Privacy

This notice covers the website hey-albert.app and the list. The application at app.hey-albert.app and the Hey Albert app will get their own notice when they launch. Last updated: 19 September 2026. The controller is based in Sofia; the GDPR and the Bulgarian Personal Data Protection Act apply. The Bulgarian version is legally binding.

Who is responsible

Emma Rocket Ltd OOD, 41 Kutlovitsa str., Slatina Distr., Entr. V, Apt. 52a, 1505 Sofia, Bulgaria, UIC 208636237, represented by the managing director Bogomil Kachamachkov. E-mail: contact@hey-albert.app. No data protection officer needs to be appointed under Art. 37 GDPR. The company is based in the EU, so no representative under Art. 27 GDPR is required.

What this site does not do

It sets no cookies. It measures nothing, tracks nobody, embeds no advertising or analytics services and loads no fonts or scripts from third-party servers. There is no automated decision-making and no profiling. When you choose a language, your browser remembers the choice in its own storage (localStorage). That is not a cookie, it never leaves your device, and you delete it together with your browser's site data.

Visiting the site

When you visit, our hosting provider processes the technically necessary data: IP address, time, requested address, browser identifier. The purpose is delivering the site and keeping it secure, legal basis Art. 6 (1) (f) GDPR. This data is kept briefly in logs and is not linked to other data.

Hosting: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Data processing agreement under Art. 28 GDPR; Vercel is certified under the EU-US Data Privacy Framework, and the EU Commission's standard contractual clauses apply in addition. The site is delivered through a global network, in Europe from European data centres; the function behind the list runs in Frankfurt am Main.

Name resolution: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, operates the domain's name servers. Only the name hey-albert.app is resolved into an address; the page request itself does not pass through Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework.

The list

When you join the list, we store your email address, the language you chose and the time. Purpose: to write to you once, when Albert is ready. Before that we send an email to confirm your address (double opt-in), and after confirmation a welcome email. Nothing else. The legal basis is your consent, Art. 6(1)(a) GDPR. So that we can prove the consent (Art. 7(1) GDPR), we record at sign-up, confirmation and unsubscribe the time, IP address, browser identifier, originating page and the wording of the consent, plus the identifier of every email sent; the legal basis for this is our legitimate interest in being able to prove it, Art. 6(1)(f). You can withdraw your consent at any time, with the link in every email or by writing to contact@hey-albert.app. Then we stop writing; we keep the record of consent and withdrawal for three years and then delete everything.

Database: Supabase, Inc., 970 Toa Payoh North #07-04, Singapore, servers in Frankfurt am Main (processing agreement under Art. 28 GDPR, standard contractual clauses). Sending: Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA; processing in the EU region (Ireland), processing agreement under Art. 28 GDPR, EU-US Data Privacy Framework and standard contractual clauses. We pass the address on to nobody else.

We keep the entry until you withdraw, at most six months after the app launches. An address that is not confirmed is deleted after 30 days.

When you write to us

A mail to contact@hey-albert.app reaches our mailbox through the e-mail forwarding of Cloudflare, Inc. (processing agreement, EU-US Data Privacy Framework). We process it to answer you, Art. 6 (1) (b) and (f) GDPR, and delete it once the matter is settled and no retention duty applies.

Security

The site is delivered encrypted only (TLS, HSTS). A content security policy blocks foreign scripts. Access to the list is limited to two narrow functions; the table itself cannot be reached from outside. This corresponds to Art. 32 GDPR.

Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You can withdraw consent at any time; processing up to that point remains lawful. Write to contact@hey-albert.app.

You can complain to a data protection authority. The authority responsible for us is the Commission for Personal Data Protection of the Republic of Bulgaria (CPDP), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia. You may also contact the authority where you live.

Children

This website is aimed at adults. You can join the list if you are at least 16 years old.

The app, in one paragraph

For Hey Albert, what the start page says applies: your data stays in Frankfurt. Albert reads only what you give him. Every answer is a draft. Everyone sees what is theirs. Your device encrypts the vault. There is no advertising and no sale of data. We will publish the full notice for the app here when it launches.

Changes

If services or purposes change, we change this notice and update the date above. Older versions are available on request.