This policy covers the website at theportalos.com. The Portal application is not generally available yet; when it launches it will have its own policy and a separate data processing agreement, because it handles a different and far more sensitive category of data (see section 9).
Portal is an early-stage product operated from the European Union. The controller within the meaning of Art. 4(7) GDPR can be reached here:
Email: privacy@theportalos.com
Postal and company details are provided on request — including to anyone exercising the rights described in section 6 — and will be published in the imprint.
We have not appointed a Data Protection Officer. Based on the scale and nature of this website’s processing, we do not currently meet the criteria in Art. 37 GDPR. This will be reassessed before the application launches.
If you submit the waitlist form, the following is stored:
| Data | Where it comes from | Why |
|---|---|---|
| Email address | You type it | To contact you about early access |
| Short description of what you sell (optional, max. 120 characters) | You type it | To understand who is interested and prepare relevant early access |
| Country code | Derived by our hosting provider from your IP address | To understand which markets to support first |
| Referring page | Your browser’s Referer header | To see which channels bring interest |
| Timestamp | Our server | Ordering the list, handling deletion requests |
Legal basis: consent, Art. 6(1)(a) GDPR. You give it by submitting the form and may withdraw it at any time (section 6).
If you type what you sell and press “Show me”, that short text is sent to our server function, which uses an AI provider to generate example wording for this page. The generated result is stored in your browser only (localStorage) so the page stays personalised on your next visit. We do not store the generated result on our servers. The text you typed is processed to produce that result and, if you also join the waitlist, it is stored with your waitlist entry as described in 2.1.
Legal basis: Art. 6(1)(b) GDPR (taking steps at your request) and Art. 6(1)(f) GDPR (our legitimate interest in demonstrating the product). Do not enter personal data, customer details or confidential business information into this field — it is a demonstration feature.
Our hosting provider processes standard connection data (IP address, time of request, requested file, browser and operating system identifiers, referring page) to deliver the site and to defend against attacks. This is technically necessary and is not used to build a profile of you.
Legal basis: Art. 6(1)(f) GDPR — legitimate interest in a functioning, secure website.
We name our processors rather than describing them in the abstract, so you can assess them yourself.
| Provider | What it does | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, CDN, security, serverless functions and the key-value store that holds the waitlist | Connection data; waitlist entries | Global network; US company. Transfers covered by EU Standard Contractual Clauses. |
| A large language model provider | Generates the personalised example wording | Only the short text you type into the personalisation field. No email, name or contact data is sent. | Processing may take place outside the EEA under EU Standard Contractual Clauses. We name the specific provider on request. |
Each processor is engaged under a data processing agreement meeting Art. 28 GDPR, receives only the data it needs, and is contractually barred from using it for its own purposes.
Some providers are established outside the EEA or operate global infrastructure. Where personal data is transferred outside the EEA, it is done on the basis of an adequacy decision or EU Standard Contractual Clauses under Art. 46 GDPR, together with additional technical measures such as encryption in transit.
Under the GDPR you have the right to:
Write to privacy@theportalos.com. We answer within one month, as required by Art. 12(3) GDPR.
You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in the EU member state of your residence, workplace, or the place of the alleged infringement.
The site is served exclusively over HTTPS. Waitlist data is stored with our hosting provider and is not publicly accessible. We apply a restrictive content security policy that permits no third-party scripts, styles or fonts.
This site is aimed at businesses and is not directed at children. We do not knowingly collect data from anyone under 16.
The application will connect to platforms such as marketplaces and mailboxes on your instruction. In that context, you are the controller for your customers’ data and we act as your processor. Before any such data is handled, we will provide a separate privacy policy, a data processing agreement under Art. 28 GDPR, and a list of sub-processors. Nothing on this website gives us access to such data today.
We update this policy when the processing changes. The date at the top always reflects the current version.
This policy was prepared from the statutory requirements and from an inspection of what this website’s code actually stores. It has not been reviewed by a lawyer, and the provider’s full identification details are still being finalised. Both should be completed before the site is used commercially.