‹ Back to home
Privacy Policy
Effective date: 18 August 2026
This Privacy Policy applies to the website prepfam.app (the "Website"). A separate privacy policy applies to the PrepFam app.
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
SPRNKLD — Dominik Sprenkelder, sole proprietor (Einzelunternehmer)
Jochingergasse 20, 2100 Korneuburg, Austria
Email: privacy@prepfam.app
We have not appointed a data protection officer, as we are not legally required to do so.
2. Categories of personal data we process
Depending on how you use the Website, we process the following categories of personal data:
- Access / log data: IP address, date and time of access, page or file requested, browser and operating system (user agent), and the referring URL.
- Contact data (contact form): name, email address, and the content of your message.
- Waitlist data: email address and time of sign-up (and, where a double opt-in procedure is used, the time of confirmation).
3. Hosting and server log files
This Website is hosted by an external provider: Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA.
When you access the Website, the hosting provider automatically collects and stores information in so-called server log files. This includes the IP address of the requesting device, the date and time of access, the page or file requested, the browser and operating system used (user agent), and the referring URL, where transmitted.
This processing is technically necessary to deliver the Website, ensure its stability and security, and prevent misuse.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and functional website).
Retention: Server log files are stored for a limited period for security purposes and then deleted, unless statutory retention obligations apply or longer storage is required to investigate a specific attack.
An international data transfer arises from the use of this provider; see Section 7.
We also use Vercel Web Analytics to see how many people visit the Website. It works without cookies or any device identifier and only stores aggregated, anonymous figures (e.g. page views, referring site, country, device type) that cannot be traced back to an individual visitor.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding how the Website is used).
4. Contact form
If you contact us via the contact form, we process the data you provide: your name, email address, and the content of your message. We use this data solely to handle your enquiry and any follow-up questions.
The form uses a technical spam protection ("honeypot" field). This is a form field that is invisible to humans and serves to block automated submissions. No personal data is collected through it.
The form data is processed by our processor Supabase Inc. (processing in a data centre within the European Union, Frankfurt region, Germany).
Legal basis: Art. 6(1)(b) GDPR (handling your enquiry / taking steps prior to entering into a contract) and Art. 6(1)(f) GDPR (legitimate interest in efficient communication).
Retention: We store your enquiry until it has been fully dealt with. The data is then deleted, unless statutory retention obligations apply. You may object to the storage or request erasure at any time.
If you email us directly (e.g. at hello@prepfam.app or privacy@prepfam.app), that message is routed through our processor ImprovMX Inc. (USA), which forwards it to our inbox. ImprovMX does not store the message beyond the time needed to forward it.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in receiving and answering email sent to our published addresses).
5. Waitlist
On our Website you can sign up to a waitlist with your email address in order to be informed about the launch of the PrepFam app and the start of the beta phase. Sign-up uses a double opt-in procedure: after you submit your email, we send a confirmation link, and your address is only added to the waitlist once you click it.
Data processed: email address, time of sign-up, and time of confirmation.
You provide this data voluntarily on the basis of your explicit consent. We use your email address solely to notify you about the availability of the app or beta access, and to send the one-time confirmation email. Your data is not shared with third parties for advertising purposes.
Legal basis: Art. 6(1)(a) GDPR (consent).
Withdrawal of consent: You can withdraw your consent at any time with effect for the future, for example via the unsubscribe link in any email or by an informal message to the contact address above. Withdrawal means that your data will no longer be processed for the above purposes from that point on. The lawfulness of processing carried out until withdrawal remains unaffected.
The email addresses are stored by our processor Supabase Inc. (processing in the EU region, Germany).
Retention: until you withdraw your consent or the purpose no longer applies (at the latest, once the waitlist / beta phase has concluded).
6. Cookies
This Website does not use any cookies that require consent. At most, technically necessary cookies are used that are required for the proper operation of the Website. No consent is required for these under § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021).
7. Recipients and international data transfers
We use processors for the processing described above. Each acts on our behalf and on our instructions, on the basis of a data processing agreement pursuant to Art. 28 GDPR:
- Vercel Inc. (USA) — website hosting; processes access / log data (see Section 3).
- Supabase Inc. (EU region, Germany) — storage of contact-form and waitlist data (see Sections 4 and 5).
- Resend, Inc. (USA) — sends the waitlist double opt-in confirmation email; processes the email address for this one-time message (see Section 5).
- ImprovMX Inc. (USA) — forwards email sent to our published addresses to our inbox (see Section 4).
Data processed by Supabase is stored within the EU/EEA.
Because Vercel, Resend and ImprovMX are based in the USA, personal data may be processed in a third country. Vercel and Resend are certified under the EU-U.S. Data Privacy Framework (DPF), so these transfers are covered by the European Commission's adequacy decision under Art. 45 GDPR. ImprovMX is not DPF-certified; that transfer instead relies on appropriate safeguards within the meaning of Art. 46 GDPR, namely the EU Standard Contractual Clauses. The same Art. 46 basis applies to Vercel or Resend transfers falling outside the scope of their certification.
8. Your rights
With regard to your personal data, you have the following rights:
- Access to the data processed (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing based on Art. 6(1)(f) GDPR, on grounds relating to your particular situation (Art. 21 GDPR)
To exercise your rights, an informal message to the contact details above is sufficient.
9. Right to lodge a complaint
If you believe that the processing of your data infringes data protection law, you have the right to lodge a complaint with a supervisory authority. The competent authority in Austria is:
Österreichische Datenschutzbehörde
Barichgasse 40–42, 1030 Wien
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Web: www.dsb.gv.at
10. Data security
This Website uses TLS/SSL encryption, recognisable by the "https://" in your browser's address bar. This protects the data transmitted between your browser and our server.
11. Changes to this Privacy Policy
We update this Privacy Policy whenever changes to our processing activities make this necessary. The current version published on this Website applies in each case.