Privacy Policy

This policy provides information about the processing of personal data when you visit this website, sign up for our waitlist, and contact us via the contact form. We process only data that is necessary for the stated purposes.

When you sign up for the waitlist, we process your email address, the language of the page on which you sign up (German or English), and a record of your consent (timestamp and version of the consent text). The purpose is managing the waitlist and notifying you about the launch of Migora in your language.

Health context (Art. 9 GDPR): Since Migora is a migraine product, your sign-up may reveal health-related information. The legal basis is your explicit consent pursuant to Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR.

Double opt-in: After you sign up, we send you an email with a confirmation link. Your sign-up only becomes effective once you click it. This is how we make sure the address really belongs to you.

Storage period: We store your data until you withdraw your consent, but no longer than 24 months after sign-up. If the project is discontinued, the data will be deleted.

Withdrawal: You can withdraw your consent at any time with effect for the future, via the unsubscribe link in every email or by sending us a message (see Controller). The lawfulness of the processing carried out before the withdrawal remains unaffected.

If you write to us via the contact form, we process the data you provide (optionally your name, your email address, the subject, and your message) solely to handle your inquiry.

The legal basis is our legitimate interest in responding to your inquiry (Art. 6(1)(f) GDPR) or, where your inquiry concerns Migora as a product, the initiation or performance of a usage relationship (Art. 6(1)(b) GDPR).

Health context (Art. 9 GDPR): If you voluntarily share health data in your message (for example, about your migraine), it is processed on the basis of the consent you give by submitting the message (Art. 9(2)(a) GDPR). Please share only what is really necessary.

We use Resend to deliver the message (see the “Email Delivery” section). We store your inquiry until it has been fully handled and delete it afterwards, unless statutory retention obligations require otherwise.

To prevent automated misuse (spam) of our forms, we process your IP address and store it exclusively as a salted, irreversible hash, never in plain text. The legal basis is our legitimate interest in a functional, abuse-resistant service (Art. 6(1)(f) GDPR).

This website is hosted by Vercel Inc. (USA). When the site is accessed, technically necessary access data (including IP address, time, requested resource) is processed. A transfer to the USA (third country) takes place; we base this on appropriate safeguards under Art. 46 GDPR (standard contractual clauses) or on certification under the EU-US Data Privacy Framework. Vercel acts as a processor. Legal basis: Art. 6(1)(f) GDPR.

We store the consent record (see Waitlist Sign-up) in a database at Supabase (Supabase, Inc.). The database is hosted in the EU (Frankfurt region). We store only your email address, the consent record (timestamp and version), and, where applicable, a salted IP hash. Supabase acts as a processor on our behalf; where a transfer to a third country occurs, we base it on standard contractual clauses (Art. 46 GDPR). Legal basis: your consent (Art. 6(1)(a), Art. 9(2)(a) GDPR).

We use Resend (Resend, Inc., USA) to send the confirmation, waitlist, and contact-form emails and to manage the waitlist contacts. The respective contents (including your email address and, for contact inquiries, also your name and message) are transmitted to Resend (third-country transfer to the USA); we base this on standard contractual clauses (Art. 46 GDPR) or the EU-US Data Privacy Framework. Resend acts as a processor on our behalf. Legal basis: your consent or our legitimate interest (Art. 6(1)(a)/(f), Art. 9(2)(a) GDPR).

With your consent, we use Vercel Web Analytics(operated by Vercel Inc., USA) as a processor for audience measurement. It records page views, referral sources, country, device type and browser, without cookies and without tracking you across websites. To tell repeat views within a single day apart, Vercel derives a hash value that changes daily from technical details such as IP address and browser identifier; the IP address itself is not stored for this purpose. Data you enter, such as your email, is not transmitted to Vercel Web Analytics. As with hosting (section 5), a transfer to the USA (third country) takes place; we base this on standard contractual clauses (Art. 46 GDPR) or on certification under the EU-US Data Privacy Framework. Measurement is loaded only after your active consent in the cookie notice; if you decline or withdraw, no measurement takes place. Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) of the German TDDDG).

If you choose a language using the language switcher, we store this choice in a cookie named “migora.locale” (content only “de” or “en”, duration 12 months). It is technically necessary so that the site appears in the language you chose, and is not used for analytics (Section 25(2) No. 2 of the German TDDDG).

Under the GDPR, you have the following rights:

• Access to the data stored about you (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Objection to processing (Art. 21)

You also have the right to withdraw consent you have given at any time (Art. 7(3)) and the right to lodge a complaint with a data protection supervisory authority (Art. 77). One competent authority is the Hamburg Commissioner for Data Protection and Freedom of Information (Hamburgischer Beauftragter für Datenschutz und Informationsfreiheit).

We will update this privacy policy if the processing changes (for example, if audience measurement is added). The current version published here applies.