Privacy Notice

Last updated: 2026-10-21

1. Controller

Dr. Kevin Rudolph
Limnaria Villas, Block A, Apt 202
Melinas Merkouri 30, 8042 Paphos, Cyprus
Email: hello@oblior.com

2. What we collect

This is a marketing site. If you submit your email address through the waitlist form, we collect:

• Your email address.
• The timestamp of submission.

We do not use cookies for tracking or profiling. We do not embed advertising trackers, advertising cookies, or third-party fingerprinting scripts.

3. Aggregate visit statistics

We use Vercel Web Analytics in cookieless mode to count page views and approximate visitor numbers. No cookies, no persistent identifiers, no fingerprints, and no full IP addresses are stored. Vercel acts as our processor under GDPR Art. 28 and processes the data on EU edge infrastructure. See Vercel Analytics privacy policy.

4. Purpose and legal basis

We process your email address solely to notify you when the Oblior demo opens, and at most a small number of follow-up messages directly related to that announcement. Legal basis: your consent (GDPR Art. 6 (1)(a)), given by submitting the form. You may withdraw consent at any time by emailing hello@oblior.com. Aggregate visit statistics are processed under our legitimate interest in understanding how the site is used (GDPR Art. 6 (1)(f)); the data collected is anonymous and aggregated.

5. Recipients / processors

The site is hosted on Vercel Inc. (340 S Lemon Ave #4133, Walnut, CA 91789, USA), with edge serving from EU regions. Email addresses are stored in a managed key-value database operated by Upstash via the Vercel Marketplace, located in the EU (Frankfurt). Vercel also provides the cookieless analytics described in section 3. Data processing agreements under GDPR Art. 28 are in place with both providers.

6. Retention

We keep your email until the demo opens and you receive the notification, or until you ask us to delete it, whichever comes first. After that we delete the record within 30 days. Aggregate analytics are stored in rolling form and retained no longer than 12 months.

7. International transfers

Website hosting infrastructure operates globally. Active data is served from EU edge locations. Backups and operational metadata may transit through US-located systems under the EU Standard Contractual Clauses (SCC) and the EU-US Data Privacy Framework where applicable.

8. Your rights (GDPR Chapter III)

You have the right to:

• Access your data (Art. 15).
• Rectify it (Art. 16).
• Erase it (Art. 17).
• Restrict processing (Art. 18).
• Portability (Art. 20).
• Object to processing (Art. 21).
• Withdraw consent at any time (Art. 7 (3)).

To exercise any of these rights, email hello@oblior.com. We will respond within 30 days.

9. Right to complain

You may lodge a complaint with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus, or with the supervisory authority in your country of residence.

10. Changes

We may update this notice as the product evolves. The “Last updated” date at the top will reflect the most recent change.

11. The Oblior app (app.oblior.com)

If you create an account in the Oblior app, we process the following data to provide the service (GDPR Art. 6 (1)(b), performance of a contract):

• Account data: name, email address and sign-in data, handled by our authentication provider Clerk, Inc. (USA).
• Company profile: the website address you enter, the text of the public pages we read from that website, and the company facts you confirm (for example country, legal form, number of employees).
• Usage records: which compliance items you mark as done or not applicable, and a log of actions for security and audit purposes.

To analyse your website we send the public page text and the fact vocabulary to Anthropic, PBC (USA, Claude API). Background jobs are run by Inngest, Inc. (USA). The app is hosted on Vercel Inc. (USA, functions in Frankfurt) and the database runs on Amazon Web Services EMEA SARL in Frankfurt, Germany. These providers process data on our behalf as processors (GDPR Art. 28); transfers to the USA rely on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. We keep account and profile data until you delete your account or ask us to delete it.