover.

5.5 Processing on our behalf

Supabase and CleverReach provide the technical services described. Resend is also used to deliver contact enquiries by email (see Section 6.1 and the overview of processors). Google is used as a reCAPTCHA processor only after the privacy and deployment requirements have been fully evidenced. The required processing agreements must be concluded or confirmed in the respective accounts before the relevant production operation. CleverReach states that recipient data is stored on servers in Germany and the EU.

6. Contact form

6.1 Description and scope

A contact form is available at mobistro.app/kontakt. We process only the details you enter: the selected topic (product question, organiser or agency, press and partnership, other), your email address, your message and optionally your name. Providing your name is voluntary; we answer your enquiry in the same way if you omit it. We do not collect further details such as a telephone number or company name.

Submission runs through a Supabase Edge Function in the Frankfurt region. From there, Resend (Plus Five Five, Inc.) delivers the message as an email to our inbox at kontakt@mobistro.app; your address is included as the reply-to address in the message header so that we can reply directly. The enquiry is not stored in a database — its content exists only as an email in our inbox.

To protect against repeated automated misuse, the normalised email address is pseudonymised with a secret key. Only this HMAC value and aggregated counters are stored, never the address in plain text or the message text. This pseudonymisation is separate from that used for the waitlist, preventing the two forms from being linked through the hash. Each activity sets an expiry marker of no more than 48 hours; expired entries are removed the next time the protection function is called.

An invisible additional field (a “honeypot”) is used solely to detect automated submissions. If it is filled in, the enquiry does not leave the Edge Function and reaches neither the security check nor our inbox.

6.2 Legal basis

• Article 6(1)(b) GDPR (steps prior to entering into a contract), where your enquiry concerns using Mobistro or working with us.
• Article 6(1)(f) GDPR (legitimate interests) for all other enquiries and for protection against misuse. Our legitimate interest is answering enquiries addressed to us and protecting the form, our inbox and infrastructure.

6.3 Retention and deletion

Your enquiry remains in our inbox as long as needed to handle it and possible follow-up questions, for no more than 24 months after the last reply. We then delete it unless statutory retention obligations apply. You may request earlier deletion at any time at datenschutz@mobistro.app. Independently, the pseudonymous misuse counters expire within 48 hours.

6.4 Protection against automated misuse (reCAPTCHA Enterprise)

The contact form uses the same visible checkbox security check as the waitlist form, with the same site key and Google Cloud project. The browser script enterprise.js from www.google.com loads lazily: not when the contact page opens, fields are focused or filled in, or the page is scrolled, but only when you submit the form with client-side valid details. Before then, the form visibly informs you of possible activation. The data flow, actively transmitted fields ({ event: { token, siteKey } }), allocation of roles, cookie setting and legal bases are unchanged from Section 5.4.

Here too, production fails closed: quota, allowance and other provider errors stop the enquiry before internal rate limiting and before delivery to our inbox. Without a successful security check, submission through the form is technically impossible. You can still reach us directly at kontakt@mobistro.app. This address appears in the imprint, footer and contact page itself, so the form is never the only way to contact us.

7. Cookies and local storage

7.1 Cookies

Mobistro uses no advertising or analytics cookies on the marketing website. After a valid, deliberate submission of the waitlist or contact form, Google reCAPTCHA may set the _GRECAPTCHA cookie for security and risk analysis. reCAPTCHA is not loaded beforehand.

7.2 Local storage of language preference

When you manually change the website language, this choice may be stored locally in your browser under the key mobistro-lang. This allows the website to open directly in your chosen language on your next visit.

This information stays on your device and is not sent to us or third parties.

Legal basis: Article 6(1)(f) GDPR (legitimate interest in providing a user-friendly website), together with Section 25(2)(2) TDDDG.

8. Web analytics

8.1 Cookie-free audience measurement

We use Plausible Community Edition for data-minimising statistical analysis of website use. Mobistro hosts the instance itself at analytics.mobistro.app on our Hetzner infrastructure in the EU. Plausible sets no cookies for this audience measurement and stores no analytics information in the browser.

We record page views, requested paths, referrers and anonymous, aggregated categories for device, browser, operating system and approximate country of origin. Existing campaign parameters may also be attributed statistically. The analytics server temporarily receives the IP address and user agent as part of the technical request. This request data is processed in memory but is not stored as raw data in Plausible. Stored analytics data is not intended to identify anyone or profile them across websites.

8.2 Form events

To measure the waitlist and contact funnels, we transmit only the event names waitlist_submit, waitlist_success, contact_submit and contact_success, each without additional properties. In particular, no email address, email domain, selected topic, name, company or free-text details, CAPTCHA data, error messages, Mobistro visitor identifier or other persistent identifier is sent to Plausible.

8.3 Purpose, legal basis and objection

Processing serves aggregated measurement of reach and functionality and improvement of our website. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is assessing website use and effectiveness with a data-minimising, self-hosted solution.

You may object to this processing at any time at datenschutz@mobistro.app. Please tell us which practical technical method you prefer for honouring your objection. We also assess access and deletion requests. Because Plausible stores no directly identifying analytics data and no Mobistro visitor identifier, subsequently attributing data to a particular person may be technically impossible or possible only to a limited extent.

9. Hosting

9.1 Hetzner / Coolify

Our website is hosted on a server we manage at Hetzner Online GmbH.

Provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany

The server is located in Germany. Deployment and operation use a self-managed Coolify installation on our infrastructure.

Each page request involves processing access data (see Section 4) to deliver the website and ensure secure operation.

Legal basis: Article 6(1)(f) GDPR (legitimate interest in reliable and efficient website delivery).

Transfers to third countries: No planned transfer of personal data to third countries takes place as part of hosting the marketing website.

Processing on our behalf: Hetzner is our hosting provider. The required processing agreement under Article 28 GDPR must be concluded before final production operation.

10. No disclosure to other third parties

Your personal data is disclosed to third parties only where:

• you have expressly consented (Article 6(1)(a) GDPR),
• disclosure is necessary to perform a contract (Article 6(1)(b) GDPR),
• there is a legal obligation (Article 6(1)(c) GDPR), or
• there is a legitimate interest and no reason to assume that your interests requiring protection override it (Article 6(1)(f) GDPR).

11. Your rights as a data subject

You have the following rights against the controller:

To exercise your rights, contact datenschutz@mobistro.app.

12. Right to complain to a supervisory authority

You have the right to complain to a data protection supervisory authority about the processing of your personal data.

In particular, you can contact the authority responsible for the controller’s place of business:

The Hessian Commissioner for Data Protection and Freedom of Information
Postfach 3163
65021 Wiesbaden
Email: poststelle@datenschutz.hessen.de
Website: https://datenschutz.hessen.de/

13. Current version and changes to this Privacy Policy

This Privacy Policy is currently valid and was last updated in September 2026.

Further development of our website or changes in statutory or regulatory requirements may make changes to this Privacy Policy necessary. The current version is always available at mobistro.app/datenschutz.