Last updated: 2026-07-20. This policy covers only untilum.com — the protocol presentation site (this domain). The capsule product (a separate domain, untilum.online) collects a different, larger set of data — sealing metadata, optional reminder emails, payment records — and will carry its own privacy policy before it accepts real users. The two are not the same data map; do not read this page as covering the product.
Carrot UG (haftungsbeschränkt), Munich, Germany (see Impressumfor the full legal notice). Contact for privacy matters:hello@untilum.com.
The "Request full data room" form on the Investors page asks for an email address, submitted voluntarily. We use it only to grant and follow up on access to our investor data room. Legal basis: your consent (Art. 6(1)(a) GDPR), given by submitting the form. You can withdraw consent at any time by writing tohello@untilum.com; withdrawal does not affect processing already carried out. We retain the address until the request is fulfilled or withdrawn, whichever comes first, and delete it once neither applies.
Note on current implementation: as of this writing, the form's submit action is a client-side stub for interface design purposes and does not yet send data to a live backend. This policy describes the intended handling once the real endpoint ships, and will be updated at that point with the concrete storage and processing details.
Like any web server, our hosting infrastructure records standard access logs when you visit this site — IP address, timestamp, requested page, referrer, and user agent — for the technical operation and security of the site (detecting and preventing abuse). Legal basis: our legitimate interest in operating a secure, reliable service (Art. 6(1)(f) GDPR). These logs are retained briefly by the hosting provider and then deleted automatically; exact retention period is confirmed with the hosting provider before public launch.
No cookies. No third-party analytics (no Google Analytics or similar). No tracking pixels, no social-media plugins, no advertising networks. Nothing on this site profiles you or follows you across other sites. If that ever changes, this section changes first, before the code ships.
Data-room access requests may be relayed to team members handling investor relations, all bound by the same confidentiality obligations. We do not sell or rent personal data, and we do not share it with advertisers.
To be confirmed: the physical location and jurisdiction of the hosting provider serving this site. If outside the EU/EEA, this section will name the transfer mechanism relied upon (e.g. an EU Commission adequacy decision or Standard Contractual Clauses) before launch.
Under the GDPR you have the right to: access the personal data we hold about you (Art. 15); request correction of inaccurate data (Art. 16); request erasure (Art. 17); request restriction of processing (Art. 18); receive your data in a portable format (Art. 20); and object to processing based on legitimate interest (Art. 21). To exercise any of these, write to hello@untilum.com. You also have the right to lodge a complaint with a supervisory authority — in Bavaria, theBayerisches Landesamt für Datenschutzaufsicht.
We will update this page as the site's actual data handling changes — particularly once the data-room form connects to a real backend (§2.1) and once hosting details are confirmed (§4). Material changes will be reflected here with an updated date at the top.
This page is a working draft prepared for legal review, not a finished legal opinion. See the project's internal data map and legal position notes (for_invest/legal/GDPR-Memo-Draft-RU.md) for the fuller analysis this page is drawn from.