Who operates this waitlist

The Costinal pre-launch waitlist is operated by the Costinal team. In this notice, “Costinal”, “we”, “us” and “our” refer to that pre-launch project and the people responsible for it. Costinal is an early-stage product. This page does not claim that Costinal is incorporated, registered or operating as a separate legal entity, and it does not invent a corporate mailing address.

Privacy questions, access requests and complaints require a monitored contact channel. The operator has not yet confirmed one, so this page does not publish an unverified address. A working privacy contact and any required operator mailing address must be configured before public launch. No address or registration is fabricated here.

What we collect

• Email address. Normalized to a single lowercase identity so the same address is never counted twice.
• Consent evidence. Whether you agreed to necessary waitlist communications, whether you separately opted in to optional marketing, the consent version, and the timestamp of each choice.
• Waitlist status and dates. Pending confirmation, verified, unsubscribed, bounced, suppressed, or rejected; signup, verification, unsubscribe and suppression timestamps; and email-delivery status codes.
• Approximate country. A country code and name derived only from Cloudflare's trusted request metadata at signup. If the country cannot be determined reliably, it is stored as UNKNOWN. We do not collect GPS coordinates, precise location, home address or postal code.
• Acquisition context. UTM source, medium, campaign, content and term when present, the referring domain, and the landing path. Unknown values stay UNKNOWN.
• Abuse-prevention data. Rate limits use keyed digests derived from your network address and email identity. We do not retain the raw network address for analytics. Cloudflare and Turnstile necessarily process connection data to deliver and protect the service under their own terms.
• Rejected-attempt counts. A rejected submission records a reason, request type, approximate country and time. Rejected rows do not store the submitted email address or raw IP address.
• Administrative records. Founder-only audit events record sensitive reads, exports, unsubscribes and deletions without storing subscriber email content in the audit detail.

The waitlist does not create a customer account, does not collect a password or payment details, and does not publish a subscriber list.

Why we use it, and our legal basis

We use your email address and consent record to send the confirmation email you requested, to maintain your waitlist place, to send essential waitlist and early-access updates where you have agreed, to honour unsubscribes and deletion requests, and to keep the waitlist secure and free from automated abuse.

We use approximate country and acquisition data only in aggregate, to understand where interest is coming from and which campaigns are working. Country metrics are computed from verified, currently eligible subscriber records. They are not used to make decisions about individual people or to show individual people on a map.

Necessary waitlist communications rely on the express consent you provide when you check the waitlist box. Optional marketing relies on your separate, unchecked opt-in. Optional marketing is never pre-selected. You may withdraw either consent at any time.

Canadian anti-spam (CASL) commitments

We record the purpose, version and time of consent so that consent evidence can be produced. Every waitlist email identifies Costinal and provides a working unsubscribe or management mechanism. Unsubscribes are applied immediately and the address is suppressed from future waitlist email.

This implementation currently sends transactional confirmation and management emails. It does not send promotional broadcasts. Before any promotional or launch-marketing message is distributed, the operator must configure compliant sender identification, including a valid mailing address, and ensure every message contains CASL-required identification and unsubscribe information. No mailing address is invented by this page.

Cookies, local storage and tracking

The public waitlist pages do not use advertising cookies, cross-site tracking pixels, fingerprinting or third-party analytics. UTM values are held in browser session storage only so they can be attached to a submission you choose to make; they are cleared after a successful submission. Cloudflare Turnstile may use its own storage or cookies to distinguish people from bots, under Cloudflare's policies. The Founder dashboard uses a secure, HTTP-only session cookie and is not part of the public waitlist experience.

Service providers and disclosure

The waitlist is hosted on Cloudflare, which provides the Worker runtime, static hosting, D1 database and Turnstile bot protection. Transactional email is delivered through the configured email provider, currently Resend when enabled. These providers process data on our behalf to provide those services. Their infrastructure may process data outside Canada. We do not sell personal information, and we do not disclose the subscriber list publicly.

We may disclose information if required by law, to protect the service from abuse, or as part of a genuine reorganization where the recipient is bound by appropriate confidentiality and privacy obligations.

How long we keep it

• Unconfirmed submissions: removed 30 days after the last attempt. Confirmation links expire after 24 hours.
• Verified subscribers: retained while you remain on the waitlist, until you unsubscribe, or until you request deletion.
• Unsubscribed, bounced or suppressed addresses: a minimal suppression record is retained for up to 24 months so we can honour the withdrawal and avoid emailing you again, then removed.
• Expired verification tokens: removed within 30 days of expiry.
• Rate-limit buckets: expire with their short fixed window; a daily cleanup removes expired rows.
• Rejected-attempt analytics: retained for up to 12 months without email or raw IP addresses.
• Founder audit records: retained for up to 24 months. They do not contain subscriber email content.
• Webhook delivery receipts: retained for 30 days to prevent duplicate processing.

Cloudflare and the email provider may retain operational logs under their own policies. We configure the waitlist so that raw IP addresses are not written to our waitlist database for analytics.

Your choices and rights

You can manage your preferences with the private link in any waitlist email or through the management page. The management page can unsubscribe you or permanently delete your waitlist record without needing a support address.

Subject to applicable law, you may request access to the personal information we hold about you, ask us to correct it, withdraw consent, or ask us to delete it. We may need to confirm that the request comes from the address concerned before acting. We aim to respond within 30 days. You may also contact the Office of the Privacy Commissioner of Canada or another applicable privacy regulator.

Deleting your waitlist record removes your email address, consent record and waitlist status from the waitlist database. It does not delete operational backups or provider logs immediately; those expire under the retention periods described above and the providers' own policies.

Security

We use HTTPS, hashed single-use verification tokens, server-side authorization for the private Founder dashboard, limited administrative access, signed unsubscribe links, server-side bot verification and rate limits. No system is perfectly secure. If you believe a waitlist link or record has been compromised, use the managed preferences page to delete the record and watch for the monitored privacy contact that must be published before public launch.

Children

The waitlist is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has submitted an address, use the management page to remove it once a monitored privacy contact is published.

Changes

If this notice or the consent terms change materially, the new version will be identified on the waitlist form and this page. A new consent version will be requested where required. This notice does not create rights beyond those provided by applicable law.