Privacy notice

Last updated: 12 May 2026

This notice explains what personal data Casabook collects on this landing page, why we collect it, and the rights you have under the EU General Data Protection Regulation (GDPR).

1. Who is responsible

Casabook is a service of Aunova OÜ. The controller for personal data processed on this site is:

Aunova OÜ
Ahtri tn 12
15551 Tallinn, Harju maakond
Estonia
VAT: EE102670613
Email: [email protected] (Casabook) · [email protected] (company)

See also our company-wide Aunova Privacy Policy and Imprint.

2. What data we collect

Waitlist signup. When you submit the waitlist form we collect:

• Your email address
• The fact and timestamp that you ticked the consent box
• Your IP address and basic browser metadata, transmitted to our form processor (Formspree) for spam protection

Server logs. The hosting provider (Cloudflare) processes connection metadata such as IP address, timestamp, requested URL, and user-agent. This is necessary to deliver the website and prevent abuse. These logs are retained for a short period as part of Cloudflare's standard operations.

3. Why we process it — and on what legal basis

• Waitlist email: to notify you when Casabook launches. Legal basis: your consent under Art. 6 (1)(a) GDPR.
• Spam protection / connection logs: our legitimate interest in keeping the site available and free from abuse, Art. 6 (1)(f) GDPR.

4. How long we keep it

• Waitlist emails: until the launch notification is sent, plus up to 30 days, then deleted — or earlier on request.
• Server logs at Cloudflare: per Cloudflare's retention defaults.

5. Who receives your data

We use the following processors. Each has been chosen with privacy in mind.

• Cloudflare, Inc. — hosting and CDN. Data transfer to the US is covered by the EU–US Data Privacy Framework and Standard Contractual Clauses.
• Formspree, Inc. — receives and forwards waitlist form submissions. US-based; transfer is covered by Standard Contractual Clauses.
• Bunny.net (BunnyWay d.o.o., Slovenia) — serves the website fonts (fonts.bunny.net), a GDPR-friendly alternative to Google Fonts. No font requests are sent to Google.

We do not sell your data, do not use it for advertising profiling, and do not share it with anyone outside the processors above.

6. Cookies and tracking

This landing page sets no cookies and uses no analytics or tracking pixels. No consent banner is required.

7. Your rights

Under the GDPR you have the right to:

• Access the data we hold about you (Art. 15)
• Have it corrected (Art. 16)
• Have it erased (Art. 17)
• Restrict its processing (Art. 18)
• Receive it in a portable format (Art. 20)
• Object to processing based on legitimate interest (Art. 21)
• Withdraw consent at any time, with no effect on processing done before withdrawal (Art. 7 (3))
• Lodge a complaint with a supervisory authority (Art. 77)

To exercise any of these rights, email [email protected]. To unsubscribe from the waitlist, reply to any email from us with "unsubscribe" or use the link in the launch email.

8. Changes to this notice

If we change this notice we will update the date above. Material changes will be communicated to waitlist subscribers by email.