What we keep, and why.

Naarwhal is a pre-launch project. The operating company is being registered in Estonia; its registered name, registry code and address are published here the day that completes. Until then the trader is reachable at hello@naarwhal.com, and nothing on this site can be ordered or paid for.

Until registration completes, the controller is the founder trading as Naarwhal, reachable at hello@naarwhal.com. The registered entity, its registry code and its address replace this paragraph the day the registration is granted, and the change is noted in the Logbook.

The waitlist. Your email address, which form on the site you used, the exact sentence you agreed to, and the time. Legal basis: your consent, GDPR Art. 6(1)(a). We store the wording you were shown because consent has to be demonstrable under Art. 7(1), and that wording changes over time.

The contact form. Your name, email, chosen topic and message. Legal basis: steps taken at your request before entering a contract, Art. 6(1)(b), and our legitimate interest in answering you, Art. 6(1)(f). This is a different basis from the waitlist, and writing to us does not add you to any list.

Events. Counts of things that happen — a page visit, a signup, an unsubscribe — with the referring site or campaign tag where there is one. Legal basis: legitimate interest, Art. 6(1)(f), in knowing whether anything we do works. No cookies are set for this, no profile is built, and no third party receives it.

No advertising or retargeting pixels. No Google Analytics, no Meta Pixel, no session recording, no fingerprinting. No selling, renting or sharing your address. No automated decision-making, and no profiling in the Art. 22 sense. No cookie banner, because we set no tracking cookies to ask you about.

Three processors, each under a data processing agreement, each acting only on our instructions:

• Vercel — hosting and request logs.
• Neon — the database the address is stored in.
• Resend — sending the emails you asked for, from its EU region.

Where a processor moves data outside the EEA, that transfer runs on the European Commission's Standard Contractual Clauses.

Waitlist addresses until you unsubscribe, or until the Forty has shipped and the list has served its purpose — whichever comes first. Unsubscribing does not delete the row: we keep the address and the time you asked, because that record is what stops you being added back by mistake. Ask for erasure and the row goes entirely. Contact messages are kept for two years.

Every email has a one-click unsubscribe, and it takes effect immediately with no confirmation step — withdrawing consent has to be as easy as giving it, which is Art. 7(3). You can also write to hello@naarwhal.com.

You have the right to access what we hold, correct it, erase it, restrict or object to how it is used, and receive it in a portable format — Arts. 15 to 21. One email does all of these; there is no form and no verification hoop beyond replying from the address in question. We answer within 30 days, usually the same week.

If we handle it badly you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or to the supervisory authority where you live.

If this page changes in a way that affects you, we say so in the Logbook and in the next email rather than quietly reposting it with a new date.