eatdrink.atDeutsch

Privacy Policy

Last updated: October 27, 2026

This privacy policy covers the eatdrink.at website. Until launch, the site introduces eatdrink.at and takes signups for the waitlist. Below you’ll find what data that involves, what we use it for and what rights you have.

Who is responsible

The company responsible for your data (the controller) is Unbogify GmbH, Zelterstr. 10, 10439 Berlin, Germany. eatdrink.at is a product of Nightly Build Group, operated by Unbogify GmbH. For any privacy question, email legal@nightlybuildgroup.com.

Hosting

The website runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data center in Germany. Hetzner processes the data on our behalf under a data processing agreement (Art. 28 GDPR).

Server logs

Every time the website is requested, our server writes an entry to a log. Each entry holds:

  • your IP address
  • the date and time
  • the address requested (domain and path), including any parameters in the link
  • the status code and size of the response
  • your browser’s identifier (user agent)
  • the page you came from (referrer)

We process this data to deliver the website, keep it secure and track down errors. We also use it to count how many visits each ad or campaign brings in. For that, the links in our ads carry UTM parameters (such as utm_source or utm_campaign). This shows us which ads work without storing anything in your browser or loading a tracking script. Legal basis: our legitimate interest in running the website securely and reliably, and in this count (Art. 6 (1)(f) GDPR).

We start a new log every day and delete each one after 14 days.

Cookies and tracking

eatdrink.at itself sets no cookies. We use no analytics tools, no tracking pixels and no scripts from ad networks. Our fonts come from our own server too, so your browser never contacts Google Fonts or any other font service. A third-party service loads only when you use the signup form: the bot check Cloudflare Turnstile, described below.

The waitlist

To join the waitlist, you enter your email address. After you sign up, you can tell us more about your venue if you like: its name, its city and its type (restaurant, café, bar, pub or inn, wine tavern, hotel or something else).

With your entry, we also store:

  • the language of the page you signed up on
  • when you signed up, when we sent you the confirmation email, when you confirmed and when you told us about your venue
  • which version of the consent text you saw
  • where your visit came from: the UTM parameters of the link you followed (that is, which ad or campaign) and the domain of the site that sent you to us

We use this data to:

  • email you about the launch of eatdrink.at and our founding offer (the first 25 venues to subscribe pay half price for as long as their subscription runs)
  • ask whether your venue would like to be one of those founding venues
  • see which ads lead to signups

We need your email address to put you on the list. Everything about your venue is optional.

Consent and confirmation

The legal basis for the waitlist and our emails is your consent (Art. 6 (1)(a) GDPR). So that nobody can sign up someone else’s address, we ask twice (double opt-in): after you sign up, we email you a confirmation link, and only once you click it are you on the list.

We record when you signed up and confirmed, and which version of the consent text you saw, so that we can prove you consented. Art. 7 (1) GDPR requires us to be able to do so. The legal basis for keeping this record is our legitimate interest in being able to prove your consent (Art. 6 (1)(f) GDPR).

Where your visit came from (the UTM parameters and the domain) we store based on our legitimate interest in knowing which ads lead to signups (Art. 6 (1)(f) GDPR).

Unsubscribing

You can withdraw your consent at any time, with the unsubscribe link in any of our emails or by writing to legal@nightlybuildgroup.com. We then mark your address as unsubscribed and send you nothing more. On request, we delete it entirely. A withdrawal applies from then on; it does not affect what we did with your consent before.

How long we keep your entry

  • Signups you don’t confirm are deleted at the latest 30 days after our last confirmation email.
  • Confirmed entries stay until you withdraw your consent or we discontinue the waitlist.
  • After a withdrawal, your entry stays on file as unsubscribed, together with the record of your consent. On request, we delete it entirely.

Where your data is stored

We keep the waitlist in our own email system (useSend), which runs on a server of Hetzner Online GmbH in the EU. To send the emails, we use Amazon Simple Email Service (SES) by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, in the AWS Frankfurt region (eu-central-1). Amazon Web Services sends the emails on our behalf.

Amazon Web Services, Inc. (USA) is certified under the EU-U.S. Data Privacy Framework. We cannot rule out that data is transferred to the USA in the process; for certified companies, the European Commission’s adequacy decision applies (Art. 45 GDPR).

Abuse protection

To keep the signup form from being abused, our application holds IP addresses, and email addresses as a keyed hash rather than in plain text, in memory (never on disk) for up to 10 minutes after the last attempt, and uses them to limit repeated attempts. Legal basis: our legitimate interest in protecting the form from abuse (Art. 6 (1)(f) GDPR).

Bot protection: Cloudflare Turnstile

To keep bots off the waitlist, we use Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Turnstile loads only once you start using the signup form, not when the page opens. It then checks, usually unnoticed in the background, whether a person or a program is filling in the form.

To do this, Cloudflare processes your IP address and technical characteristics of your browser and your connection, such as your browser’s identifier (user agent). Turnstile also runs small tests in your browser that pick up browser quirks and human behavior. It does not read what you type into the form. For the check, Turnstile may store and read information in your browser, for example in cookies or in your browser’s local storage.

Legal basis: our legitimate interest in protecting the form from spam and abuse (Art. 6 (1)(f) GDPR). Turnstile stores or reads information in your browser only as far as that is strictly necessary for the form you are using (§ 165 (3) TKG 2021 in Austria, § 25 (2) no. 2 TDDDG in Germany).

For the check, Cloudflare acts on our behalf. Cloudflare also uses the data on its own responsibility to improve Turnstile’s bot detection, relying on its own legitimate interest. Cloudflare is certified under the EU-U.S. Data Privacy Framework, so the European Commission’s adequacy decision covers transfers to the USA (Art. 45 GDPR). Cloudflare describes what Turnstile processes in its Turnstile Privacy Addendum: https://www.cloudflare.com/turnstile-privacy-policy/

Who receives your data

We do not sell your data. Apart from us, only the service providers named above receive it: Hetzner (servers for the website and our email system), Cloudflare (bot protection) and Amazon Web Services (sending emails).

Your rights

Under the GDPR, you have the right to:

  • access the data we hold about you (Art. 15 GDPR)
  • have incorrect data corrected (Art. 16 GDPR)
  • have your data erased (Art. 17 GDPR)
  • restrict how we process your data (Art. 18 GDPR)
  • receive your data in a common, machine-readable format (Art. 20 GDPR)
  • withdraw your consent at any time, with effect for the future (Art. 7 (3) GDPR)

Where we process data based on our legitimate interest, you can also object on grounds relating to your particular situation (Art. 21 GDPR). This covers the server logs, where your signup came from, abuse protection, bot protection and the record of your consent.

To exercise any of these rights, email legal@nightlybuildgroup.com.

Complaints

You can lodge a complaint with a data protection authority (Art. 77 GDPR). The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59-61, 10555 Berlin, Germany. You can also contact the authority in the country where you live or work. In Austria, that is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna.

No automated decisions

We make no automated decisions about you within the meaning of Art. 22 GDPR, and we do not profile you.

Back to the home page