Privacy Policy
This says what happens to personal data when you visit this site, and what will happen to it inside the product once it runs. It is written to be read rather than survived.
RetainLens is not live yet. The only personal data handled today is what this website receives: server log data and, if you use the form, your email address. The sections marked in the product describe how the service is being built and become true when the first account opens.
1. Who is responsible
Eldridge Kaboth
Bromberger Straße 69
28237 Bremen
Germany
Email: hello@retainlens.com
RetainLens is run as a sole proprietorship (Einzelunternehmen). A data protection officer is not required under Art. 37 GDPR and § 38 BDSG, so there is none; write to the address above with anything on this page.
2. Two different roles
For this website we are the controller: we decide what is collected and why, and this policy covers it.
For the member data inside a customer's account we are a processor. The studio decides what goes in and why; we act on its instructions only. That relationship is governed by the Data Processing Agreement, and members of a studio should ask that studio about their data.
3. What this website collects
Server log data
Every request leaves a log entry with our hosting provider: IP address, date and time, the page requested, the referring page, and browser and operating system strings. It is what makes delivery and abuse defence possible, and the legal basis is Art. 6(1)(f) GDPR: our interest in a site that works and is not being attacked. Logs are kept for a short period (currently up to 30 days) and are not combined with anything else.
The email form
If you enter an email address, we use it to reply to you and to tell you when RetainLens opens. Legal basis: Art. 6(1)(b) GDPR, steps taken at your request before a contract. We keep it until you ask us to delete it, and in any case no longer than 24 months after the last contact. There is no newsletter and the address is not passed to anyone for advertising.
Cookies and analytics
This site sets no cookies and runs no analytics, no tracking pixels and no A/B tooling. That is why you are not being asked to accept anything. If that ever changes, the consent banner comes first and this page is updated before the first byte is measured.
Fonts and other third parties
The typefaces are served from our own domain. Nothing on this site loads from a content delivery network, an analytics service or a social network, so opening a page contacts our server and nobody else's.
4. What the product handles in the product
An account holds business data about a studio's members: name, join date, membership type, status, check-in timestamps, and an email address only where the studio chooses to include one. That is the whole list.
It never holds health data, injury notes, body metrics or payment details. Not as a policy we could change quietly, but because the integrations never ask for those fields and the importer drops them. Every platform connection is read-only at the token level, so RetainLens can read a schedule but cannot cancel a membership, charge a card or edit a record.
5. Who else processes data for us
We use a small number of providers, each under a data processing agreement:
- Vercel Inc.: hosting and delivery of this website and the application.
- Resend: transactional email (the Monday email, password resets). No marketing sends.
- Supabase: the application database, from launch.
- Stripe Payments Europe Ltd.: payment and billing, once paid plans exist. Card details go to Stripe and never reach us.
The binding version of this list, together with the notice period for changes, is in the Data Processing Agreement.
6. Transfers outside the EU
Some of these providers are US companies or have US parent companies. Where data reaches them outside the EU, the transfer rests on the European Commission's Standard Contractual Clauses, and on the EU–US Data Privacy Framework where the provider is certified under it. At launch the application and its database are provisioned in an EU region.
7. How long we keep things
- Server logs: up to 30 days.
- An email you gave us through the form: until you ask us to delete it, at most 24 months after the last contact.
- Account and member data: for as long as the account exists. If a trial or a subscription ends without payment, the account goes read-only and the data is kept for 60 days so nothing is lost by accident, then deleted.
- Invoices and what tax law requires us to keep: the statutory retention periods (§ 147 AO, § 257 HGB), regardless of the above.
8. Your rights
Under the GDPR you can ask us for access to your data (Art. 15), correction (Art. 16), erasure (Art. 17), restriction (Art. 18) and a portable copy (Art. 20), and you can object to processing based on legitimate interests (Art. 21). Where processing rests on consent, you can withdraw it at any time with effect for the future. One email to hello@retainlens.com is enough; we do not require a form.
You can also complain to a supervisory authority. The one responsible for us is Die Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen, and you may equally go to the authority where you live or work.
9. Changes to this policy
If the service changes, this page changes with it, and the date at the top moves. Customers are told by email before anything material takes effect.