VolaLabs→Book a Call

Privacy Policy

Last updated: August 28, 2026

1. Controller

The controller responsible for data processing on this website within the meaning of Art. 4(7) GDPR is:

VolaLabs GmbH
Sonnenstraße 8
15370 Petershagen
Germany

Represented by Managing Director Mike Beckhusen.
Email: mbeckhusen@volalabs.de

2. Overview

This website does not set advertising cookies and does not build cross-site profiles. We collect as little personal data as possible. The only optional cookies we set are for product analytics (section 4), and they are set solely if you consent. This policy explains what data is processed when you visit this website, who processes it on our behalf, and what rights you have.

3. Hosting & Server Logs

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA, acting as our processor under Art. 28 GDPR. When you visit this site, Vercel automatically collects and stores information in server log files that your browser transmits, including:

  • IP address
  • Browser type and version
  • Operating system
  • Referrer URL
  • Date and time of access

This data is processed on the basis of Art. 6(1)(f) GDPR (legitimate interest) to ensure the secure and reliable operation of the website. Server logs are automatically deleted after 30 days. Processing may involve a transfer to the United States; see section 7 for the safeguards that apply.

4. Analytics & Performance Measurement

We use Vercel Web Analytics and Vercel Speed Insights (Vercel Inc.) to measure aggregate page views and page-loading performance. Vercel Web Analytics further processes interaction data, in particular the use of links and interface elements and the outcome of form submissions. Such data is recorded without reference to an identified or identifiable natural person; content you enter into forms is not transmitted. These tools do not set cookies and do not track you across websites. Measurement data is aggregated and is not used to identify individual visitors. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in understanding how our site is used and in a functioning, performant website).

We also use Umami (Umami Software, Inc., EU data region) to measure page views, referrers, browser and device type, country, and average visit duration. Umami sets no cookies and stores nothing on your device, does not use fingerprinting, and does not track you across websites. IP addresses are not stored; they are hashed in memory and the hash salt is discarded daily. Because no information is stored on or read from your device, section 25 TDDDG does not apply and no consent is required. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in understanding how our site is used).

With your consent, we additionally use Microsoft Clarity (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) to understand how visitors use this site. Clarity produces heatmaps and session replays: a reconstruction of your visit including mouse movement, clicks, scrolling and the pages you viewed. Text you enter into forms is masked before it leaves your browser, and we operate Clarity in strict masking mode.

Clarity sets the following first-party cookies:

  • _clck— retains a Clarity visitor identifier so that two visits from the same browser are attributed to the same user; expires after 1 year
  • _clsk— links the page views of a single visit into one replay; expires after 1 day

The legal basis is Art. 6(1)(a) GDPR(consent), together with section 25(1) TDDDG for the storage of and access to information on your device. Clarity is loaded only after you accept it in the consent banner — if you decline, or have not yet chosen, no Clarity script is requested and no Clarity cookie is set. You may withdraw your consent at any time with effect for the future via the Cookie settings link in the footer; withdrawal does not affect the lawfulness of processing carried out beforehand. Clarity data is retained by Microsoft for a maximum of 30 days.

5. Contact Form

If you contact us via the contact form, we process your name, email address, company, topic, and message. To prevent abuse we additionally store a one-way hash of your IP address and your browser user-agent string. This data is processed solely to respond to your inquiry, based on Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in preventing spam and abuse). The IP address itself is processed only transiently for rate limiting and is never stored in plain form. Your submission is deleted once your inquiry has been fully resolved and no retention obligation applies.

6. Email Enquiries and Document Requests

If you ask us for sample data, documentation or a walkthrough of the service, we process your email address and any business context you provide (firm name, role), together with a hashed IP address and user-agent for abuse prevention. This data is used solely to answer your request and to contact you about onboarding to the service. Processing is based on Art. 6(1)(b) GDPR (pre-contractual measures) and your consent per Art. 6(1)(a) GDPR. You may withdraw consent at any time with effect for the future, without affecting the lawfulness of processing carried out before withdrawal — use the unsubscribe link in any email or write to us directly. Records are retained for as long as necessary to onboard you to the service or until you request deletion. After withdrawal of consent or unsubscribe, records are deleted within 30 days. As with the contact form, the IP address itself is processed only transiently for rate limiting and is never stored in plain form.

7. Processors

We use the following service providers, each engaged as a processor under Art. 28 GDPR:

  • Vercel Inc.(USA) — website hosting, server logs, analytics and performance measurement
  • Umami Software, Inc.(EU data region) — cookieless traffic analytics
  • Microsoft Ireland Operations Limited(Ireland) — product analytics, heatmaps and session replay (Clarity), only with your consent
  • Supabase, Inc.(USA) — database storage for contact submissions
  • Resend, Inc.(USA) — transactional email delivery
  • Upstash, Inc.(USA) — rate limiting to protect our forms from automated abuse

These providers are established in the United States and may process data there. Where a transfer outside the European Economic Area takes place, it is based on the data protection terms of the respective provider, including the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR where these form part of those terms. We do not sell personal data and do not share it with third parties for their own purposes.

8. Nature of the Service

VolaLabs is a market data provider. We do not collect, process, or store any trading activity, position data, or financial account information from our customers. The data we publish is one-way: from our infrastructure to your systems.

9. Your Rights

Under the GDPR, you have the right to:

  • Access the personal data we hold about you (Art. 15)
  • Rectification of inaccurate or incomplete data (Art. 16)
  • Erasure of your data (Art. 17)
  • Restriction of processing (Art. 18)
  • Be informed of recipients to whom rectification, erasure, or restriction has been communicated (Art. 19)
  • Data portability (Art. 20)
  • Object to processing based on legitimate interest (Art. 21)

To exercise any of these rights, please contact us at mbeckhusen@volalabs.de.

10. Right to Lodge a Complaint

Without prejudice to any other remedy, you have the right under Art. 77 GDPR to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement. The authority responsible for us is:

Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg
Stahnsdorfer Damm 77
14532 Kleinmachnow
Germany

11. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated revision date.