Website & free waitlist
OCTO Privacy Policy
1 Who we are
This policy covers octo-tool.com, our free waitlist, marketing emails and contact with us. We will provide separate privacy information before introducing product accounts, uploads, AI chats or payments.
Axel Van Mechelen and Robbe Heynderickx operate as OCTO and are joint data controllers. Contact: admin@octo-tool.com, Isabellakaai 60, 9000 Ghent, Belgium. Axel coordinates privacy information and requests; Robbe coordinates security, suppliers and deletion. You may exercise your rights against either founder and request information about our joint arrangement.
2 What data we use and why
2.1 Website and cookies
We receive data from you, your browser and our email providers’ delivery records. We use IP addresses, device details, requests and error or security records to operate the website, deliver emails and prevent abuse. Legal basis: legitimate interests (Article 6(1)(f) GDPR). Logs are kept for up to 30 days, longer only for a specific incident or dispute.
Necessary cookies support only the requested function. Our preference cookie remembers your choice; this processing supports our legal obligations concerning consent (Article 6(1)(c) GDPR). Google Analytics 4 (GA4) is off by default and requires separate consent (Article 6(1)(a) GDPR).
| Cookie / provider | Purpose | Lifetime / choice |
|---|---|---|
| cookie_consent — OCTO | Remembers acceptance or rejection, time and policy version. | 6 months after an explicit choice; necessary. |
| _ga — Google via OCTO | Distinguishes browsers for analytics. | 6 months from initial setting; consent required. |
| _ga_<id> — Google via OCTO | Stores session identifiers and timing. | 6 months from initial setting; consent required. |
Ordinary revisits do not extend these periods.
Cookie details: domain octo-tool.com, path /. The <id> suffix identifies the GA4 measurement container.
Other necessary login or security cookies: [NAME, PROVIDER, PURPOSE, DATA, DOMAIN, PATH AND LIFETIME — OR NONE]. They are exempt from consent only where strictly necessary. Joining the waitlist does not create a product account.
Our banner makes accepting and rejecting analytics equally easy. Change or withdraw your choice through “Cookie settings” in the website footer at any time, without losing access. Browsing or accepting terms is not consent. Your choice applies to this browser and device; we ask again when it expires.
GA4 measures visits and interactions using pseudonymous browser and session identifiers, pages, referral details, timestamps, browser, device category, language and approximate region. Google uses IP addresses to derive location but, according to its documentation, does not store them in GA4. These data are not anonymous. We do not use advertising features, link analytics to waitlist records or send names, email addresses or form content to GA4.
We block Analytics requests, including cookieless signals, before consent and after rejection or withdrawal.
Withdrawal stops new measurement and removes the GA cookies we control; it does not automatically erase previously collected data. You can ask us to delete those data, supplying your browser identifier if needed. You can also delete cookies in your browser settings.
2.2 Waitlist and optional answers
With your consent, we use your email address, registration time, status and optional name to register you, confirm your registration and send the availability notification you requested. Providing your email is voluntary but necessary to join. The waitlist is for people aged 16 or over; we remove registrations identified as being below that age.
Your name, education level and “How did you find us?” answer are optional. With your consent, we use education level to plan introductory groups and referral information to improve our communication. You can have these answers removed separately. Legal basis: Article 6(1)(a) GDPR.
Retention: until withdrawal, closure of the waitlist or 31 January 2027, whichever comes first; deletion or irreversible anonymisation within 30 days. Continuing beyond that date requires a new choice. Registration does not automatically become a product account.
2.3 Contacting us
We use your contact details and message to handle enquiries: legitimate interests (Article 6(1)(f) GDPR), or Article 6(1)(b) for steps you request before entering a contract. Retention: up to 12 months after resolution, except for a specific legal obligation or dispute.
2.4 Marketing emails
We use your email address, optional name and preferences only after separate, confirmed consent (Article 6(1)(a) GDPR). Joining the waitlist does not subscribe you automatically. We do not measure individual email opens or clicks to create marketing profiles.
Retention: until unsubscribe, objection, the end of marketing activity or 24 months after your last explicit confirmation, whichever comes first. Sending stops immediately; we delete the active profile within 30 days. Unconfirmed links expire after 14 days; we delete the application within 30 days afterwards.
2.5 Analytics retention
GA4 user and event data: two months, without resetting on new activity, subject to Google’s monthly deletion cycle. Aggregated standard reports fall outside this setting: we retain them while needed to improve the website, review this annually and delete the property when that purpose ends. Browser cookie lifetimes are in 2.1.
2.6 Evidence and other retention periods
Limited records of choices, consent and privacy requests support legal obligations (Article 6(1)(c) GDPR).
We document acceptance of terms, age declarations and necessary legal claims on the basis of legitimate interests (Article 6(1)(f)). Retention: as needed, normally up to three years after participation or consent ends, or a request is resolved; longer only for a specific legal requirement or claim.
Minimal suppression records prevent unwanted emails while the mailing activity and risk of reimport continue, with annual review. Deleted data may remain in protected OCTO backups for up to 90 additional days; we reapply deletions after restoration. Following withdrawal, we erase identifiable data without undue delay where no other legal basis permits retention. Truly anonymous statistics may be kept longer.
3 Security and automated decisions
We use encrypted connections, restricted access and procedures for deletion and incidents. We do not make solely automated decisions with legal or similarly significant effects or create behavioural advertising profiles.
4 Service providers and data sharing
We do not sell personal data. Authorised people and processors receive access only for their tasks, subject to confidentiality and data processing agreements where required. We share necessary data with advisers or authorities where a legal matter or obligation requires this.
Hosting and security: Cloudflare (Pages and Turnstile) — website requests and technical data. Email: Brevo — contact details, content and delivery records. Forms and database: Supabase — submitted data and registration and consent records.
Analytics: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, with Google LLC and authorised subprocessors. Google processes the data in 2.1 under its data processing terms. Optional sharing for Google products and advertising integrations are disabled. See Google’s data use information and processing terms. Those terms provide for applicable deletion instructions to be carried out as soon as reasonably practicable, within a maximum of 180 days, unless retention is legally required.
4.1 International transfers
Locations and transfer safeguards for hosting, email and database providers: [COMPLETE FOR EACH PROVIDER]. Google may process data in the United States and other countries where its subprocessors operate, including for support.
Transfers to Google LLC covered by its active EU-US Data Privacy Framework certification rely on the corresponding adequacy decision. Where this does not apply, we use applicable Standard Contractual Clauses, with the required assessment and supplementary measures. See Google’s transfer arrangements and subprocessors. Request information or a copy of relevant safeguards at admin@octo-tool.com. Cookie consent does not replace these safeguards.
5 Your rights and choices
Subject to GDPR conditions, you may request access, correction, deletion, restriction and data portability.
You may object to processing based on legitimate interests for reasons relating to your situation, and object to direct marketing at any time.
You can withdraw consent at any time without affecting the lawfulness of earlier processing. Use “Cookie settings” for analytics and the unsubscribe link for marketing. Through email preferences or admin@octo-tool.com, you can leave the waitlist, remove optional answers or stop marketing. These choices are separate; you may also stop all emails.
Send requests to admin@octo-tool.com or our address in section 1. We normally respond free of charge within one month. If a permitted extension of up to two additional months is needed, we tell you within the first month. If we reasonably doubt your identity, we request only the information needed to confirm it.
6 Contact and complaints
Contact: admin@octo-tool.com. You may also complain directly to the Belgian Data Protection Authority, another competent EEA supervisory authority, or seek a judicial remedy.
We date changes to this policy and notify you of material changes. We seek fresh consent for a new purpose where required.