Privacy Policy

General information

The following gives a simple overview of what happens to your personal data when you visit this website. Personal data is any data with which you can be personally identified. Full details are in this Privacy Policy.

Who is responsible for collecting data?

Data on this website is processed by the website operator (VALLAR LLC). Its contact details are in the “Controller” section.

How do we collect your data?

Some data is collected because you provide it to us — such as the email address you enter in the early-access form and, optionally, your child's age. Other data is collected automatically or with your consent by our IT systems when you visit (e.g. browser, operating system, time of the page view).

What do we use your data for?

Some data is collected to deliver the website reliably and to notify you about Milana's launch. Other data may — only with your consent — be used to analyse how the site is used.

What are your rights?

You have the right at any time to free information about the origin, recipients and purpose of your stored data, as well as a right to rectification or erasure. Any consent you have given can be withdrawn at any time for the future. You also have a right to lodge a complaint with the competent supervisory authority.

We host our website externally. Personal data collected on this website is stored on the host's servers — primarily IP addresses, meta/communication data and website access data.

External hosting is carried out for the purpose of securely, quickly and efficiently providing our online offering through a professional provider (Art. 6(1)(f) GDPR). Where consent has been requested, processing is based solely on Art. 6(1)(a) GDPR and § 25(1) TDDDG; consent can be withdrawn at any time.

Vercel

Vercel's servers may be located in the USA. The associated transfer of personal data to the USA is based on the European Commission's Standard Contractual Clauses. Details: vercel.com/legal/privacy-policy and vercel.com/legal/dpa.

We have concluded a data-processing agreement (DPA) with Vercel ensuring that personal data is processed only on our instructions and in compliance with the GDPR.

The party responsible for processing data on this website is:

The controller is the natural or legal person who alone or jointly determines the purposes and means of processing personal data.

Data protection

We take the protection of your personal data very seriously and treat it confidentially and in accordance with statutory data-protection regulations and this Privacy Policy. Please note that data transmission over the internet (e.g. by email) can have security gaps; complete protection against access by third parties is not possible.

Storage period

Unless a more specific period is stated, your data remains with us until the purpose for processing no longer applies — for the early-access list, until launch and onboarding, or until you unsubscribe or request deletion. Consent records are kept for as long as needed to demonstrate compliance.

Legal bases for processing

Where you have consented, we process your data on the basis of Art. 6(1)(a) GDPR and § 25(1) TDDDG. Where data is required to perform a contract or pre-contractual measures, we rely on Art. 6(1)(b) GDPR. We also process data to comply with legal obligations (Art. 6(1)(c) GDPR) or on the basis of our legitimate interests (Art. 6(1)(f) GDPR).

Recipients of personal data

We share personal data only where required to perform a contract, where we are legally obliged to, where we have a legitimate interest, or where another legal basis permits it. When using processors, we share data only on the basis of a valid data-processing agreement. We do not sell your data.

Withdrawing your consent

Many processing operations are only possible with your express consent. You can withdraw consent already given at any time. The lawfulness of processing carried out before the withdrawal remains unaffected.

Right to object (Art. 21 GDPR)

If data processing is based on Art. 6(1)(e) or (f) GDPR, you have the right at any time to object, on grounds relating to your particular situation, to the processing of your personal data. If your data is processed for direct marketing, you have the right to object at any time; thereafter your data will no longer be used for that purpose.

Right to lodge a complaint

In the event of breaches of the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over in a common, machine-readable format.

Information, rectification and erasure

You have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of processing, and where applicable a right to rectification or erasure. For this, contact us at any time at privacy@vallar.ai.

Right to restriction of processing

You have the right to request the restriction of processing of your personal data — for example where you contest the accuracy of the data, the processing is unlawful, we no longer need the data, or you have objected under Art. 21(1) GDPR.

For security reasons this site uses SSL/TLS encryption. You can recognise an encrypted connection by the address bar changing from “http://” to “https://” and by the lock icon in your browser bar. When encryption is active, the data you transmit to us cannot be read by third parties.

We do not use any advertising or cross-site tracking cookies. We store only your consent choice and your language preference in your browser's local storage. These are strictly necessary and are not used to track you; the legal basis is Art. 6(1)(f) GDPR.

Your language preference is stored only locally in your browser — no cookie, no cross-site use. It is updated whenever you change it (so future visits open in your chosen language) and is automatically removed after at most 7 days of inactivity.

For analytics we use Google Consent Mode. Until you consent, analytics storage stays set to “denied”, so no analytics cookies are set. Only once you consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG) is full measurement enabled.

Our hosting and network providers automatically collect and store information in server log files that your browser transmits automatically. These are:

• browser type and version
• operating system used
• referrer URL
• hostname of the accessing device
• time of the server request
• IP address

This data is not merged with other data sources. Collection is based on Art. 6(1)(f) GDPR; we have a legitimate interest in the technically error-free presentation and security of our website.

When you join the early-access list, we process your email address, optionally your child's age, and your consent (with a timestamp). We use this data solely to notify you about Milana's launch. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the unsubscribe link in any email or at privacy@vallar.ai.

Resend

We use the service Resend to send our emails. Sending data for EU recipients is processed in the Ireland (EU) region. Any transfer to the USA is based on the European Commission's Standard Contractual Clauses. We have concluded a data-processing agreement (DPA) with Resend.

This website uses Google Analytics, a web-analytics service. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics lets us analyse visitor behaviour (e.g. page views, time on page, devices used and approximate origin). We have enabled IP anonymisation, so your IP address is truncated within the EU/EEA.

We use Google Consent Mode v2. By default, analytics and advertising storage are set to “denied”, so no analytics cookies are set without your consent. Only once you consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG) is full measurement enabled; you can withdraw consent at any time. Transfers to the USA are based on the Standard Contractual Clauses; Google is certified under the EU-US Data Privacy Framework. We have concluded a DPA with Google.

Manage your consent

You can enable or disable Google Analytics directly here. This setting mirrors your choice in the consent banner and takes effect immediately.

We use services of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, for DNS, content delivery (CDN), security and email routing. Technical data such as the IP address may be processed to provide the website securely and reliably.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure, performant operation). Processing is based on Standard Contractual Clauses; Cloudflare is certified under the EU-US Data Privacy Framework.

This site uses Google Fonts for a consistent typeface. The fonts are installed locally and bundled when the site is built. No connection to Google's servers is made in the process.

Milana is designed for children, but this website and the early-access list are intended for parents and guardians. We do not knowingly collect personal data directly from children through this site. Any information about a child (such as their age) is optional and provided by an adult.

We may adjust this Privacy Policy so that it always meets current legal requirements. We will then update the date above and, for significant changes, notify you by email.