1. Introduction

Nauthera GmbH, Krieggasse 6a, 3414 Oberburg, Switzerland ("Nauthera", "we", "us", or "our") is responsible for the processing described here and operates the website nauthera.io (the "Site"). This Privacy Policy explains how we collect, use, and protect your personal information when you visit the Site or interact with our services.

Nauthera is a self-hosted, Kubernetes-native identity provider. We do not operate a SaaS platform — the software runs entirely in your own infrastructure. This policy covers only the data we collect through this website.

2. Information We Collect

2.1 Information you provide

• Waitlist & contact forms: When you sign up for our waitlist or contact us, we collect your email address and any other information you voluntarily provide.
• Design-partner questions: After you join the waitlist you may answer optional questions (your role, the identity provider you use today, and how many Kubernetes clusters you run). We store your answers with your email address.

2.2 Information collected automatically

• Log data: Our hosting providers (Vercel and Cloudflare) automatically collect standard server log information, including your IP address, browser type, referring URL, pages visited, and timestamps.
• Cookies & similar technologies: We use the following. You can change your choice at any time via "Cookie Settings", and you can delete cookies in your browser.
  • nauthera-consent (necessary, 1 year): your cookie choices.
  • nauthera-waitlist-joined (necessary, 1 year): that you joined the waitlist, and whether you applied for a design-partner seat.
  • nauthera-lp-variant (analytics, 30 days): which version of a landing page you saw (see "Page versions"). It is set before you choose and removed if you decline analytics.
  • Google Ads cookies whose names start with _gcl_ (such as _gcl_au, _gcl_aw, _gcl_ag, _gcl_gb and _gcl_gs), and the local-storage item _gcl_ls (marketing, 90 days): set only if you accept marketing, to tie a signup to the ad you clicked. They are removed if you later decline marketing.
  • The local-storage item theme (until you clear it): your light or dark choice, stored only when you use the theme switch.
  • Session storage (until you close the tab): the email address you typed into a waitlist form, so it isn't lost when you open another page and you can finish the optional questions. It leaves your browser only when you submit the form.
• Page versions: We sometimes show visitors one of two versions of a landing page to learn which is clearer. The cookie nauthera-lp-variant, holding only the letter of the version you saw (A or B), keeps it the same on your next visit; it contains no identifier. If you join the waitlist, we record that version and the page you joined from with your email address.

3. How We Use Your Information

We use the information we collect to:

• Respond to your inquiries and provide support
• Email you once, when the operator ships, if you joined the waitlist, and contact you about the design-partner programme if you applied
• Understand who is interested in Nauthera and select design partners, if you answered the optional questions
• Compare versions of our landing pages and measure whether our ads lead to waitlist signups
• Monitor and improve the Site's performance and security
• Comply with legal obligations

Where the GDPR applies, we rely on your consent for the waitlist email, the design-partner answers, Vercel Web Analytics and advertising cookies; on our legitimate interest in a secure, fast site for server logs and page-speed measurement, in comparing versions of our landing pages (the page-version cookie, which you can refuse by declining analytics, and the page version recorded with your signup), and in knowing whether our ads work for the cookieless signals described in section 4; and on legal obligations where they apply.

We do not sell, rent, or share your personal information with third parties for their marketing purposes.

4. Third-Party Services

We rely on the following third-party providers to operate the Site. Each processes data in accordance with their own privacy policies:

• Vercel — Hosting and deployment. May process server logs and request metadata.
• Cloudflare — DNS, CDN, and DDoS protection. May process IP addresses and request metadata.
• Resend — Transactional and marketing email delivery. Processes email addresses for waitlist and notification emails, and stores the waitlist details described in section 2 with them.
• Vercel Web Analytics — Aggregated page-view statistics, plus an event when someone joins the waitlist or applies for a design-partner seat (with the page and page version). It uses no cookies and runs only while you accept analytics in the cookie banner.
• Vercel Speed Insights — Page-speed measurements (Core Web Vitals) for every visit. It uses no cookies, and the page address is sent without its query string.
• Google Ads — Measures whether visits from our ads lead to waitlist signups and design-partner applications (conversion tracking), using Google Consent Mode. Google's tag loads on every page. Until you accept marketing it sets no cookies, but it sends Google cookieless signals on each page view and on each signup or application: the page address with the ad click ID removed, the page title, your screen size, your browser and operating-system versions, and your IP address. Google uses them for aggregated measurement. If you accept marketing, Google also sets the advertising cookies listed in section 2.2 to tie a signup to the ad you clicked, and may use your visit to show you our ads on other sites (remarketing).

5. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes described in this policy, or as required by law. Waitlist email addresses, and the details stored with them, are retained until you unsubscribe or request deletion.

6. Data Security

We implement reasonable technical and organisational measures to protect your personal information, including TLS encryption in transit and restricted access controls. However, no method of transmission or storage is completely secure.

7. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or port your personal data, or to object to or restrict its processing. To exercise any of these rights, contact us at privacy@nauthera.io. Our full contact details are in the imprint.

You can withdraw your consent at any time: use the unsubscribe link in our email, or "Cookie Settings" for cookies. You can also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or with the data-protection authority where you live.

8. International Transfers

Your data may be processed in countries other than your own. Our service providers (Vercel, Cloudflare, Resend, Google) operate globally and may transfer data to the United States or other jurisdictions. Where a provider is certified under the EU–U.S. or Swiss–U.S. Data Privacy Framework, transfers to it rely on that certification; otherwise they rely on the European Commission's standard contractual clauses, as recognised by the FDPIC.

9. Children's Privacy

The Site is not directed at individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have collected such data, please contact us so we can delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date.

11. Contact

If you have any questions about this Privacy Policy, please contact us at privacy@nauthera.io.