Privacy Policy

1. Who is responsible for your data

typetwo is currently run by Luca Ferrara, as a private individual — the company has not yet been formally incorporated. The data controller for the purposes of the GDPR is:

Luca Ferrara
Schillerstr. 41
80336 München, Germany

Contact: lucaferraraeu@gmail.com / +39 347 718 7624

We haven't appointed a Data Protection Officer, since one isn't legally required at typetwo's current size and scale of data processing.

2. What data we collect and why

We only collect what you give us directly through the sign-up forms on this website (on the Home, About Us, and Spartan Race pages), and nothing else — we don't currently collect payment details or any other personal information, since typetwo does not yet sell any product directly through this site. Specifically, when you submit the form, we process:

• Your first and last name, so we can address you personally in our communications.
• Your email address, to add you to our mailing list and contact you about product launches, priority access, and news — only after you've given consent (Art. 6(1)(a) GDPR).
• The language of the page you signed up from (English or Italian), so we can write to you in the right language.
• If you sign up using another visitor's invite link, we record that referral relationship (who invited you) and how many people you've referred — this is what powers the waitlist ranking and the reward milestones we tell you about when you sign up. This is necessary to provide the referral feature itself, so it doesn't rely on separate consent (Art. 6(1)(b) GDPR).
• A hashed version of the IP address you signed up from, kept only to spot abuse patterns like an unusually high number of signups from the same network in a short time — based on our legitimate interest in keeping the referral program fair (Art. 6(1)(f) GDPR).

3. Cookies

We use one strictly necessary cookie on this website. For full details on which cookies we use and why, see our Cookie Policy.

4. Who we share your data with

We use the following service providers (data processors) to run this website:

• Resend — email delivery and mailing list management. Processes your name and email address to send you communications.
• Vercel — website hosting. Processes technical data, such as your IP address, to serve you this website securely.
• Supabase — database hosting for waitlist and referral data. Processes your name, email address, referral relationships, and hashed IP address. Hosted in the EU (Frankfurt, Germany).
• Cloudflare — bot protection on our sign-up form (Turnstile). Processes technical data, such as your IP address and browser characteristics, to tell human visitors apart from automated abuse.

We never sell your data, and we don't share it with anyone else. This website is served entirely over an encrypted (HTTPS) connection, and Resend, Vercel, Supabase, and Cloudflare each maintain their own technical and organisational security measures to protect it.

5. International data transfers

Supabase, our database provider, stores your data in the EU (Frankfurt, Germany), so no international transfer applies there.

Resend, Vercel, and Cloudflare are based in the United States. Where your data is transferred outside the European Economic Area, we rely on their Standard Contractual Clauses and other GDPR-compliant safeguards to keep it protected. You can review these safeguards directly: Resend's Data Processing Agreement (https://resend.com/legal/dpa), Vercel's Data Processing Addendum (https://vercel.com/legal/dpa), and Cloudflare's Data Processing Addendum (https://www.cloudflare.com/cloudflare-customer-dpa/).

6. How long we keep your data

We keep your name and email address for as long as you're subscribed. You can ask us to delete them at any time (see "Your rights" below), and we'll remove them without delay, unless we're required by law to keep them longer.

If someone you referred asks us to delete their data, we remove their record entirely — this will naturally lower your referral count too, since no trace of them remains.

Vercel, our hosting provider, also keeps short-term technical request logs (retained for 1 hour) to operate and secure this website.

7. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Restrict or object to how we process your data
• Receive your data in a portable format
• Withdraw your consent at any time, without affecting anything we did before you withdrew it

To exercise any of these rights, email lucaferraraeu@gmail.com — we'll respond within one month, as required by Art. 12(3) GDPR. You can also lodge a complaint with a supervisory authority — in particular the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA — Promenade 18, 91522 Ansbach, Germany, poststelle@lda.bayern.de), or the authority in your own country of residence.

8. Children

This website isn't directed at children, and we don't knowingly collect data from anyone under 16.

9. Changes to this policy

We may update this policy as typetwo grows — for example, once we start selling products directly, or add new tools to the website. We'll update the date at the top of this page whenever we make changes.

10. Contact

Questions about this policy or your data? Email lucaferraraeu@gmail.com.