Privacy Notice

1. Data controller

The data controller for personal data collected through https://wentzel.ai is:

2. What data we collect

We collect the following categories of personal data:

• Contact form data — name, email address, and the message you send us. Used solely to respond to your inquiry.
• Waitlist sign-up — email address. Used to notify you when a product launches.
• Analytics & performance data — aggregate page-view metrics and anonymous Web Vitals (page-load and responsiveness timings) collected via privacy-respecting analytics and sent to our own /api/vitals endpoint. No cross-site tracking; no advertising or marketing cookies; no fingerprinting. Whether this is collected by default or only after you opt in depends on your region — see “Cookies” below.
• Cookie consent record — your consent choice and timestamp, stored locally in your browser (under wentzel.consent.v1) and optionally in our audit log.

3. Legal basis for processing

• Legitimate interest (Art. 6(1)(f)) — responding to contact form inquiries and maintaining security logs.
• Consent (Art. 6(1)(a)) — analytics cookies and Web Vitals reporting for visitors in the EEA, UK, and Switzerland, where nothing non-essential loads until you click “Accept”. You may withdraw consent at any time via the “Cookie settings” link in the footer.
• Contractual necessity (Art. 6(1)(b)) — waitlist management (you asked to be notified).

4. Data retention

Contact-form submissions are retained for up to 12 months, then deleted. Analytics data is aggregated and anonymised after 90 days. Waitlist sign-ups are deleted within 30 days of the product launching and notifying you. Consent records are retained for 3 years (audit compliance). DSR request records are retained for 3 years.

5. Third-party processors

• AWS SES — email delivery. Data is processed in the AWS US-East-1 region.
• Cloudflare — CDN, DDoS protection, and edge compute. Cloudflare logs are retained per Cloudflare's own privacy policy.
• Plausible or Vercel Analytics (analytics, only when enabled) — cookieless, GDPR-compliant aggregate metrics; no personal data shared. At most one provider is active, and only where analytics is permitted for your region. Web Vitals performance data is sent to our own first-party endpoint, not to a third party.

6. Cookies & region-aware consent

We use strictly necessary first-party storage to remember your consent choice. The only optional category is analytics (aggregate page views + anonymous Web Vitals). We set no marketing, advertising, or cross-site tracking cookies.

How we ask for analytics depends on where you are, detected from your network region (we do not store your IP for this):

• EEA, UK & Switzerland (opt-in) — a banner blocks and no analytics loads until you choose “Accept”.
• Everywhere else (opt-out) — analytics may run by default under a notice-at-collection model; you can switch it off at any time via the “Cookie settings” link in the footer.
• Global Privacy Control — if your browser sends a GPC signal we treat it as an opt-out automatically, in every region, and remember it.

You can review or change your choice at any time from the “Cookie settings” link in the footer, which re-opens the preference banner.

7. Your rights

If you are in the EEA, UK, or other jurisdiction with equivalent rights, you may exercise any of the following:

• Right of access (Art. 15) — request a copy of the data we hold about you.
• Right to rectification (Art. 16) — ask us to correct inaccurate data.
• Right to erasure (Art. 17) — ask us to delete your data.
• Right to data portability (Art. 20) — receive your data in a machine-readable format.
• Right to object (Art. 21) — object to processing based on legitimate interest.

Submit a request using our Data Subject Request form. We will respond within 30 days (GDPR Art. 12).

8. Contact & complaints

To exercise your rights or raise a privacy concern, contact us at privacy@wentzel.ai. If you are unsatisfied with our response you have the right to lodge a complaint with your local supervisory authority (e.g. the Information Commissioner's Office in the UK, or your national DPA in the EEA).