This is a convenience translation. Only the German version is legally binding.
Privacy Policy
Last updated: September 2026
1. Introduction and Controller
Paul-Jasper Sahr ("Gemhog", "we", "us") operates the website gemhog.com and the Gemhog waitlist and product update service. We are the controller of your personal data within the meaning of the EU General Data Protection Regulation (GDPR) and the German Digital Services Act (Digitale-Dienste-Gesetz, DDG).
Paul-Jasper Sahr
Quellenweg 162a, 26129 Oldenburg
Germany
Email: hello@gemhog.com
This policy describes which personal data we collect, why we collect it, how we process it and what rights you have under Art. 13 and 14 GDPR.
2. What Data We Collect
Identity Data
- Email address
- Display name and profile picture, if you use a sign-in service in an early-access product
Authentication Data
- Session tokens (stored as HTTP-only cookies), where sign-in is available
- Last used sign-in method (e.g. Google or email), if you have consented to optional functional/preference cookies
- One-time passwords (OTP codes — used for verification only, not stored after verification)
Technical Data
- IP address
- Browser user agent
- Device type
- Referring URL
Usage Data
- Page views and feature interactions
- PostHog analytics events (e.g. landing_page_viewed, subscribe_started, subscribe_completed)
Error Data
- Stack traces and console logs
- Breadcrumbs and session IDs (Sentry)
Support Data
- Name and email address of the signed-in user
- Messages and conversation history that you submit in the support chat
Newsletter Data
- Email address
- Subscription status
- Unsubscribe date (if applicable)
3. What We Use Your Data For and Legal Bases
We only process personal data where there is a legal basis under Art. 6 GDPR:
Performance of a Contract — Art. 6(1)(b) GDPR
- Waitlist registration and email confirmation
- Authentication, where sign-in is available
- Product update and early-access communication
- Delivery of transactional emails
- Handling support requests when you actively open the support chat
Consent — Art. 6(1)(a) GDPR
- Product analytics via PostHog (controlled via cookie consent)
- Storing and reading the last used sign-in method as an optional functional/preference setting (controlled via cookie consent)
- Error tracking via Sentry, insofar as consent is required for this
- Newsletter or product update subscription
Legitimate Interest — Art. 6(1)(f) GDPR
- Security logging — logging of IP addresses for fraud and abuse detection
- Basic server logs for infrastructure stability and debugging
4. Processors and Service Providers
We share personal data with the following processors, each for a specific purpose:
PostHog (EU — Frankfurt)
Product analytics and feature tracking. Data is sent to PostHog through our own endpoint m.gemhog.com. PostHog processes it as our processor in its EU region (Frankfurt). Data processed: anonymous usage events; identified user events, where sign-in is available. Retention period: in accordance with PostHog's retention policy.
Sentry (DE — Germany)
Error tracking and crash reporting. Endpoint: ingest.de.sentry.io. Data processed: stack traces, console breadcrumbs, session IDs. Retention period: 90 days.
Chatwoot (Support Chat)
Provision of the support chat. Chatwoot is only loaded when you open the support chat in the signed-in application. Data processed: name, email address, messages and conversation history. The retention period depends on the settings of our Chatwoot account and statutory retention obligations.
Resend (USA)
Delivery of transactional emails and management of contacts for the waitlist and product updates. Data processed: email address, email content, membership of the mailing list, and subscription and unsubscription status. Safeguard for transfers to third countries: EU Standard Contractual Clauses (SCCs).
Neon (EU/USA)
Managed PostgreSQL database hosting. Data processed: account and application records in the production database. Safeguard for transfers to third countries: EU Standard Contractual Clauses (SCCs).
Cloudflare (USA/EU)
DNS, CDN, DDoS protection, edge hosting and database connectivity. Data processed: IP addresses, request headers and application requests. Safeguard for transfers to third countries: EU Standard Contractual Clauses (SCCs).
5. Data Transfers to Third Countries
PostHog and Sentry process your data within the European Union.
Resend, Neon, Cloudflare and Chatwoot may process data outside the European Union. Transfers of personal data to these processors take place on the basis of EU Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR, which ensure an adequate level of data protection.
6. Retention Periods
- Waitlist/newsletter data: email address is stored until you unsubscribe + 30 days (for bounce processing)
- User accounts, where sign-in is available: stored until you request deletion or your account is terminated
- Session tokens: 7 days (rolling)
- Last used sign-in method: 30 days, if you have consented to optional functional/preference cookies
- OTP codes: discarded immediately after verification
- PostHog analytics events: in accordance with PostHog retention settings (default: 365 days)
- Sentry error data: 90 days
- Chatwoot support data: in accordance with the settings of our Chatwoot account and statutory retention obligations
- Server logs: 30 days rolling
7. Your Rights Under the GDPR
Under Art. 15–22 GDPR, you have the following rights regarding your personal data:
- Right of access (Art. 15): You can request a copy of the personal data we hold about you. To do so, write to hello@gemhog.com.
- Right to rectification (Art. 16): You can update your details directly — where available — or contact us to correct inaccurate data.
- Right to erasure (Art. 17): You can request the deletion of your personal data by emailing hello@gemhog.com.
- Right to restriction of processing (Art. 18): You can, under certain circumstances, request that we restrict the processing of your data. Contact us at hello@gemhog.com.
- Right to data portability (Art. 20): You can request your personal data in a structured, commonly used and machine-readable format. Write to hello@gemhog.com, and we will provide you with your data.
- Right to object (Art. 21): You have the right to object to processing based on legitimate interests. We will stop the processing unless we can demonstrate compelling legitimate grounds.
- Right to withdraw consent: Where processing is based on consent (e.g. analytics or the optional sign-in method preference), you can withdraw it at any time via the cookie settings in the marketing footer or in the user menu of the application. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. After you decline or withdraw consent, we do not send any PostHog analytics events and do not write or read the optional sign-in method preference; optional cookies are deleted on a best-effort basis. Strictly necessary session and auth cookies are not affected.
- Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority. The competent authority is the State Commissioner for Data Protection of Lower Saxony (Die Landesbeauftragte für den Datenschutz Niedersachsen) (or your local EU data protection authority).
8. Automated Processing
We do not use personal data for credit checks, profiling or automated individual decision-making within the meaning of Art. 22 GDPR.
9. Cookies
We use cookies and similar technologies. Your cookie choice applies jointly to our website and the application. Pre-release and preview versions have separate settings. You can find detailed information about the individual cookies, their purposes and how to manage your settings in our Cookie Policy.
10. Children
Our service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe that a child has provided us with personal data, please contact us at hello@gemhog.com — we will delete the data promptly.
11. Changes to This Policy
We may update this privacy policy from time to time to reflect changes in our practices or in the law. We will inform registered users and newsletter subscribers of material changes by email. The date of the last update is shown at the top of this page.