VolaLabs

Privacy Policy

Last updated: August 28, 2026

1. Controller

The controller responsible for data processing on this website within the meaning of Art. 4(7) GDPR is:

VolaLabs GmbH
Sonnenstraße 8
15370 Petershagen
Germany

Represented by Managing Director Mike Beckhusen.
Email: mbeckhusen@volalabs.de

2. Overview

This website does not set advertising cookies and does not build cross-site profiles. We collect as little personal data as possible. This policy explains what data is processed when you visit this website, who processes it on our behalf, and what rights you have.

3. Hosting & Server Logs

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA, acting as our processor under Art. 28 GDPR. When you visit this site, Vercel automatically collects and stores information in server log files that your browser transmits, including:

  • IP address
  • Browser type and version
  • Operating system
  • Referrer URL
  • Date and time of access

This data is processed on the basis of Art. 6(1)(f) GDPR (legitimate interest) to ensure the secure and reliable operation of the website. Server logs are automatically deleted after 30 days. Processing may involve a transfer to the United States; see section 7 for the safeguards that apply.

4. Analytics & Performance Measurement

We use Vercel Web Analytics and Vercel Speed Insights (Vercel Inc.) to measure aggregate page views and page-loading performance. These tools do not set cookies and do not track you across websites. Measurement data is aggregated and is not used to identify individual visitors. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a functioning, performant website).

5. Contact Form

If you contact us via the contact form, we process your name, email address, company, topic, and message. To prevent abuse we additionally store a one-way hash of your IP address and your browser user-agent string. This data is processed solely to respond to your inquiry, based on Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in preventing spam and abuse). The IP address itself is processed only transiently for rate limiting and is never stored in plain form. Your submission is deleted once your inquiry has been fully resolved and no retention obligation applies.

6. Waitlist & Methodology Pack Requests

If you sign up for the VolaLabs waitlist or request the methodology pack, we process your email address and any business context you provide (firm name, role), together with a hashed IP address and user-agent for abuse prevention. This data is used solely to contact you about onboarding to the service or to deliver the requested document. Processing is based on Art. 6(1)(b) GDPR (pre-contractual measures) and your consent per Art. 6(1)(a) GDPR. You may withdraw consent at any time with effect for the future, without affecting the lawfulness of processing carried out before withdrawal — use the unsubscribe link in any email or write to us directly. Records are retained for as long as necessary to onboard you to the service or until you request deletion. After withdrawal of consent or unsubscribe, records are deleted within 30 days. As with the contact form, the IP address itself is processed only transiently for rate limiting and is never stored in plain form.

7. Processors

We use the following service providers, each engaged as a processor under Art. 28 GDPR:

  • Vercel Inc.(USA) — website hosting, server logs, analytics and performance measurement
  • Supabase, Inc.(USA) — database storage for contact and waitlist submissions
  • Resend, Inc.(USA) — transactional and waitlist email delivery
  • Upstash, Inc.(USA) — rate limiting to protect our forms from automated abuse

These providers are established in the United States and may process data there. Where a transfer outside the European Economic Area takes place, it is based on the data protection terms of the respective provider, including the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR where these form part of those terms. We do not sell personal data and do not share it with third parties for their own purposes.

8. Nature of the Service

VolaLabs is a market data provider. We do not collect, process, or store any trading activity, position data, or financial account information from our customers. The data we publish is one-way: from our infrastructure to your systems.

9. Your Rights

Under the GDPR, you have the right to:

  • Access the personal data we hold about you (Art. 15)
  • Rectification of inaccurate or incomplete data (Art. 16)
  • Erasure of your data (Art. 17)
  • Restriction of processing (Art. 18)
  • Be informed of recipients to whom rectification, erasure, or restriction has been communicated (Art. 19)
  • Data portability (Art. 20)
  • Object to processing based on legitimate interest (Art. 21)

To exercise any of these rights, please contact us at mbeckhusen@volalabs.de.

10. Right to Lodge a Complaint

Without prejudice to any other remedy, you have the right under Art. 77 GDPR to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement. The authority responsible for us is:

Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg
Stahnsdorfer Damm 77
14532 Kleinmachnow
Germany

11. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated revision date.