Privacy notice

Last updated: 2026-10-29

This notice explains which personal data Bardach Technologies LLC ("we", "us") processes when you visit https://aerialgrade.bardach-technologies.com/ (the "Site"), a test page for the planned product Aerialgrade, and what rights you have. We are a company in the United States, and the Site is not directed at people in the European Union. We still describe our processing in the terms of the EU General Data Protection Regulation ("GDPR"). The rights in section 5 are open to every visitor, wherever they live.

1. Who is responsible (controller)

Bardach Technologies LLC, limited liability company (USA), 30 N Gould St, Ste R, Sheridan, WY 82801, USA (office of our registered agent; our legal and service address). E-mail: [email protected].

Representative in the EU under Art. 27 GDPR: None appointed: this test page is not directed at the EU market (decision D-103).

We have not appointed a data protection officer. Art. 37(1) GDPR does not require one for the processing described here.

2. What we process, why, and on which legal basis

2.1 Visiting the Site (hosting)

When you open a page, our hosting provider Cloudflare, Inc. (Pages and Workers) processes your IP address, the requested address, the time, your browser's user agent and the referring page, to deliver the page and protect it against attacks. The provider does this on our behalf. For data it uses for its own purposes, such as running and securing its network, it is responsible itself under its own privacy policy. We do not use these data to identify visitors, and we do not combine them with other data. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Retention: the provider keeps the data it processes for us only as long as it needs them to provide its service to us, and at the latest until our contract with it ends. Data it uses for its own purposes it keeps as its own privacy policy describes.

2.2 Counting visits without cookies

We count visits on our own server (a Cloudflare Worker operated by us), from the requests it answers anyway. The Site has no counting script, sets no cookies and stores nothing on your device. The server counts when it delivers a page, when you follow the page's main button or another counted link, and when you send the sign-up form. For this it uses what your browser sends with each request: the address requested (including a campaign tag such as utm_source, if the link you followed had one), the referring page and your browser's user agent. For each count it stores only: whether the visit is live, a test run of ours or automated; the page; the event; one source; the day; the country the request came from, as our hosting provider's network reports it (only the two-letter country code, not your address or location); and whether the browser is a phone, a tablet or a computer. The source is the campaign tag of the link you followed if it is one of the channel tags we set up for that page, otherwise "other". Without a campaign tag, the source is only the domain of the referring website, otherwise "direct". The user agent is used only to label automated visits and the device type and is discarded once the request is answered. We do not store your IP address, your user agent or the full referring address, and we do not build a profile of you. To count each visitor only once per day, the server computes a one-way code from the network address and browser type that changes every day, keeps only that code until the end of the next day, and never stores the address itself. Legal basis: our legitimate interest in measuring whether the planned product is wanted before we build it (Art. 6(1)(f) GDPR). This counting reads nothing from your device and stores nothing on it, so it needs no consent and the Site shows no cookie banner.

2.3 Registering your interest (if you use the form)

If you enter your e-mail address and tick the consent box, our server computes a keyed one-way hash of your address (HMAC-SHA-256 with a secret key). It stores the hash, the exact consent text you agreed to, the time, whether the sign-up was live, a test run of ours or automated, one source (as in 2.2), the deletion date and, if you chose one, your answer to the optional question. Your e-mail address itself is not stored. We use this only to count unique sign-ups for this test. Because we keep no address, we will not send you e-mails from this test. We treat the hash as personal data. It is pseudonymous: we hold the key, so we can match the hash to an address you give us again (see 5), but we cannot turn the hash back into an address. Legal basis: your consent (Art. 6(1)(a) GDPR). Giving your address is voluntary; if you do not, your interest is simply not counted. You can withdraw your consent at any time with effect for the future (see 5).

We do not use your data for automated decisions that have legal or similarly significant effects on you (Art. 22 GDPR), we do not sell it and we do not use it for advertising.

3. Recipients and transfers outside the EU

Recipients are our hosting and counter provider Cloudflare, Inc. (Pages and Workers), each bound by a data processing agreement or acting under its own terms. Bardach Technologies LLC is based in the United States, so the data you send through the Site reach us there directly. Our providers may also process data in the United States and in other countries. Where a provider is certified under the EU-U.S. Data Privacy Framework, transfers to it rely on the European Commission's adequacy decision for that framework (Decision (EU) 2023/1795); otherwise they rely on the EU Standard Contractual Clauses in that provider's terms (Art. 46(2)(c) GDPR). We have not certified ourselves under the Data Privacy Framework.

4. How long we keep data

Each sign-up record is deleted automatically at the end of 2027-01-31 (UTC), the deletion date stated in the consent text. The server refuses a sign-up without such a date. The daily totals in 2.2 contain no IP address, user agent, hash or e-mail address and relate to no person; we keep them as anonymous statistics.

5. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). Where we rely on your consent, you can withdraw it at any time; withdrawal does not affect processing before it.

Because we keep only a hash, we cannot find your sign-up unless you tell us the e-mail address you used: write to [email protected]. If you write from a different address, we first ask you to confirm the request from the address you signed up with. We then compute the hash, show you or delete the matching records as you ask, and afterwards discard the address you sent.

You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work or where you think the infringement took place.

6. Changes

We will update this notice if the Site or the data flows change and show the new date at the top.

Adapted from the General Legal GDPR privacy policy template (CC0 1.0) for a cookie-less test page of a US company. The points flagged for review in this template were resolved against dated primary sources. This text is not legal advice, and no lawyer has reviewed it.

This template was prepared and made publicly available by General Legal, PC ("General Legal"). It is provided for general reference purposes only and does not constitute, and should not be construed as, legal advice, or an endorsement or review of any particular transaction in which it is used. Use of this template does not create an attorney-client relationship with General Legal. General Legal has not reviewed, and takes no position on, any modifications made to this document or the deal terms it is used to document.