Privacy Policy — Kaleid waitlist
Last updated: 27 August 2026
Scope of this policy
This policy covers the Kaleid waitlist at learnkaleid.com — the page where you give us your email address to hear about closed beta access, and the optional questions that follow.
It does not cover the Kaleid application itself. The app collects different information and works differently. If you are invited to the beta, you will be given a separate privacy policy for the app before you create an account.
Who is responsible for your data
The controller of your personal data is:
Ciara Reeves Moran
Sole trader (enskild firma), Sweden
Email: hello@learnkaleid.com
We do not have a data protection officer, because we are not required to appoint one.
What we collect, and why
When you join the waitlist
| What | Why we need it | Legal basis |
|---|---|---|
| WhatYour email address | Why we need itTo send you a confirmation link, one reminder if you do not use it, and to tell you when beta access opens | Legal basisYour consent |
| WhatA record that you confirmed you are old enough — stored as the date and time you ticked the box, not your age or date of birth | Why we need itTo show we do not knowingly sign up people below our minimum age | Legal basisYour consent, and our legal obligation to be able to demonstrate it |
| WhatA record of what you agreed to and when — the exact wording of the consent sentence you were shown, plus the timestamp | Why we need itSo that if you ever ask, we can show you precisely what you agreed to | Legal basisLegal obligation (Art. 7(1) GDPR) |
| WhatWhich version of the site you signed up through — the live site, a test preview, or a developer’s machine | Why we need itTo keep test signups out of the real list | Legal basisOur legitimate interest in an accurate list |
| WhatDates and times of your activity with us — when you signed up, when we sent your confirmation email and how many times, when we sent your reminder, when you confirmed, when you unsubscribed, when you answered the optional questions | Why we need itTo run the waitlist correctly: sending you at most one reminder and never a second, not emailing you after you unsubscribe, knowing who is still waiting | Legal basisYour consent |
If you answer the optional questions
After signing up you are offered four questions. Every one of them is optional and you can skip all of them.
| What | Why we need it | Legal basis |
|---|---|---|
| WhatWhat best describes you — one of five fixed options | Why we need itTo understand who is interested in Kaleid | Legal basisYour consent |
| WhatHow you found us — one of five fixed options | Why we need itTo understand how people hear about Kaleid | Legal basisYour consent |
| WhatWhat you are curious about — free text | Why we need itTo understand what people want to learn, and to shape what we build | Legal basisYour consent |
| WhatWhat you think about education — free text | Why we need itThe same | Legal basisYour consent |
These answers are used for understanding our audience and improving the product. They are never used to send you anything. Your email address is what we contact you with; these answers are not, and they are not shared with anyone outside the services listed below.
Because the last two are free-text boxes, you can write anything you like in them — including, if you choose, your name or other details about yourself. Please only write what you are comfortable sharing. We do not ask for this and we do not need it.
To stop the signup form being abused
When you submit the form, we briefly store a scrambled form of your internet address (IP address), so that one network cannot flood the form with fake signups.
We want to be precise about this, because it is better than it sounds:
- Your IP address is put through a one-way cryptographic scramble before anything is stored. The scrambling key is not held in the database.
- The database never contains your actual IP address.
- These records are kept for about one day and then removed.
- They cannot be looked up by your email address, and they are not connected to your waitlist record.
Legal basis: our legitimate interest (Art. 6(1)(f) GDPR) in keeping the signup form working and free of abuse. We consider this proportionate because the data is scrambled, short-lived, and cannot be linked back to you by us.
Website analytics
We use PostHog to count visits, so that we can tell which pages people actually read and whether the site is working. It runs in cookieless mode, which limits what it is able to collect in the first place:
- It sets no cookies and stores nothing on your device. This is why you are not asked to accept anything.
- Your IP address is never stored. It is used once, on PostHog’s servers, as one ingredient in a scrambled code that counts visitors, and then it is gone. It is not written down anywhere, and we never see it.
- That code is rebuilt with a new random key every day, and the previous day’s key is destroyed. Two visits on the same day can therefore be counted as one visitor, which is the whole point of it. Visits on different days cannot be connected to each other at all, by us or by PostHog.
- It records which links and buttons you click, and the words printed on them, so we can see which parts of the page people actually use. It does not record anything you type. The email box and the two free-text questions are marked in the code so that the analytics ignores them entirely.
- No name, email address or account is attached to a visit, and analytics is never connected to your waitlist record.
- There is no session recording and no heatmap. We do not watch what you click or where you move your mouse.
Your visit data is stored in Frankfurt, Germany (EU). Storage and processing are not the same thing, and we would rather say so than let the word “EU” do more work than it should: PostHog Inc. is a US company, and it processes data outside the EU, including in the United States. Those transfers are covered by the EU-US Data Privacy Framework and by Standard Contractual Clauses.
Legal basis: our legitimate interest (Art. 6(1)(f) GDPR) in knowing whether the site works. We consider this proportionate because nothing is placed on your device, nothing is kept that could name you, and the counting code cannot follow you from one day to the next.
What we do not collect
To be explicit, because these are the things people usually assume:
- We do not ask for your name, school, year group, subjects, or location.
- We do not use cookies, local storage, or any other tracking on your device. Our site sets nothing on your device at all.
- We do not use advertising pixels or session recording of any kind. The analytics described above counts visits and is never linked to you by name, address or account.
- We do not work out where you are from your IP address.
- Our fonts are served from our own domain, so no data about your visit is sent to Google or any other font provider.
- We do not make any automated decisions about you, and we do not profile you.
- We do not sell your data, and we never will.
Who else handles your data
We use four service providers. Each of them processes your data only on our instructions, under written data processing terms that form part of our contract with them.
| Provider | What they do | What they see | Where |
|---|---|---|---|
| ProviderSupabase | What they doStores the waitlist database | What they seeYour whole signup record | WhereServers in Ireland (EU). Supabase Inc. is a US company and its staff may access systems from outside the EU for support purposes. |
| ProviderResend | What they doSends your confirmation email, and one reminder if you do not confirm | What they seeYour email address and the contents of those emails | WhereEmails are dispatched from Ireland, but Resend stores account data — including delivery logs containing recipient email addresses — in the United States. Resend Inc. is a US company. |
| ProviderPostHog | What they doCounts visits to the site | What they seeThat a page was viewed, and basic technical details such as which browser you used. Your IP address is used to build the daily counting code described above and is never stored. No cookie, and nothing that names you | WhereData is housed on servers in Frankfurt, Germany (EU), but PostHog processes it outside the EU, including in the United States. PostHog Inc. is a US company. |
| ProviderVercel | What they doHosts the website, and runs the code that receives your signup | What they seeEvery request to the site, which includes your IP address, browser type, and which page you visited — plus the contents of the signup form at the moment you submit it. On our plan Vercel keeps these request logs for one hour, and then they are gone | WhereServer code runs in Dublin, Ireland (dub1). Vercel Inc. is a US company. |
Transfers outside the EU
Your waitlist record is stored in the EU (Ireland), and the code that receives your signup also runs in Ireland.
However, your email address does leave the EU. Resend, our email provider, keeps delivery logs in the United States, and those logs contain the address we sent your confirmation to. Supabase and Vercel are also US companies whose staff may access their systems from outside the EU. PostHog houses analytics data in Frankfurt but processes it outside the EU, including in the United States.
Where personal data leaves the EU, the transfer is covered by the European Commission’s Standard Contractual Clauses in each provider’s data processing agreement, and in PostHog’s case also by the EU-US Data Privacy Framework. You can ask us for details at hello@learnkaleid.com.
We are telling you this specifically because “your data stays in the EU” is a claim a lot of small sites make without checking. We checked, and for your email address it is not quite true.
How long we keep it
| What | How long |
|---|---|
| WhatYour waitlist record | How longUntil you unsubscribe or ask us to delete it, or 12 months after your last contact with us — whichever comes first. “Last contact” means the most recent of: signing up, confirming your email, answering the optional questions, or writing to us. If you are taking part in the Kaleid beta, we keep your record for as long as your participation lasts, and the 12 months then run from the end of it. |
| WhatYour record if you never confirm your email | How long30 days. If you do not click the confirmation link, we delete your record after a month. We use double opt-in precisely so that an unconfirmed address is not treated as a real signup. |
| WhatYour consent record | How longDeleted at the same time as your waitlist record |
| WhatThe scrambled form of your IP address | How longAbout one day |
| WhatYour IP address in Vercel’s request logs | How longOne hour, on the plan we are on. This is Vercel’s own retention period and is outside our control. |
| WhatYour email address in Resend’s delivery logs | How longResend states that it keeps email data for 30 days. This happens automatically and is outside our control. |
If you unsubscribe without asking for deletion, we keep a minimal record so that we know not to email you again. You can ask for that to be deleted too.
The legal basis for keeping that much is not your consent, because you have just withdrawn it. It is our legitimate interest (Art. 6(1)(f) GDPR) in being able to honour the request you made, since the only reliable way to not email someone again is to remember that they asked.
How we keep it safe
We are a one-person operation, so rather than claim a security programme we do not have, here is specifically what protects your data:
- The whole site is served over an encrypted connection (HTTPS), and browsers are told to refuse an unencrypted one.
- The database is closed by default. It has no public read access of any kind, so there is no address anyone could visit to list what is in it. Only the server code that runs this site can reach it.
- The links in our emails are cryptographically signed. A link that has been altered, even by one character, stops working rather than doing something unintended.
- There is no login and no admin page on this site, so there is no password to steal and no dashboard to break into.
- Access to the underlying accounts is limited to one person, the founder named above.
No system is perfect, and we would rather say that than imply otherwise. If you ever think something here is wrong, tell us at hello@learnkaleid.com and we will look at it properly.
Your rights
Under the GDPR you have the right to:
- Get a copy of the personal data we hold about you
- Correct anything that is wrong
- Have it deleted
- Restrict or object to how we use it
- Receive it in a portable format so you can take it elsewhere
- Withdraw your consent at any time — this does not affect anything we did before you withdrew it
The fastest way to do any of this is the link at the bottom of every email we send you. It lets you unsubscribe, or delete your record entirely, without contacting us.
Otherwise, email hello@learnkaleid.com. We will respond within one month, as the law requires. There is no charge.
Two things we want to be honest about
Your email address exists in more than one place. The self-service delete link removes your waitlist record immediately. But:
- If you have already been invited to the closed beta, your address is also in the Kaleid app’s own database, which is a separate system. Removing you from there is currently done by hand.
- Your address is also in Resend’s delivery logs, because that is how our emails reached you. Resend states it keeps email data for 30 days, after which it goes automatically. We cannot delete it sooner.
So if you ask us to erase everything, we will remove you from every system we control within one month, and the Resend copy will expire on its own within 30 days of the last email we sent you. If you never confirmed, that last email is the reminder rather than the confirmation, so the Resend copy can outlast our own record of you by a couple of days.
We are telling you this rather than saying “one click deletes everything,” because that would not be true.
If you are not happy with how we have handled things
You can complain to the Swedish data protection authority:
Integritetsskyddsmyndigheten (IMY)
Box 8114, 104 20 Stockholm
Email: imy@imy.se
Website: imy.se
IMY also accepts complaints through an e-service on their website.
You can complain to IMY without contacting us first, though we would rather have the chance to fix it.
Minimum age
You must be 16 or older to join the waitlist. This matches the confirmation you tick on the signup form.
We do not ask for your date of birth, so we cannot check this. If you tell us that someone below this age has signed up, we will delete their record.
Changes to this policy
If we change this policy, we will update the date at the top. If the change is significant and affects how we use data you have already given us, we will email you before it takes effect.
We keep a record of every version of the consent wording we have used, so if you ever want to know exactly what you agreed to on the day you signed up, we can tell you.
Questions
Email hello@learnkaleid.com. A real person reads it.