Privacy Policy

Last updated: 26 June 2026

1. Controller

The controller responsible for data processing on this website is:

Gehad Mohamed
Friedrichstr. 155, 10117 Berlin, Germany
Email: hello@flipshot.io

2. What we collect, and why

Waitlist sign-up

When you join the waitlist we process the email address you enter and, optionally, the marketplaces you sell on and your monthly sales volume (asked after sign-up). We use this solely to notify you about early access and launch and to gauge interest.

• Legal basis: your consent, Art. 6 (1)(a) GDPR. You can withdraw it at any time with effect for the future (see Section 6) — e.g. by emailing us — without affecting prior processing.
• Double opt-in: when you submit the form, your email is sent (via a serverless function on our host) to our EU email provider Brevo, which sends you a confirmation email. You are only added to the waitlist after you click the confirmation link — and you stay on it until you withdraw consent or we delete the list.

Hosting & server logs

This site is hosted by Netlify. When you visit, the host automatically processes technical data (including your IP address, date/time, requested files, and user agent) in server log files, which is technically necessary to deliver the site securely.

• Legal basis: our legitimate interest in the secure, stable operation of the site, Art. 6 (1)(f) GDPR.

Fonts

This site currently loads web fonts (Inter and Material Symbols) from Google Fonts (Google Ireland/LLC). When the page loads, your IP address is transmitted to Google. Legal basis: legitimate interest in consistent presentation, Art. 6 (1)(f) GDPR.

Cookies, analytics & advertising

To measure and improve our early-access campaign, this site uses analytics and advertising tools, loaded through Google Tag Manager: Google Analytics 4 (usage measurement), the Meta Pixel and the Reddit Pixel (to measure ad performance and reach similar audiences). These tools may set cookies or similar identifiers and process data such as your IP address, device/browser information, pages viewed, and whether you joined the waitlist.

• In the EU/EEA (and UK): these tools load only after you consent via our cookie banner. Legal basis: your consent, Art. 6 (1)(a) GDPR and § 25 (1) TTDSG. Until you accept, they stay off (Google Consent Mode). You can decline without affecting the rest of the site.
• Outside the EU/EEA: these tools load by default.
• Withdrawing consent: you can withdraw at any time with effect for the future by clearing this site's storage in your browser (which removes the saved fs_consent choice and re-shows the banner) or by emailing us.

Campaign attribution

If you reach this site from one of our ads or links, the page may read campaign parameters from the URL (UTM tags) and the referring website, and store the marketplaces and monthly sales volume you optionally tell us after signing up. We attach these to your waitlist record to understand which channels and messages work. Legal basis: your consent, Art. 6 (1)(a) GDPR (waitlist), and our legitimate interest in measuring our campaign, Art. 6 (1)(f) GDPR.

3. Recipients & processors

• Brevo (Sendinblue GmbH / Brevo SAS) — our email service provider (EU); stores the waitlist and sends the confirmation and waitlist emails, as our processor under a data processing agreement. Data is processed on EU servers.
• Netlify, Inc. — website hosting and the serverless function that forwards your email to Brevo, acting as our processor under a data processing agreement.
• Google (Ireland/LLC) — web fonts, plus Google Tag Manager and Google Analytics 4 (where you consent), as described above.
• Meta Platforms Ireland Ltd. — the Meta Pixel for ad measurement (where you consent).
• Reddit, Inc. — the Reddit Pixel for ad measurement (where you consent).

We do not sell your data. Analytics and advertising tools are used only with your consent (EU/EEA/UK) as described above.

4. International transfers

Your waitlist data is held by Brevo on EU servers. Our website host (Netlify), Google Fonts/Analytics/Tag Manager, the Meta Pixel and the Reddit Pixel may process technical data (such as your IP) on servers in the USA; such transfers are safeguarded by the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework, together with the providers' respective data-processing terms.

5. Storage period

We keep your waitlist data until you withdraw consent or until the waitlist purpose ends (e.g. a reasonable period after launch), after which it is deleted. Server logs are retained only as long as necessary for security.

6. Your rights

Under the GDPR you have the right to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and to object (Art. 21). Where processing is based on consent, you may withdraw it at any time (Art. 7 (3)). To exercise any right, contact hello@flipshot.io.

You also have the right to lodge a complaint with a supervisory authority — for us, the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit, BlnBDI).

7. Changes

We may update this policy as the product develops. The current version is always available on this page.