Privacy policy

Last updated October 20, 2026

Version for the closed beta sign-up phase.

This notice explains which personal data I process when you visit offcuts.work and put your name down for the closed beta, and which rights you have. The German version is the legally binding one; this translation is provided for convenience.

1. Controller

Marcel Küpper
Joseph-Roth-Str. 122
53175 Bonn (Germany)

Email: marcel@offcuts.work

2. What happens in this phase

offcuts.work is not open to the public yet. On the website you can sign up for the closed beta.

I use your details from the application to invite you when the closed beta starts (expected mid-November 2026), to choose whom to invite from the answers, and to arrange a short video call if you offered one. I'll delete these data with the end of the beta phase (expected mid-December 2026) or when you decide to leave the beta test.

There is no newsletter, no advertising and no sharing for marketing purposes.

An account is only created once you accept the invitation. From then on, the community privacy policy applies; I will send it to you with the invitation.

3. Visiting the website

a) Server log files

On every request the web server processes technically necessary data:

• date and time of the request
• requested address (URL) and HTTP status code

Purpose: delivering the website, detecting and preventing abuse and attacks, troubleshooting. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is a secure and stable service. Log files are deleted after 30 days, unless a specific security incident requires keeping individual entries until it has been resolved.

b) Cookies and local storage

I use no tracking, no third-party analytics and no advertising cookies. That is why there is no cookie banner.

At most the following is stored:

• NEXT_LOCALE: remembers your chosen language (English or German).

This storage is strictly necessary to show the site the way you asked for (Section 25(2) no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act). The legal basis for the related processing is Art. 6(1)(f) GDPR.

c) Fonts

All fonts are served from my own server. Loading a page does not contact Google Fonts or any other font provider.

4. Signing up for the closed beta

a) Which data

• name (required; used to address you in the confirmation and the invitation)
• email address (required)
• Instagram handle (optional)
• why you want to join and which materials and tools you work with (required, free text)
• whether you are available for a short video call (optional)
• your promise to give feedback through the feedback form (required)
• your consent to the terms
• chosen language, so the emails reach you in your language
• time of sign-up and of confirmation
• IP address at the time of sign-up

b) Double opt-in

After you submit the form, you receive an email with a confirmation link. You are only on the list once you click it. This makes sure nobody signs up someone else's address. The link is valid for 7 days. The system stores only a hash of the link, not the link itself.

I keep the IP address only until you confirm, so that misuse of the form can be traced; it is deleted on confirmation. To prevent mass sign-ups I also limit the number of sign-ups per IP address and per email address; these counters expire after at most 24 hours.

The form also rejects links in the name and free-text fields, and addresses from known disposable email providers. Both checks run on my own server against a list contained in the software; no third party is involved. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is keeping spam and throwaway addresses off the list.

c) Purpose and legal basis

I process your data to send you the confirmation email and, when the beta starts, the invitation, possibly followed by one reminder if you have not accepted it yet. Because places in the beta are limited, I also use your answers and, where given, your Instagram profile to choose whom to invite; where you offered one, I arrange a short video call. The legal basis is your consent (Art. 6(1)(a) GDPR).

Abuse prevention (IP address, counters) is based on Art. 6(1)(f) GDPR; my legitimate interest is protecting the form against automated and third-party sign-ups.

d) Withdrawing consent

You can withdraw your consent at any time with effect for the future, for example with a short email to unsubscribe@offcuts.work. I will then delete your sign-up. Processing carried out before the withdrawal remains lawful.

e) Retention

Unconfirmed sign-ups are deleted automatically 30 days after the last confirmation link was sent.

Confirmed sign-ups are deleted once you have created an account, when you withdraw consent, or at the latest six months after the closed beta starts.

Proof of your consent (email address, time of sign-up and confirmation, and time of acceptance of the terms) is kept for up to three years after the end of the year in which the consent ends, so I can show that I only wrote to you with your consent (Art. 6(1)(c) in conjunction with Art. 5(2) and Art. 7(1) GDPR, and Art. 6(1)(f) GDPR). I do not use this record for anything else.

5. Contact by email

If you email me, I process your address and the content to answer your request (Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR for contract-related requests). I delete the correspondence once your request is settled and no statutory retention duty applies.

6. Recipients

I do not sell your data or share it for marketing. Only I and the following service providers, who act on my behalf and under my instructions (processing on behalf under Art. 28 GDPR), have access:

Hosting:
netcup GmbH
Emmy-Noether-Straße 10
76131 Karlsruhe (Germany)
Server locations: Vienna and Nuremberg

Email delivery:
Confirmation and invitation emails are sent through this service.
Scaleway SAS
8 rue de la Ville-l’Évêque
75008 Paris (France)

I also disclose data to authorities or courts where I am legally required to.

7. Transfers to third countries

In this phase your data is processed only within the European Union. If that changes, I will inform you beforehand and put appropriate safeguards in place under Art. 44 et seq. GDPR.

8. Your rights

Where the legal requirements are met, you have the right to

• access the data stored about you (Art. 15 GDPR),
• have inaccurate data corrected or incomplete data completed (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdraw consent with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): Where I process data based on Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. I will then stop processing that data unless I can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

An email to legal@offcuts.work is enough for any of these requests.

Right to lodge a complaint: You can complain to a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for me is:

Landesbeauftragte für Datenschutz und Informationsfreiheit
Nordrhein-Westfalen
Postfach 20 04 44
40102 Düsseldorf

9. Obligation to provide data and automated decisions

You are not obliged to give me any data. A sign-up, however, requires your name, your email address, the two free-text answers, your promise to give feedback and your consent to the terms and this notice; without them I cannot consider you for the beta. Your Instagram handle and whether you are available for a video call are optional.

There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.

10. Changes

When the community launches, the processing changes. I will publish the new version on this page and send it to you with the invitation.