Privacy notice: Sim2Real Lab
Last updated: 2026-10-24.
This notice explains what personal data Sim2Real Lab (sim2reallab.com) collects, why, and what rights you have. It follows Article 13 of the EU General Data Protection Regulation (GDPR).
1. Who is responsible (the controller)
Serhii Oryshych, a private individual based in Poland, runs Sim2Real Lab. There is no company yet. Contact for all privacy questions: privacy@sim2reallab.com. Postal address: Filtrowa 79/30, 02-032 Warszawa, Poland.
Sim2Real Lab is in build. Today the site only shows this landing page and collects waitlist sign-ups. Nothing is sold and no payment is taken. There are no accounts.
2. What we collect, why, and the legal basis
| What you do | Data we store | Why | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Join the waitlist | Your e-mail address; the group you chose (student, software engineer, career switcher or other); a yes flag that you said you are 16 or older (no age, no birth date); the version and time of the consent text; the time of your latest request; the opt-in state and its times (pending, e-mail sent, confirmed, unsubscribed) | To check the address once with a confirmation e-mail, then to e-mail you when lessons and the job radar open. The group is used only for counts. | Your consent (Art. 6(1)(a)), confirmed by the link in our first e-mail |
| Tick "occasional news" (optional, not pre-ticked) | A separate yes flag with its own version and time | Occasional news about new lessons and features | Your separate consent (Art. 6(1)(a)) |
| Send the form | A rate-limit key: a one-way hash of your IP address mixed with a random value that exists only in the memory of one server instance. The key is kept only in that memory (never written to disk or to the database). It is usually cleared within about 20 minutes and always when that instance stops. Also a hidden anti-spam field | To stop spam and abuse | Legitimate interest in keeping the site safe (Art. 6(1)(f)) |
| Write to one of our e-mail addresses | Your e-mail address, the message and anything you put in it | To answer you, and to keep a record of how we handled a request about your rights | Legitimate interest in answering messages (Art. 6(1)(f)). For a request about your rights: our legal obligation to answer it (Art. 6(1)(c) with Art. 12), and our legitimate interest in being able to show how we handled it (Art. 6(1)(f)) |
| Any visit | Technical request logs (IP address, browser, time, page) kept by our host | To deliver and secure the site | Legitimate interest (Art. 6(1)(f)) |
You do not have to give us any data. To join the waitlist we need your e-mail address; without it we cannot add you or tell you when lessons open. All lessons are planned to be open without sign-up. The waitlist is for people aged 16 and over; if you are under 16, please do not join.
We do not store your name, birth date, school, phone, IP address or browser details with your sign-up. We do not use your data for automated decisions with legal or similarly significant effects, and we do not sell it.
Suppression list. When you unsubscribe or ask us to delete your sign-up, we keep a keyed code made from your e-mail address (an HMAC with a secret key that is kept outside the database), not the address itself. We use it for one thing only: if we ever restore our database from a backup, we check the restored sign-ups against these codes and delete yours again before any e-mail is sent. We never use it to contact you. If you join the waitlist again and confirm it with the link in our e-mail, your code is removed. Legal basis: our legitimate interest in making sure that your unsubscribe or deletion request stays effective (Art. 6(1)(f)). Kept for 90 days, which is longer than our database provider's restore period.
3. Cookies and similar storage
We use no cookies, no third-party analytics, no advertising tags and no tracking pixels.
Visit counts. Our server counts page views as daily totals only: site, date, page (home, privacy or terms) and a coarse source label (for example "reddit", "google" or "direct"). We store no IP address, no browser details, no full web address and nothing that identifies you or your device. Legal basis: our legitimate interest in knowing how many people visit (Art. 6(1)(f)). The totals are kept for 24 months.
Theme choice. If you switch between light and dark theme, your browser keeps that choice in its local storage on your device. It is never sent to us. You can clear it in your browser settings.
4. Who receives your data
We share data only with the service providers below. Vercel, Neon, Resend and Cloudflare process it for us under a data processing agreement. Google holds the e-mails you send us under its own terms (see "E-mails you send us").
- Vercel Inc. (USA): hosts the site and keeps short technical request logs. Our server functions run in Frankfurt, Germany.
- Neon (Neon, LLC, part of Databricks, Inc.): hosts the database. Region: EU (Frankfurt, Germany — AWS eu-central-1).
- Resend (Plus Five Five, Inc., USA): sends the confirmation e-mail and, later, the launch e-mail, from its EU region (Ireland). It receives your e-mail address and the text of the e-mail. No e-mail is sent before the sending domain is set up.
- Cloudflare, Inc. (USA): answers DNS look-ups for our domain, and forwards e-mails sent to our addresses (privacy@sim2reallab.com, legal@sim2reallab.com and our other addresses at sim2reallab.com) to the controller's mailbox. It does not receive your sign-up data.
E-mails you send us. Our addresses at sim2reallab.com have no mailbox of their own. Cloudflare forwards each message to the controller's personal Gmail mailbox, so Google (Google Ireland Limited for users in the EU) also holds your message, under Google's own terms and privacy notice. We use it only to answer you and, for a request about your rights, to keep proof of how we handled it (section 6).
5. Transfers outside the EU
Some of our providers are in the USA, or their teams and systems can reach data from the USA. Vercel, Resend and Cloudflare are certified under the EU–US Data Privacy Framework, and their data processing agreements also include the European Commission's Standard Contractual Clauses. Neon (Databricks) relies on the Standard Contractual Clauses in its data processing agreement. Our database is stored in the EU, and Resend sends our e-mails from its EU region, but Resend's main systems are in the USA. Google, which holds the e-mails you send us, handles them under its own terms (Google LLC is certified under the Data Privacy Framework). You can ask for a copy of the safeguards at privacy@sim2reallab.com.
6. How long we keep data
| Data | How long |
|---|---|
| Sign-up not confirmed, confirmation e-mail sent | Deleted 30 days after the e-mail was sent |
| Sign-up not confirmed, no e-mail sent yet | Deleted 180 days after you joined |
| Confirmed sign-up | Until you unsubscribe, or 24 months after the later of your confirmation and our last e-mail to you |
| After you unsubscribe | Marked as unsubscribed at once (never e-mailed again) and deleted by the next nightly clean-up |
| After you ask us to delete it | Deleted within one month of your request (see section 7) |
| Rate-limit keys | In server memory only; usually cleared within about 20 minutes, and always when the server instance stops |
| Copies in our database provider's restore history | Kept only for the restore period of our Neon plan (today 6 hours), then gone. If we ever have to restore the database, sign-ups that were deleted after the restore point are deleted again before any e-mail is sent (see "Suppression list" in section 2) |
| Suppression list (after you unsubscribe or ask us to delete your sign-up) | A keyed code made from your e-mail address, not the address itself, kept for 90 days so that a database restore cannot bring your sign-up back. Removed earlier if you join the waitlist again and confirm it. If we keep our optional weekly encrypted backup of this list, a copy can stay up to 4 more weeks. |
| Copies of sent e-mails at our e-mail provider (Resend) | Kept by Resend for 30 days (Resend's stated retention), then deleted by Resend |
| E-mails you send us | While we need them to answer you. For a request about your rights we keep only the request, our answer and our log entry, for 3 years after the request is closed, as proof of how we handled it (this is the usual period in which a claim about it can be made); we tell you this in our answer |
| Page-view totals | 24 months (they hold no personal data) |
| Host request logs | About 1 day (Vercel Pro runtime logs) |
7. Your rights
You can ask for access to your data, correction, deletion, restriction, data portability, and you can object to processing based on legitimate interest. You can withdraw consent at any time with the unsubscribe link in every e-mail or by writing to privacy@sim2reallab.com; this does not affect what we did before. You can complain to a supervisory authority; in Poland this is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.
To use a right, write to privacy@sim2reallab.com from the address that is on the waitlist. We answer within one month. If we cannot be sure the request comes from the owner of the address, we ask you to confirm by replying from it; we do not ask for ID documents for the waitlist. Deleting your sign-up removes the whole row (e-mail, group, flags and times), not only the e-mail subscription.
8. Changes
If we change this notice, we update the date at the top. If a change affects how we use your e-mail, we tell people on the waitlist first.