Privacy Policy
What this site collects, why, and how to have it removed.
Last updated 12 October 2026
Who is responsible
SannaCFO is a product in development. The people responsible for it, and for the personal data described on this page, can be reached at hello@sannacfo.com.
For anything about your data, write to hello@sannacfo.com.
What this website collects
One thing that says who you are: the email address you type into the waitlist form, together with the time you submitted it and a note that it came from this website. Apart from that there are only the visitor statistics described below, which do not identify you. The unsubscribe form takes an address too, but only to find and delete the matching row: it is not stored.
After you submit the form we send one email to that address with a link to confirm it. Until the link is opened the address is not on the list and gets nothing else from us; if it is not opened within seven days, the address is deleted. We keep the time the confirmation was sent and the time it was given, as the record of your consent.
SannaCFO is not available yet. There is no account to create and no product to sign in to, so no revenue, usage or cost data of yours is collected or processed by us.
There is no advertising on this site, and nothing follows you from it to another site. The scripts, fonts and images are all served from this domain.
Visitor statistics
We count visits and measure how fast the pages load, using two services of our hosting provider: Vercel Web Analytics and Vercel Speed Insights. They set no cookies and store nothing on your device.
With each page view the following may be recorded: the time, the page address, the site you came from, the country, region and city your connection appears to come from, your browser and operating system with their versions, whether the device is a phone, tablet or computer, your network speed, and the loading times your browser measured for the page.
To count a visitor once and not once per page, Vercel works out a hash from the incoming request. It is discarded after 24 hours, so a visit on one day cannot be linked to a visit on another, or to a visit to any other website. Your IP address is not stored with the statistics, and we see them only as totals. Nothing in them is connected to an address on the waitlist.
We do this to learn which pages are read and to keep the site fast, which is our legitimate interest (Article 6(1)(f) of the GDPR). You can object to it by writing to hello@sannacfo.com. A browser extension that blocks such scripts stops the counting too, and the site works the same without it.
Why, and on what legal basis
We use your address to send you emails about SannaCFO: how the release is going, development updates, and the news that it is available. We use it for nothing else.
The legal basis is your consent (Article 6(1)(a) of the GDPR), which you give by submitting the waitlist form and confirming your address by email. Giving it is voluntary. You can withdraw it at any time: on the unsubscribe page, with the unsubscribe link in any email we send, or by writing to hello@sannacfo.com. Withdrawing it does not affect anything done before you withdrew it.
Who else can see it
We use a small number of service providers, who process the data only on our instructions and under their own data processing terms:
- Vercel serves this website, runs the functions that receive the forms, and provides the visitor statistics described above.
- Supabase stores the waitlist table the address is written to.
- Resend sends the emails described above.
Your address is never sold, never rented, and never passed to anyone for their own purposes.
Transfers outside the EEA
Some of these providers are based in, or have infrastructure in, the United States. Where your data is transferred outside the European Economic Area, the transfer is covered by an adequacy decision of the European Commission or by its standard contractual clauses. You can ask us for more detail at the address above.
Your IP address
The waitlist and unsubscribe forms are rate limited, which means the server briefly holds the IP address a submission came from so it can count recent attempts. It is kept in memory only, for at most ten minutes after an attempt, and is never written to the database. We do this to protect the form from abuse, which is our legitimate interest (Article 6(1)(f) of the GDPR). Our hosting provider keeps its own request logs, as any host does.
How long it is kept
Until you unsubscribe or ask for it to be deleted. If the waitlist is closed, or the project is discontinued, the list is deleted. To have your address removed, enter it on the unsubscribe page, which deletes it from the list at once, or write to hello@sannacfo.com; no reason is needed.
Your rights
Under the GDPR you can ask for a copy of what we hold about you, ask for it to be corrected or deleted, ask us to restrict how it is used, object to how it is used, or ask for it in a portable form. You can also withdraw your consent at any time. Write to hello@sannacfo.com and we will answer within one month.
You also have the right to complain to a data protection authority, in particular the one in the country where you live or work.
No automated decisions
We do not use your address for profiling or for any decision made by automated means.
Changes
If this page changes, the date at the top changes with it. A change that affects what we do with an address already on the list will be sent to that address before it takes effect.