Privacy Policy

Last updated: 16 July 2026 Effective date: 16 July 2026

This Privacy Policy explains how personal data is collected and used when you visit cushio.ai (the "Site") and join the Cushio waitlist (together, the "Service"). It is written to be read, not just filed. Please read it before submitting your email address.

Cushio is at an early, pre-launch stage. Today the Site does one thing: it lets you join a waitlist so we can tell you when Cushio launches or when early access opens. The product itself is not yet operating, and this policy will be updated before the product does anything more with your data (see "Changes to this Policy").

1. Who is responsible for your data (the "Controller")

The Service is operated by Vadim Seliukov, an individual (a sole operator, no company has been formed yet). For the purposes of the EU and UK General Data Protection Regulation ("GDPR"), Vadim Seliukov is the data controller.

• Contact for all privacy matters and to exercise your rights: hello@cushio.ai
• Postal / business address: Husitská 677/15, 130 00 Praha 3-Žižkov, Czech Republic
• Governing jurisdiction: Czech Republic

Because the operator is an individual and not a company, there is no formally appointed Data Protection Officer and none is legally required at this stage. You can reach the operator directly at the email above.

2. The short version

• The only piece of personal data you actively give us is your email address, when you choose to join the waitlist.
• Alongside it, our server automatically records a small amount of technical information (see Section 3), none of which includes your name, and none of which stores your raw IP address.
• We use this to run the waitlist, to email you at launch, to prevent spam and abuse, and to understand basic, aggregate usage of the Site.
• We use a small number of well-known service providers ("processors") to host the Site and run analytics: Cloudflare and PostHog. We do not use advertising trackers.
• Our analytics are cookieless. We do not set any cookies or local storage on your device for analytics, and we do not use advertising or cross-site tracking cookies of any kind.
• We do not sell your personal data, and we do not share it for cross-context behavioural advertising.
• We honour recognised browser opt-out signals (Global Privacy Control and "Do Not Track"): if your browser sends one, we do not load analytics at all.
• You have rights over your data, including asking us to delete it, and you can exercise them at any time by emailing hello@cushio.ai.

The rest of this document is the detailed version.

3. What personal data we collect, why, and our legal basis

We practise genuine data minimisation: we collect the least we can while still being able to run a waitlist and keep it free of abuse. The table below lists everything we collect.

3.1 When you join the waitlist

When you submit the waitlist form, we collect and store the following in a database (Cloudflare D1):

Notes on the above:

• We do not store your raw IP address in the waitlist database. We compute a salted, one-way hash of it and store only that hash, purely to detect duplicate or abusive sign-ups. Because we store a salted one-way hash rather than the IP itself, the value we keep is pseudonymised, not anonymous: it cannot be read back to your IP address in normal use, as long as our secret salt stays secret. (Your IP address is, however, briefly processed in transit by our infrastructure and analytics providers as part of how the internet works, see Sections 4 and 5.)
• The waitlist form includes a hidden anti-spam field ("honeypot") that a real browser leaves empty. If it arrives filled in, we treat the submission as automated (a bot), discard it, and store nothing.
• We do not ask for your name, phone number, company, or any other detail. If you include personal information in an email you send us, we will only use it to respond to you.
• The email field is unique in our database: if you sign up twice with the same address, we do not create a second record.

3.2 Our legitimate-interests balancing

Where we rely on legitimate interests above, we have weighed our interest (running a functional, spam-free, minimally measured waitlist) against your rights and reasonable expectations. The data used on this basis is limited, technical, and largely security- or aggregate-analytics-related; we do not use it to build a marketing or behavioural profile of you, and we do not make automated decisions about you. You have the right to object to this processing (see Section 9), and we will stop unless we have compelling legitimate grounds that override your interests.

3.3 Analytics (PostHog), and no cookies

The Site uses PostHog (a product-analytics tool) to understand, in aggregate, how the page is used. Our PostHog configuration is deliberately minimal and, importantly, cookieless:

• No cookies or local storage are used for analytics. PostHog is configured to keep its state in memory only (its persistence: 'memory' setting), so it does not set any cookie or write to your browser's local storage on your device. Because nothing is stored on your device for analytics, there is no cookie banner: there is nothing to consent to store.
• Events are limited to page views and a single custom event, waitlist_joined, together with the form placement and page-version described above. We do not collect anything else through analytics.
• Automatic event capture ("autocapture") is turned off, so we do not capture your individual clicks, form-field interactions, or similar interaction metadata beyond the pageview and the waitlist_joined event.
• Session recording / session replay is turned off, so we do not record your screen, mouse movements, or keystrokes.
• Person profiles are created on an "identified-only" basis (PostHog's person_profiles: 'identified_only' setting), so we are not asking PostHog to create a stored profile for every anonymous visitor.
• PostHog still processes limited technical data (such as your IP address and user-agent) on our behalf, in transit, as an unavoidable part of receiving a web request, but it does so without storing anything on your device.

Because our analytics set nothing on your device and are limited to the aggregate measurements above, we rely on legitimate interests (Art. 6(1)(f)) for this processing. We do not use analytics for advertising, and we do not sell or share the data.

We honour browser opt-out signals. If your browser sends a Global Privacy Control (GPC) or "Do Not Track" (DNT) signal, we do not initialise or load PostHog at all: no analytics runs. You can find further choices in Section 8 (Cookies and analytics).

3.4 Web fonts

The Site's typefaces are self-hosted: the fonts are served directly from our own Site (via Cloudflare, our hosting provider). We do not load fonts from any third-party font service, so viewing the Site does not send your IP address to any outside font provider.

3.5 Server logs and infrastructure

Our hosting and network provider, Cloudflare, processes and may log requests to the Site (including IP addresses and request metadata) to route traffic, serve content, and protect the Site against attacks and abuse. This is standard infrastructure processing on our behalf and is covered by Cloudflare's role as our processor (Section 5) on the basis of our legitimate interests (Art. 6(1)(f)) in delivering and securing the Site.

4. How we use your personal data (purposes)

To be explicit, we use the data described above only to:

1. Operate the waitlist, record that you have joined and prevent duplicate entries.
2. Notify you about Cushio's launch and early-access opportunities (using your email address).
3. Prevent abuse and spam and rate-limit sign-ups (using the salted IP hash and user-agent).
4. Understand basic, aggregate usage of the Site to improve it (analytics).
5. Respond to you if you contact us.
6. Comply with law and enforce our terms where necessary.

We do not use your data for automated decision-making that produces legal or similarly significant effects about you, and we do not engage in profiling for advertising.

5. Who we share data with (processors and sub-processors)

We do not sell your personal data and we do not share it with third parties for their own marketing. We do rely on a small set of trusted service providers ("processors") who process personal data on our behalf and under our instructions to make the Service work:

These providers are bound by their own contractual and data-protection terms to handle personal data appropriately. We may change providers, or add a processor, as the Service develops; if we do, we will update this policy.

We may also disclose personal data if required by law, to respond to lawful requests from public authorities, or where necessary to protect our rights, safety, or property or those of others.

6. International data transfers

The operator and visitors may be located anywhere, and one of our processors is based in, and processes data in, the United States, outside the European Economic Area ("EEA") and the United Kingdom.

• PostHog processes analytics data in the United States.
• Cloudflare is a US-headquartered company operating a global network; our waitlist database is hosted with a European-region preference, but Cloudflare's infrastructure and support may involve access from outside the EEA/UK, and the region preference is not a guarantee of exclusively-EU storage.

Where personal data is transferred outside the EEA or the UK, we rely on the data-transfer terms offered by each provider, in particular the European Commission's Standard Contractual Clauses (SCCs) (and the UK International Data Transfer Addendum where the UK GDPR applies) and, where applicable, an adequacy mechanism such as the EU-US Data Privacy Framework where a given provider is certified. You may request more information about the safeguards that apply by contacting hello@cushio.ai.

7. How long we keep your data (retention)

We keep personal data only as long as we need it for the purposes described above:

• Waitlist data (email and the associated technical fields, see Section 3.1): we keep this until Cushio launches, plus a reasonable period afterwards to complete launch notifications and early access, or until you ask us to delete it or withdraw your consent, whichever comes first. If you ask us to remove you from the waitlist, we action it promptly.
• Analytics data (page-view and waitlist_joined events and associated technical data, Section 3.3): retained according to our analytics provider's standard retention settings, and used only in aggregate.
• Emails you send us: kept for as long as needed to handle your request and a reasonable period afterward.

When data is no longer needed, we delete it or irreversibly anonymise it. You do not have to wait for these periods to lapse, you can ask us to delete your data at any time (Section 9).

8. Cookies and analytics

The Site does not set cookies for analytics, and it does not use advertising cookies or cross-site tracking of any kind.

Our analytics provider, PostHog, is configured to run cookieless: it keeps its state in memory only and does not write any cookie or local-storage entry to your device (see Section 3.3). Because nothing is stored on your device, there is no analytics cookie banner: there is nothing to place there and nothing to consent to storing.

Your choices:

• Global Privacy Control / "Do Not Track": where your browser sends a recognised opt-out signal (such as Global Privacy Control (GPC) or DNT), we do not load analytics at all, and we treat the signal as a valid request to opt out of analytics and of any "sale" or "sharing" as those terms are defined under US state privacy laws, noting that, as stated below, we do not sell or share your personal data in any event.
• Opt out of analytics manually: you can also opt out at any time by using your browser's privacy controls to block the analytics domain (us.i.posthog.com).

9. Your rights under the GDPR (EEA / UK visitors)

If you are in the EEA or the UK, you have the following rights over your personal data. You can exercise any of them, free of charge, by emailing hello@cushio.ai. We will respond within the time limits set by law (generally one month under the GDPR).

• Right of access, obtain confirmation of whether we process your data and a copy of it.
• Right to rectification, have inaccurate or incomplete data corrected.
• Right to erasure ("right to be forgotten"), have your data deleted.
• Right to restriction, ask us to limit how we use your data in certain circumstances.
• Right to data portability, receive the data you gave us in a structured, commonly used, machine-readable format.
• Right to object, object to processing based on legitimate interests (Section 3.2). You may also object at any time to use of your data for direct marketing, and we will stop.
• Right to withdraw consent, where we rely on consent (for the waitlist and launch emails), you may withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing before withdrawal. You can withdraw at any time by emailing hello@cushio.ai and asking to be removed from the waitlist; we action removals promptly. Once launch emails begin, every email will also include a one-click unsubscribe link. (There is no email-sending backend yet, so today the reliable route is simply to email us.)
• Right to lodge a complaint, you have the right to complain to a data-protection supervisory authority. Because the operator is based in the Czech Republic, the lead authority is the Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, www.uoou.gov.cz. You may also complain to the supervisory authority in your own country of residence or workplace (for example, in the United Kingdom, the Information Commissioner's Office). We would appreciate the chance to address your concerns first, so please consider contacting us before you do.

To protect your data, we may need to verify your identity before acting on a request (for example, by confirming the request comes from the email address on file). We will not charge a fee unless a request is manifestly unfounded or excessive, and we will tell you if that is the case.

10. Your rights under US state privacy laws (including California, CCPA/CPRA)

If you are a resident of California or another US state with a comprehensive privacy law, you may have the following rights, which you can exercise by emailing hello@cushio.ai:

• Right to know / access, what personal information we collect about you, the purposes, and the categories of recipients.
• Right to delete, request deletion of the personal information we hold about you.
• Right to correct, request correction of inaccurate personal information.
• Right to opt out of "sale" or "sharing", we do not sell your personal information, and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of. We will honour a Global Privacy Control signal as an opt-out request regardless.
• Right to non-discrimination, we will not discriminate against you for exercising any of these rights.

For the purposes of the CCPA/CPRA, since the Site began operating (and in any 12-month look-back period), we have collected the categories of personal information described in Section 3:

• Identifiers, your email address and a salted IP hash; and
• Internet or other electronic network activity information, page-version, placement, coarse country, user-agent, and analytics events.

We collect these for the business purposes described in Section 4, and we retain them for the periods described in Section 7 (identifiers and network-activity information collected via the waitlist are retained on the waitlist-data timeline; analytics network-activity information is retained on the analytics timeline). We have not sold or shared any personal information, and we do not collect sensitive personal information for the purpose of inferring characteristics.

You may use an authorised agent to submit a request on your behalf; we may require proof of authorisation and verification of your identity. If we deny a request, you may appeal by replying to our response.

11. Children's privacy

The Service is not directed to children, and we do not knowingly collect personal data from anyone under the applicable age of digital consent in their country. That age varies by country; in the Czech Republic it is 15. If you are under the applicable age in your country, please do not use the Service or submit your email address.

As a US-specific addition, and consistent with the US Children's Online Privacy Protection Act ("COPPA"), we do not knowingly collect personal information from children under 13.

If you believe a child has provided us with personal data, please contact hello@cushio.ai and we will delete it promptly.

12. Security

We take reasonable and appropriate technical and organisational measures to protect personal data, given the limited and low-sensitivity nature of what we collect. These measures include serving the Site over encrypted connections (HTTPS/TLS), storing a salted one-way hash of IP addresses rather than the raw IP, minimising the data we collect, limiting who can access the waitlist data, and relying on reputable infrastructure and analytics providers. The salted hash is pseudonymised, not anonymous: it cannot be read back to your IP address in normal use, as long as our secret salt stays secret.

However, no method of transmission over the internet or of electronic storage is completely secure, and we cannot and do not guarantee absolute security. In the event of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will act in accordance with applicable law, including notifying the relevant supervisory authority and, where required, affected individuals.

13. Third-party links

The Site may contain links to third-party websites or resources that we do not operate or control. This Privacy Policy does not apply to those third parties. We are not responsible for the content, privacy practices, or security of any third-party site, and the inclusion of a link does not imply our endorsement. We encourage you to review the privacy policy of any third-party site you visit.

14. Changes to this Policy

Because Cushio is pre-launch and evolving, we may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top, and, where the changes are material, we will take reasonable steps to inform you (for example, by a notice on the Site or, where appropriate and where we have your email, by email). We will always update this Policy before the product begins processing personal data in any way materially different from what is described here.

We encourage you to review this page periodically. Where a change would materially expand how we use personal data that we process on the basis of your consent (for example, using your email address for a genuinely new purpose beyond launch and early-access notifications), we will ask for your fresh, specific consent before making that change, rather than treating your continued use of the Site as acceptance.

15. This notice, and what you actually agree to

This document is a transparency notice, not a contract. Its purpose is to tell you plainly what data we handle and why. Simply browsing the Site is not "agreement" to anything, and reading this notice does not sign you up to a bargain.

The only thing we rely on your consent for is: adding your email address to the waitlist and emailing you at launch and about early access. You give that consent by submitting the waitlist form, and you can withdraw it at any time (see Sections 7 and 9). Everything else described here (security, spam-prevention, coarse aggregate analytics, and serving the Site) runs on our legitimate interests, not on your consent.

For the terms that do govern your use of the Site as a legal agreement, see our separate Terms of Service.

16. Governing law

This Privacy Policy is governed by the laws of the Czech Republic, without prejudice to any mandatory data-protection rights or protections available to you under the laws of your own country of residence.

17. Contact

For any questions about this Privacy Policy, or to exercise any of your rights, contact:

Vadim Seliukov, operator of Cushio Email: hello@cushio.ai Address: Husitská 677/15, 130 00 Praha 3-Žižkov, Czech Republic