Privacy Policy
Last updated: October 2026
1. Controller
Lulaa Technologies GmbH, Kolonnenstraße 8, 10827 Berlin, Germany. Managing Directors: Maxim Boelter, Klaus H. Wilch. Email: info@getlulaa.com.
This policy covers our website www.getlulaa.com. We have not appointed a data protection officer. Please send privacy questions to info@getlulaa.com.
2. Hosting
The website runs on Cloudflare Workers (Cloudflare, Inc., USA). When you visit, Cloudflare processes technical data such as your IP address, the requested address, the time, and browser and device information to deliver the pages and protect them from attacks. We keep no access logs ourselves.
The legal basis is our legitimate interest in a secure and reliable website (Art. 6(1)(f) GDPR). Cloudflare processes the data on our behalf and only for as long as delivery and security require.
We serve fonts and scripts ourselves. Google Fonts and other external libraries are not loaded.
3. Analytics with PostHog
To understand how the website is used, we use PostHog (PostHog, Inc., USA) with data stored in the EU (Frankfurt). It records page views, clicks, scrolling and mouse movements for heatmaps, along with page, browser and device details. Clicks on our booking links are counted separately.
We run PostHog without cookies or local storage, so nothing is stored on your device. To count visits, PostHog builds a hash on its server from your IP address and browser identifier with a key that changes daily and is then deleted. Your IP address is not stored with the events, visits on different days cannot be linked, and no user profiles are created. Session recording is off, and contact form input is not captured.
The legal basis is our legitimate interest in improving the website (Art. 6(1)(f) GDPR). You can object at any time: if “Do Not Track” is turned on in your browser, analytics does not start. An email to info@getlulaa.com works too.
4. Contact form and email
When you write to us through the form or by email, we process your email address, your message and the details in it to answer your enquiry. Cloudflare delivers the form to us as an email. Our mailbox runs on Google Workspace (Google Cloud EMEA Ltd., Ireland). To prevent abuse, the form limits requests per IP address; the IP address is not stored permanently for this.
The legal basis is entering into or performing a contract (Art. 6(1)(b) GDPR), and for other enquiries our legitimate interest in answering them (Art. 6(1)(f) GDPR).
We delete enquiries no later than six months after they are resolved. We keep them longer only if they lead to a contract or statutory retention duties apply, such as for business correspondence under German commercial and tax law.
5. Booking and external links
Our booking links open Calendly’s website (Calendly LLC, USA). Calendly is not embedded in our pages; no data is shared until you open the link. If you book a meeting, Calendly and we process your details to organise it (Art. 6(1)(b) GDPR). Deletion follows the same rule as for enquiries.
Our product video opens on YouTube. No YouTube player is embedded. External websites are covered by their own privacy policies.
6. Service providers and transfers outside the EU
Cloudflare, PostHog, Google and Calendly process data on our behalf or as independent providers. We have data processing agreements under Art. 28 GDPR with our processors.
These providers are based in the USA or belong to US companies, so access from the USA cannot be ruled out. Transfers rely on the adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and on the European Commission’s standard contractual clauses (Art. 45 and 46(2)(c) GDPR). You can request a copy of these safeguards.
7. Your rights
You have the right to access, rectification, erasure, restriction of processing and data portability (Art. 15 to 20 GDPR). Write to info@getlulaa.com.
Right to object: where we process data based on our legitimate interest, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).
You can lodge a complaint with a data protection authority. Ours is the Berlin Commissioner for Data Protection and Freedom of Information.