Privacy policy

Last updated: 29 October 2026

1. Controller

Obsidian Labs UG (haftungsbeschränkt) (tradename CostPane), Gronauer Straße 41b, 48629 Metelen, Germany. Email: info@costpane.com. No data protection officer has been appointed because there is no legal obligation to appoint one.

2. Overview

This website is a static information page. It sets no analytics or tracking cookies, uses no external fonts or scripts, and embeds no third-party content. We process personal data only (a) technically when you visit (hosting), (b) if you complete our survey or optionally join the waitlist (Tally), (c) if you place a founding pre-order (Stripe), and (d) if you email us.

3. Hosting and server logs (Cloudflare Pages)

The site is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”), as our processor. When you open the site, your browser automatically sends technical data, in particular your IP address, date and time, the page requested, referrer URL, browser type and operating system. This data is needed to deliver the site securely. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working website). Cloudflare processes on its global network, including in the USA. The transfer is based on Cloudflare’s EU-U.S. Data Privacy Framework certification (Art. 45 GDPR) and the EU standard contractual clauses in Cloudflare’s data processing addendum. We do not use Cloudflare Web Analytics or Logpush. Technical logs are kept only as long as Cloudflare needs them for operation and security. More: Cloudflare privacy, Cloudflare GDPR.

4. Survey and waitlist (Tally)

“Join the waitlist” and “Take the survey” open a form hosted by Tally BV, Sint-Pietersnieuwstraat 11, 9000 Ghent, Belgium, enterprise number 0776.979.007 (“Tally”). Tally processes responses on our behalf as a processor under a data processing agreement (accepted when creating a Tally account). Form data is stored in the EU (encrypted in transit and at rest).

We collect including:

Responses without an email are not personal data for us unless free text identifies someone. We use email addresses only if you tick the matching checkbox (Art. 6(1)(a) GDPR). If you enter an email without ticking either box, we do not use it for mailings and delete it with the research data within 24 months at latest, or sooner on withdrawal or when the study ends. Tally keeps submissions until we delete them in the account; backups may persist up to 90 days after deletion. Email verification (double opt-in) is not enabled on the form. You may withdraw consent at any time with future effect by emailing info@costpane.com or using unsubscribe links in emails (Art. 7(3) GDPR). When you open the Tally form, Tally’s privacy policy also applies; Tally may set its own cookies.

5. Founding pre-order (Stripe Payment Link)

The “Founding pre-order” button takes you to a payment page hosted by Stripe. Payment data (card details, name, email, billing address, country) is entered directly with Stripe and never reaches our website. For EEA customers, involved entities include: Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland (contract/DPA); Stripe Technology Europe, Limited, Ireland (regulated payment services); Stripe Technology Company, Limited, Ireland (other controller activities). For regulated payment services they may act as joint controllers; see the Stripe Privacy Center for the essence of that arrangement (Art. 26 GDPR). Stripe may transfer data to the USA (Stripe, LLC’s EU-U.S. Data Privacy Framework and standard contractual clauses). We receive your name, email, the amount, payment status and limited card information (e.g. brand and last 4 digits). Legal basis: Art. 6(1)(b) GDPR (pre-order and refunds) and Art. 6(1)(c) GDPR (tax and commercial retention). Retention: invoices and booking records 8 years, books and annual accounts 10 years, commercial letters 6 years (§ 147 AO, § 257 HGB). Stripe privacy.

6. Contact by email

If you email us, we process your email address and message to reply. Legal basis: Art. 6(1)(b) GDPR where the message concerns a pre-order or future contract, otherwise Art. 6(1)(f) GDPR (answering enquiries). We delete it when the matter is closed unless statutory retention applies. Email is hosted with Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) as our processor; Google may also process in the USA (Data Privacy Framework, standard contractual clauses). Google privacy.

7. Cookies and similar technologies

Our static pages set no cookies and do not read information on your device for analytics or tracking. Cloudflare may set a strictly necessary cookie (e.g. __cf_bm) if security features such as Bot Fight Mode are enabled; no consent under § 25(2) No. 2 TDDDG is then required. Tally and Stripe pages you open via our links may use their own cookies — see their policies above.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent (Art. 7(3)). You have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR). Contact info@costpane.com. You may lodge a complaint with a supervisory authority (Art. 77 GDPR), for example: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, poststelle@ldi.nrw.de.

9. Obligation to provide data; automated decisions

You are not obliged to provide any data. Without an email we cannot add you to the waitlist; without payment data no pre-order is possible. We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

10. Security

The site is delivered only over encrypted HTTPS (TLS).

11. B2B outreach by email

We may contact businesses whose work relates to AI services, using business email addresses the business has published on its own website, to ask about how they handle AI usage costs and to tell them about CostPane. We store the company name, contact name and role (if published), the email address, the public page where we found it, and our correspondence. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in B2B direct marketing and market research, Recital 47). Source: the recipient’s publicly accessible website. We delete the data 12 months after the last contact if there is no business relationship, or immediately after an objection, keeping only the email address on a suppression list so that we never contact it again. You may object at any time (Art. 21(2) GDPR) by replying “unsubscribe” or emailing info@costpane.com. Emails are sent through Google Workspace (see section 6).