Draft — pending legal review

Privacy notice for the waitlist

Last updated 20 October 2026 · SupportGenius is not built yet

The only thing this site asks you for is your email address, when you join the waitlist. This notice says what happens to it, and what the services that run the site and the waitlist do with your connection. The site sets no cookies of its own and runs no analytics.

1. Who is responsible

SupportGenius is a division of Factory Zero Pte. Ltd., Singapore (“we”), which is the controller of the personal data described here. Contact: [email protected]. Postal address on request.

2. What the waitlist stores

Joining the waitlist writes one entry to a database that only the waitlist uses. The entry holds these columns, and no others about you:

• email: the address you typed.
• email_normalized: the same address in lower case, so one address cannot join twice.
• product: always supportgenius.
• status: pending until you confirm the address, then confirmed.
• position: your place in the queue, set when you confirm.
• referral_code: a random code made for every entry. Referral credit is switched off.
• referred_by, referrals: empty and zero, because referral credit is switched off.
• answers: empty. The sign-up form asks no questions.
• created_at, confirmed_at: when you joined and when you confirmed.
• generation: a number that ties your confirmation link to your entry.

Two more tables hold data about the sign-up, not extra data about you. waitlist_send_cooldown keeps subject (your address and the product, so that we do not mail you more than once an hour) and last_sent_at. waitlist_position_lock keeps one row per product, with a counter for queue positions. We do not ask for your name.

3. What leaves us when you join

• The human check. The form runs Cloudflare Turnstile. It sends your IP address and a token from your browser to Cloudflare to check that a person is joining. Cloudflare may set its own cookies for that check.
• Rate limiting. Our Worker counts requests per IP address and per email address with Cloudflare’s Rate Limiting, allowing 10 requests a minute to each, to stop abuse. These counts are not written to the waitlist database.
• The confirmation email. Once a mail key is set on the waitlist Worker, we send one confirmation email to your address, from [email protected]. It is sent by Owlpost (owlpost.to), the mail service Factory Zero runs, or by Resend (resend.com) if only a Resend key is set. Until a mail key is set, no email is sent and your entry waits as pending.
• Launch email. When SupportGenius has something to use, we email the waitlist once, at the address you gave. Nothing else.

4. Who processes it

• Cloudflare, Inc.: hosts this site (Cloudflare Pages); delivers the film through Cloudflare Stream (its poster when the page loads, its video when you press play); runs the waitlist Worker and its D1 database; provides Turnstile and Rate Limiting. The Worker has request logging switched on, so Cloudflare may hold IP addresses in its logs.
• Owlpost (Factory Zero): sends the confirmation email, and the launch email when we send it.
• Resend: sends the confirmation email only if Owlpost is not set up and a Resend key is.

We do not sell personal data or share it for advertising. No other processor receives the waitlist.

5. The site itself

Typefaces are served from this site, so loading a page sends no request to Google or any other font provider. The site loads no analytics and no advertising trackers. Your IP address reaches Cloudflare, which hosts and protects the site, as it does for any site it serves. The film's poster and, once you press play, its video come from Cloudflare Stream, so your address reaches Cloudflare for those too.

6. How long we keep it

• Pending entries (not confirmed) are deleted 30 days after they last joined.
• Confirmed entries are kept until you ask us to remove you, or until 12 months after SupportGenius launches, or until you unsubscribe or ask us to delete them, whichever comes first.
• Send records (waitlist_send_cooldown) are deleted by a daily clean-up once they are more than two hours old.
• Email delivery records kept by Owlpost: the message and its delivery events are deleted 30 days after sending. A delivery record that holds no address or message content (only a hashed recipient) is kept for a further 30 days. This is Owlpost’s default window; a paid plan can set it up to 365 days.
• Cloudflare request logs: kept by Cloudflare for up to 7 days.

7. Your rights and how to use them

You can ask us for a copy of what we hold about you, ask us to correct it, object to how we use it, or ask us to delete it. For a waitlist entry, you can also withdraw your consent at any time. Write to [email protected] from the address on the list, or tell us the address if you cannot write from it. We can only find an entry by its address.

To remove you, we blank the address and answers in your entry and keep the row. That keeps the order of everyone else’s queue position and the referral codes others were given. If you are in the EU or UK, you can also complain to your local data protection authority.

8. Legal basis

Joining the waitlist and receiving the confirmation email rely on your consent, given when you confirm the address (Article 6(1)(a) of the GDPR). Rate limiting and the human check rely on our legitimate interest in keeping the waitlist working and free of abuse (Article 6(1)(f)).

9. Changes

We will update this notice before anything changes what we collect or who receives it. Until SupportGenius is built, this page is a draft, pending legal review.