Privacy policy
Last updated 1 November 2026
This policy explains what happens to your personal data when you join the pacerail beta waitlist, subscribe to product news or visit pacerail.com. It is written to follow the EU General Data Protection Regulation (GDPR) and Swedish law.
Who is responsible
The controller is Christofer Näs (enskild firma), a sole trader in Sweden. pacerail is a product of this business. For anything about your data, email privacy@pacerail.com.
What I collect
- Your email address, which is the only required field.
- Optional answers if you give them: which coding agents you use, where you would use pacerail, and roughly what you pay for AI subscriptions per month in US dollars.
- First source, medium and campaign: short labels from utm_source, utm_medium and utm_campaign, or the existing ref tag. Without tags, only the referring domain is used; otherwise the source is direct. These labels stay with your sign-up through email confirmation. Full referring URLs are not stored.
- Your choices and when you made them: the version of the consent text you agreed to, the time you signed up and confirmed, and whether you chose product news.
- Spam protection: a keyed hash of your IP address (for IPv6, of its /64 network prefix) and of your email address, used to limit how many sign-ups and emails can come from one place. The hashes are kept for at most 24 hours. Your IP address itself is not stored by pacerail.
- Hosting logs: the hosting provider, Vercel, records technical data such as IP address, browser and requested page in its logs when you visit the site.
I use Vercel Web Analytics for page visits and sign-up events, and Vercel Speed Insights for page performance. No email addresses, form answers or email-link tokens are sent to these tools. I do not use advertising trackers or profiling, and I do not sell or share your data for marketing.
Why, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Running the waitlist: the confirmation email and the beta invite | Email address, status, consent record | Your consent (GDPR art. 6(1)(a)) |
| Product news | Email address | Your separate consent (art. 6(1)(a)) |
| Deciding what to build first | Optional answers, source label | Your consent (art. 6(1)(a)) |
| Understanding visits, sources and conversions, and improving page performance | Cookieless visit and performance measurements; source and campaign totals | Legitimate interest in understanding and improving the service (art. 6(1)(f)) |
| Keeping the sign-up form free of spam and abuse | Hashed IP and email address, hosting logs | Legitimate interest in a secure service (art. 6(1)(f)) |
You can withdraw your consent at any time. That does not affect what happened before you withdrew it.
Which emails you get
As few as possible. The waitlist sends you two emails: one to confirm your address, and your invite when the beta opens for you. If you use the form at the end of this page, you get one more email with a secure link, because that is how I know the request comes from the owner of the address. Product news comes only if you ask for it.
When you confirm your spot, unsubscribe or delete your data, the confirmation is shown on the page after you press the button. No confirmation email is sent, so deleting your data does not put a new email in your inbox.
Links in emails never act on their own. Each one opens a page with a button, works only for the address it was sent to, expires, and can be used once.
How long I keep it
- A sign-up you never confirm is deleted automatically after 72 hours.
- A confirmed sign-up is kept until you delete it, and at the latest until 12 months after the beta launches.
- Product news: your address is removed from the mailing list as soon as you unsubscribe.
- Spam-protection hashes: at most 24 hours.
- Used links: a keyed hash that marks a link as used, so it cannot be used twice. It contains no email address and expires when the link would have expired, at most 60 days later.
- When you delete your data, your record and your product-news contact are removed at once and no email is sent. After that, pacerail keeps nothing about you except the short-lived hashes above and anonymous daily totals that cannot be linked to you.
- Hosting and email delivery logs are kept by Vercel and Resend for the periods set by those services.
Who processes data for me
These providers process data on my behalf under data processing agreements. All three are based in the USA. Transfers rely on the EU–US Data Privacy Framework, under which each provider is certified, and on the EU Standard Contractual Clauses in their agreements.
| Provider | Role | Where |
|---|---|---|
| Vercel Inc. | Hosting of the website and sign-up form | USA (servers in Washington, D.C.) |
| Upstash, Inc. | Database for waitlist records | USA-based company; database region to be confirmed |
| Resend | Sending email and keeping the product news list | USA |
Your rights
You have the right to see the data I hold about you, to have it corrected or deleted, to restrict or object to processing, and to get it in a portable format. Every email I send has a link to unsubscribe from product news and a link to delete all your data. You can also use the form below or email privacy@pacerail.com. I answer within one month.
If you think I handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se, or to the data protection authority where you live.
Cookies
pacerail.com sets no cookies and uses no local or session storage for measurement. Vercel Web Analytics and Speed Insights work without cookies. pacerail adds no device fingerprinting or persistent visitor identifiers. Source labels travel within site links and forms, so a later visit in a new session is not connected to an earlier anonymous visit. No cookie banner is used. Anonymous daily sign-up totals are kept for 40 days; source labels on a sign-up follow the retention period for that record. Vercel explains its analytics privacy measures here.
Changes
If this policy changes in a way that matters, the date at the top changes and people on the waitlist get an email before the change applies.
See or delete your data
Enter the email address you signed up with. If I hold data for it, you will get an email with a secure link. The link works for 24 hours, and only once. This form never changes or deletes anything by itself: only the person who can open that email can.