Effective from 23 August 2026

Privacy Policy

Our rule is simple: we ask only for your e-mail, use it only for what we agreed, and you can unsubscribe at any time.

1. Who processes your data

The data controller is penact s.r.o., Company ID 09959980, registered office at Orelská 513/5, Vršovice, 101 00 Praha 10 (operator of the Ottilea brand).

Data protection contact: hello@ottilea.com

We have not appointed a Data Protection Officer, as we are not required to.

2. What data we process

When you join the waitlist:

• your e-mail address – the only detail you actively give us,
• the language of the page you signed up on (Czech or English),
• the date and time of sign-up,
• a fingerprint of your IP address – we do not store the IP address itself. We convert it with a one-way function (SHA-256 with a salt) into a fingerprint from which the original address cannot be recovered. It only lets us recognise repeated sign-ups from one place,
• the traffic source – which part of the site you submitted the form from, and any parameters from the link you arrived through (e.g. an ad or Instagram),
• invitation codes – your own, and the code of the woman who invited you, if any,
• e-mail delivery status – whether a message arrived or bounced. We do not track whether you opened an e-mail or what you clicked in it.

If you subscribe to updates, we additionally store the date, time and exact wording of your consent, and where you gave it.

We do not collect your name, phone number, address, age or any special category data.

3. Why we process it and on what legal basis

Providing your e-mail is entirely voluntary. Without it, however, we cannot add you to the waitlist or tell you when we open.

4. How you give consent

Joining the waitlist. You give consent by submitting the form. Below the form we state what we will use the address for, with a link to this policy. We do not ask you to click a confirmation link – your place is valid immediately. We verify that the address is real using the welcome e-mail: if it bounces, we remove the address from the list.

Updates. Consent to receive updates is separate from joining the waitlist, and joining does not include it. You give it by clicking the link in the welcome e-mail. We record when you gave it and the exact wording. Without this consent we will send you only the launch invitation, nothing else.

Withdrawal. You can withdraw consent at any time with one click in every e-mail, or by writing to hello@ottilea.com. We then mark your record as unsubscribed and send you nothing further.

5. Who we share data with

We do not sell your data and do not pass it to third parties for their own marketing. The following processors work for us:

In addition, contractors bound by confidentiality may help us run the site and communications.

Transfers outside the EU. Your data is stored in the European Union. However, Supabase, Resend and Cloudflare are companies based in the United States and may, in justified cases (such as technical support), access the data from there. These transfers are covered by the European Commission’s Standard Contractual Clauses, or by the provider’s participation in the EU–US Data Privacy Framework. We have a data processing agreement with each processor.

We may also disclose data to public authorities where required by law.

6. Cookies and analytics

The website uses no cookies at all – neither analytics nor marketing.

We currently do not measure traffic. There is no Google Analytics, Meta Pixel or any other measurement tool on the site.

The only thing the site stores on your device is the invitation code in your browser’s temporary memory (sessionStorage), when you arrive through a friend’s link. It exists solely so we can correctly credit the extra month when you sign up. It disappears when you close the tab, does not track you across sites, and requires no consent because it is necessary to deliver what you asked for by clicking the link.

If we later add traffic measurement, we will use a tool that works without cookies and without cross-site identifiers, and we will update this section. Should we ever deploy a tool that does use cookies, we will show a cookie banner first and will not run it without your consent.

7. Your rights

At any time you have the right to:

• withdraw consent – one click in every e-mail, or a message to hello@ottilea.com; withdrawal does not affect processing carried out beforehand,
• access the data we hold about you,
• rectify inaccurate data,
• erasure (“right to be forgotten”),
• restriction of processing,
• data portability to another controller,
• object to processing based on legitimate interest.

Write to hello@ottilea.com and we will respond within one month at the latest.

You also have the right to lodge a complaint with the supervisory authority: Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.

8. Security

The waitlist is held in a database that is not accessible from outside – only our server function reads from and writes to it. Data is transferred over an encrypted connection (HTTPS). Access to the list is limited to a small number of people. Instead of your IP address we keep only its irreversible fingerprint.

9. Automated decision-making

We do not carry out automated decision-making or profiling with legal effects for you.

10. Children

The website and the upcoming service are intended for persons aged 18 and over. We do not knowingly process children’s data.

11. Changes

We may update this policy, particularly once the app launches. The current version is always at ottilea.com/en/privacy with its effective date. We will notify you by e-mail of any material change.