Privacy policy

Information pursuant to Art. 13 and 14 GDPR · Last updated: 18 August 2026

This English version is provided for convenience. Only the German version is legally binding.

This website is deliberately kept lean. For audience measurement we use Google Analytics, and Google Ads to measure how our ads perform — but both only after you have explicitly agreed in the notice at the bottom of the screen. If you decline or make no choice at all, nothing is loaded, no cookies are set and no data is sent to Google. We embed no social media plug-ins. Below we describe exactly which data is processed when you visit this website.

1. Controller

The controller within the meaning of Art. 4 (7) GDPR is:

Lucian Katzbach
Krähenweg 95
90768 Fürth
Germany
Email: hi@flightroom.io

No data protection officer has been appointed. The requirements of Art. 37 GDPR in conjunction with Section 38 of the German Federal Data Protection Act (BDSG) are not met, as fewer than 20 people are regularly and permanently engaged in the automated processing of personal data. For all data protection matters, please contact the address given above directly.

2. Your rights as a data subject

You have the following rights with regard to the personal data we hold about you:

• Access to information on whether and which data we process, and to a copy of that data (Art. 15 GDPR).
• Rectification of inaccurate data and completion of incomplete data (Art. 16 GDPR).
• Erasure of the data concerning you (Art. 17 GDPR), unless statutory retention obligations prevent this.
• Restriction of processing (Art. 18 GDPR).
• Data portability — receipt of the data you provided in a structured, commonly used, machine-readable format (Art. 20 GDPR).
• Objection to processing based on a legitimate interest (Art. 21 GDPR).
• Withdrawal of consent with effect for the future (Art. 7 (3) GDPR). The lawfulness of processing carried out before the withdrawal remains unaffected.
• Complaint to a supervisory authority (Art. 77 GDPR).

The supervisory authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 27, 91522 Ansbach, Germany
www.lda.bayern.de

Irrespective of this, you may also contact the supervisory authority of your habitual residence or place of work.

3. Hosting and server log files

This website is hosted on Firebase Hosting, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). We have concluded a data processing agreement with Google pursuant to Art. 28 GDPR.

When you access this website, your browser transmits technically necessary data which is recorded in server log files:

• IP address of the requesting device
• date and time of access
• page or file requested and the volume of data transferred
• notification of successful retrieval (HTTP status code)
• browser type and version, operating system, referrer URL

Purpose: delivering the website, ensuring stability and security, and defending against and investigating attacks.
Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest lies in the technically sound and secure operation of this website.
Retention period: Google generally deletes the log data automatically after a few days. We do not merge it with any other data sources.

Further information: firebase.google.com/support/privacy

4. Waitlist / early access sign-up

You can register your interest in early access via the “Try it free” form. In doing so we process only the email address you enter and the time of sign-up.

Double opt-in procedure

After you submit the form we automatically generate a random confirmation token and send you an email containing a confirmation link. Your sign-up is only stored as confirmed once you follow that link. This ensures that nobody can enter someone else’s address without their consent. The following is stored: email address, time of sign-up, status (“pending” / “confirmed”), confirmation token, time of confirmation and the time the address was passed to the mailing list.

After your confirmation: our mailing list

Once you have confirmed, we transfer your email address to Brevo and keep it there in a mailing list. That is the only way we can notify you when early access starts. Only the email address is transferred, no other details. Brevo acts for us as a processor under Art. 28 GDPR — the confirmation email is sent through the same service.

Legal basis and withdrawal

Legal basis: Art. 6 (1) (a) GDPR (consent), which you give by submitting the form and subsequently confirming it.
Withdrawal: you can withdraw your consent at any time with effect for the future — informally by email to hi@flightroom.io. We will then delete your data without delay: the entry in our database and the contact in the mailing list at Brevo.
Retention period: until withdrawal, but no longer than until the purpose ceases to apply (the start of regular product operation). If a sign-up is not confirmed within 30 days, we delete the entry.

Technology used

Data is stored in Cloud Firestore and the confirmation process is handled by Cloud Functions for Firebase — both services provided by Google Ireland Limited and both operated in the europe-west3 (Frankfurt am Main, Germany) region. The confirmation email is sent via a Firebase extension and the email service Brevo, which acts for us as a processor under Art. 28 GDPR.

The database security rules mean your email address can neither be read nor modified from the outside; it can only be created.

5. Contacting us by email

If you contact us by email, we process the information you provide solely in order to handle your enquiry.

Legal basis: Art. 6 (1) (b) GDPR where the enquiry is aimed at concluding a contract, otherwise Art. 6 (1) (f) GDPR (legitimate interest in responding to enquiries).
Retention period: until the enquiry has been dealt with conclusively, unless statutory retention periods (in particular under the German Commercial Code and Fiscal Code) apply.

6. Google Fonts

To display fonts consistently we embed the “Plus Jakarta Sans” typeface via Google Fonts, a service provided by Google Ireland Limited. When you access this website, your browser loads the font files from a Google server (fonts.googleapis.com or fonts.gstatic.com). Your IP address is transmitted to Google in the process; transmission to servers in the USA cannot be ruled out.

Purpose: consistent, accessible typography.
Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest lies in presenting our offering consistently and with good performance.

According to Google, Google Fonts sets no cookies and does not use the requests for profiling. Further information: developers.google.com/fonts/faq/privacy and policies.google.com/privacy

7. Firebase JavaScript SDK

To transmit the waitlist sign-up we load the Firebase JavaScript SDK from the Google server www.gstatic.com. Your IP address is transmitted to Google in this case as well.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in operating the sign-up function).

8. Google Analytics and Google Ads (only with your consent)

For audience measurement we use Google Analytics 4 (measurement ID G-H3JZ7YJXTF), a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Nothing happens without your consent. The Google tag — it serves both Google Analytics and the Google Ads account described in section 8.1 — is only loaded once you click “Accept all” in the notice at the bottom of the screen. Until then, no connection to Google is established, no cookies are set and no IP address is transmitted. If you choose “Essential only” or leave without choosing, it stays that way.

Once you have consented, Google Analytics processes in particular: a truncated IP address, the pages you visit and how long you stay, the referring source, your approximate location (country/region), device type, browser and operating system, plus a pseudonymous identifier stored in cookies (e.g. _ga, _ga_<ID>) on your device. These cookies are stored for up to 24 months. We use the data in aggregated form only and do not combine it with other data sources.

Besides page views, this website reports a single event: when the waiting-list form is submitted, it tells Google Analytics and Google Ads that a sign-up has taken place (sign_up). Your email address is expressly not part of that — it is not transmitted to Google.

Purpose: Understanding which content gets read and improving the website accordingly; measuring the success of our advertising.
Legal basis: Your consent pursuant to Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG for the storage on your device.
Retention: Usage data in Google Analytics is retained for a maximum of 14 months.

8.1 Google Ads — measuring our advertising

We advertise FlightRoom through Google Ads, also a service provided by Google Ireland Limited. No second script is loaded for this: the same Google tag that serves Google Analytics also carries the conversion ID AW-18392587818. The same consent and the same gate therefore apply — without your agreement nothing is loaded here either.

If your visit comes from one of our ads, the address you open carries a click identifier (gclid). From it, Google Ads stores a pseudonymous identifier in cookies (e.g. _gcl_au) on your device; those cookies expire after 90 days at the latest. The page you opened, the time, and details about your browser and device are processed along the way. We ourselves only see aggregated figures in Google Ads — which ad produced how many sign-ups, not who signed up.

We do not transmit email addresses or any other details from the sign-up form to Google Ads: we use neither “enhanced conversions” nor customer list uploads. With your agreement, however, we also pass your consent for advertising cookies on to Google (Consent Mode v2: ad_storage, ad_user_data, ad_personalization). Google may therefore also use the data collected in this way for personalised advertising and to build audiences.

Purpose: Recognising which ad led to a sign-up, and spending our advertising budget accordingly.
Legal basis: Your consent pursuant to Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG for the storage on your device.
Retention: The cookies named above expire after 90 days at the latest. How long Google keeps the conversion data in our Google Ads account is governed by Google’s own rules.

Withdrawal: You can withdraw your consent at any time with effect for the future — via the Cookie settings link in the footer of every page. We then delete the cookies set by Google immediately and neither Google Analytics nor Google Ads is loaded again. The lawfulness of processing carried out before the withdrawal remains unaffected.

Further information: policies.google.com/privacy

9. Cookies and local storage

Without your consent this website sets no cookies. The cookies of Google Analytics and Google Ads named in section 8 above are only set once you consent. Everything else this website stores on your device is necessary for operation and never leaves your device:

• Your language choice from the switcher in the header (localStorage), so that the site opens in your preferred language next time.
• Your consent decision (localStorage), so that we do not ask you again on every visit. Only “granted” or “denied” is stored, together with the time.

Neither is read by us nor transmitted to third parties. The legal basis for this strictly necessary storage is Section 25 (2) no. 2 TDDDG.

We do not use: Google Maps, Google reCAPTCHA, YouTube or Vimeo embeds, social media plug-ins from Facebook, Instagram, X/Twitter or LinkedIn, or newsletter tracking pixels.

10. Transfers to third countries

The Google services we use are provided to users in the European Economic Area by Google Ireland Limited. Processing by the parent company Google LLC in the USA cannot, however, be ruled out.

Google LLC is certified under the EU-U.S. Data Privacy Framework. In its adequacy decision of 10 July 2023 the European Commission determined that certified companies in the USA provide an adequate level of data protection (Art. 45 GDPR). In addition, Google has incorporated the European Commission’s standard contractual clauses pursuant to Art. 46 (2) (c) GDPR.

The former “EU-US Privacy Shield” has been invalid since the judgment of the Court of Justice of the European Union of 16 July 2020 (Case C-311/18, “Schrems II”) and is no longer a valid basis for data transfers.

11. Recipients and processors

We do not sell data and we do not pass it on to anyone who would run their own advertising with it. Only the following service providers are involved, and they act for us on our instructions:

Beyond this we only pass on data where we are legally obliged to do so or where you have expressly consented.

11. No automated decision-making

Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place.

12. Currency of this policy

This privacy policy is dated 18 August 2026. Further development of this website or changes in legal requirements may make an update necessary. You will always find the current version at this address.

You can reach us on any data protection matter at hi@flightroom.io. We answer requests under Art. 15 to 21 GDPR without delay, and within one month at the latest.