Privacy Policy

This page explains what personal data MySTDY collects during the pre-launch waitlist phase, why we collect it, and how you can control or delete it. A fuller privacy policy will be published when the product launches and additional processing (accounts, content, payments, AI features) begins. For any question, email privacy@mystdy.com.

1. Controller

The data controller is Ren Vekst AS (Org. nr 934 231 635), Engøveien 74, 3145 Tjøme, Norway. We operate MySTDY as a trading name. Privacy contact: privacy@mystdy.com.

2. What we collect

When you sign up to the waitlist we collect:

• Email address — so we can tell you when MySTDY launches at your university.
• University / school name — so we can prioritise which campuses go live first.
• UTM parameters (source, medium, campaign, content, term) — when present in the URL that brought you here, so we can attribute signups to channels.
• Basic technical metadata (page URL and page title at time of submission).

If you accept analytics in the cookie banner, we additionally collect aggregate product-analytics events (page views, scroll depth, form interactions) via PostHog, and anonymous visitor activity via HubSpot so we can tie your eventual waitlist submission to how you found us. No advertising cookies. No cross-site tracking. No session recording.

3. Legal basis (GDPR Art. 6)

• Consent (Art. 6(1)(a)) — waitlist signup, analytics cookies, future marketing emails.
• Legitimate interest (Art. 6(1)(f)) — aggregate UTM attribution and product-analytics once consent is given. You can object at any time.

4. Processors & sub-processors

We use a small, specific set of processors. All operate under Data Processing Agreements with equivalent protection under GDPR.

We do not use Google Analytics, Facebook Pixel, or any advertising trackers on this site. We do not sell or rent personal data.

5. International transfers

HubSpot and PostHog store your data within the European Union. If any processor needs to transfer data outside the EEA for operational reasons (e.g. administrative access), they do so under Standard Contractual Clauses approved by the European Commission plus supplementary safeguards.

6. Cookies

We use first-party analytics cookies via PostHog and HubSpot, and only if you click Accept on the cookie banner. If you click Reject, no analytics cookies are set and no events are sent. You can revoke consent at any time by clearing your browser storage for this site. Essential functionality (the waitlist form) works without any cookies.

7. Retention

• Waitlist signups — kept until public launch (expected May 2026) plus 12 months, or until you ask us to delete them, whichever comes first.
• Analytics events — retained in PostHog for 12 months, then aggregated.

8. Your rights (GDPR)

If you are in the EEA, you have the right to:

• Access the personal data we hold about you
• Request correction of anything inaccurate
• Request deletion (right to be forgotten)
• Restrict or object to processing
• Export your data in a portable format
• Withdraw consent at any time
• Lodge a complaint with your local data protection authority

Email privacy@mystdy.com to exercise any of these. We respond within 30 days (up to 60 for complex cases, as permitted under GDPR Art. 12). No charge, unless a request is manifestly unfounded or excessive.

9. Security & breach notification

Data is transferred over HTTPS / TLS and stored encrypted at rest by our processors. Access is role-based and logged. In the event of a personal-data breach that is likely to result in risk to your rights and freedoms, we notify the Norwegian Data Protection Authority (Datatilsynet) within 72 hours and affected users without undue delay, as required by GDPR Art. 33–34.

10. Children

MySTDY is intended for users aged 16 and above. We do not knowingly collect data from anyone under 16. If you believe a minor has submitted the waitlist form, contact privacy@mystdy.com and we will delete the record.

11. Supervisory authority

If you believe your rights have been violated and we haven't resolved your concern, you can lodge a complaint with Datatilsynet (the Norwegian Data Protection Authority), P.O. Box 458 Sentrum, 0105 Oslo, Norway — datatilsynet.no.

12. Changes to this policy

We update this policy when our processing changes or when we ship new features. A full post-launch version will replace this pre-launch policy before the product goes live. The “effective” date at the top reflects the current version. Material changes will be emailed to waitlist members.