The waitlist privacy notice

Last updated 1 November 2026. This covers the waitlist form and the emails that follow it. It is not the policy for the product, which does not exist yet.

Who is collecting this

AffinePath Ltd., registered in Uganda. We are the data controller, and there is no one else behind us deciding what to do with your address.

What the form collects

Your email address and one choice from a short list of roles. That is all. There is no name field, no company field and no phone number to leave blank by accident. The form carries two more things that are never kept: a hidden field that only a bot fills in, and the token the human check hands back.

What it is used for

One confirmation email when you join, occasional short notes before launch, and one email on the day we open. You agreed to that by joining, and you can withdraw it with one click at any time.

What we do not do

We do not sell your address, add it to third-party lists, or pass it to advertisers. No page here sets a cookie, stores anything in your browser or runs an analytics script. The only request the waitlist makes of us is the form submission itself.

Where your role choice goes

Nowhere. Your role is used to write the confirmation email and is then dropped. Only the address itself is stored, so the updates you receive are not currently matched to it. If you would rather we kept your role so they can be, say so when you reply.

Who else touches the data

Two companies, both named here on purpose. Cloudflare hosts this page and runs the check that tells a human from a script. Resend holds the list and sends the mail. Each of them uses its own downstream providers, which their own privacy documentation names.

Your IP address

We do not store it. Two requests do reveal it, because a browser has to make them before a page can look right or prove you are a person: the typefaces are fetched from Google and the human check is fetched from Cloudflare. Cloudflare also receives your IP when your submission is verified, which is how it separates a person from a script. Each of those companies keeps its own logs under its own policy.

Why your address is inside the unsubscribe link

The link in the email is signed for one address, so that a forwarded or altered link cannot unsubscribe somebody else. Your address is therefore part of the link itself, and anything in a link can end up in a server log. We would rather tell you than have you find out.

How long we keep it

Until you unsubscribe. After that the address stays on the list marked as unsubscribed, so that it cannot be added again by mistake. If you want it gone outright, email us and it is deleted. There is no automatic purge running, so we are not going to claim there is one.

Your rights

You can ask to see what we hold, have it corrected, have it deleted, or withdraw consent. One email to the address below does all of that. There is no self-service portal and no privacy request workflow, because there is one person here and he answers his own inbox. If we fail you, complain to your data protection authority.

Where the data lives

The list is held with United States based providers. We have not signed standard contractual clauses for it, and this page is not going to imply paperwork we do not have.

Children

This is a business product for people who run risk, compliance or continuity programmes. We do not aim it at anyone under 18 and we do not want their addresses.

Changes

If this notice changes, the date above changes with it. Read it again if the difference matters to you.

Contact

Write to holyaseamark@affinepath.com for anything in this notice, including a deletion request. Replies reach the founder directly.