Privacy policy

SUPERPUBLIC GmbH, Schiffbauerdamm 5, 10117 Berlin, Germany.
Email: media@superpublic.space

We have not appointed a data protection officer because we are not legally required to. Use the address above for any data protection request.

When you sign up on our apply page we process your email address and, if you fill it in, your free text answer to the question what you are building. The answer is stored as the contact attribute COMPANY.

Purpose: sending you updates about SUPERPUBLIC, Batch 001, application windows and shoot dates, and getting in touch with you about your application.

Legal basis: your consent, Art. 6(1)(a) GDPR. We use a double opt in: after the form we send one confirmation mail. Only after you click the confirmation link do we add you to the list. Until then no marketing mail is sent.

To prove the consent we store the confirmation event including date, time and the IP address used for the confirmation.

Withdrawal: every mail contains an unsubscribe link, and you can write to the address above at any time. Withdrawing does not affect the lawfulness of processing before the withdrawal.

Storage period: until you withdraw your consent or the list is discontinued. After unsubscribing your email address is kept on a suppression list so we do not mail you again by accident, based on our legitimate interest, Art. 6(1)(f) GDPR.

To apply for Batch 001 you create an account. We process your email address, your password in hashed form, and, if you sign in with Google, the email address and name Google returns to us. Inside your Hub we store what you enter for your application: startup name, link to your application video, your Instagram or TikTok link, your pitch deck and, if you upload one, your business plan.

Purpose: running the application process you asked us to run, including saving your draft so you can continue later, reminding you by email if your application is still unfinished, reviewing it, and listing accepted applicants in the applicant directory with startup name and video link only.

Legal basis: Art. 6(1)(b) GDPR, since the processing is necessary to handle the application you initiated. Marketing mail beyond your application status is separate and only goes out with the consent checkbox in your Hub, Art. 6(1)(a) GDPR.

Uploaded files are stored in private storage and are not publicly accessible. Our review team opens them through short lived signed links.

Other applicants: once you submit, other signed in applicants see three things in the Hub, your profile picture, your preferred name, or your first name if you did not set a preferred name, and the link to your application video, plus your startup name if you entered one. Your email address, your phone number, your files and any internal score are never shown to other applicants. You consent to this when you create your account.

Storage period: application data is kept for the duration of the selection process and for up to 12 months afterwards so we can consider you for a later batch. You can ask us to delete your account and your application at any time using the contact address above, and we delete it unless we are legally required to keep it.

Newsletter delivery runs on Brevo, operated by Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France. Brevo acts as our processor under a data processing agreement pursuant to Art. 28 GDPR. Data is processed on servers inside the EU.

Brevo records whether a mail was delivered, opened and whether links in it were clicked. We use that only to see whether our mails work at all and to keep the list clean. Your consent to the newsletter includes this measurement. If you do not want it, do not confirm the subscription or unsubscribe again.

This website is hosted by Lovable Labs Incorporated on infrastructure operated by Cloudflare and Supabase. When you open a page, technical data is processed automatically: IP address, requested URL, referrer, date and time, browser and operating system. This is necessary to deliver the site and to keep it secure, legal basis Art. 6(1)(f) GDPR. Logs are kept only for a short period and then deleted.

We do not set advertising cookies and we do not run third party analytics on this site.

We only store what the site needs to run without asking: your login session and security related state. That is legal basis Art. 6(1)(f) GDPR and Section 25(2) TTDSG. Everything optional stays switched off until you actively agree in the consent banner, legal basis Art. 6(1)(a) GDPR and Section 25(1) TTDSG.

The categories are: Necessary (always on), Attribution (campaign parameters, see section 6), Analytics and Marketing. We currently run no third party analytics and no advertising cookies, so Analytics and Marketing have no active tools. Your choice is stored locally in your browser together with a timestamp.

You can change or withdraw your decision any time through the Cookie settings link in the footer. When you withdraw a category, data stored in your browser for it is deleted right away.

When you arrive through a link that carries campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term) we store those values, the landing path and the domain that referred you in your browser local storage for up to 30 days. There is no cookie, no device id and no cross site tracking. If you start an application, this first touch information is saved once with your application so we can see which channel works. This only happens if you agreed to the Attribution category, legal basis Art. 6(1)(a) GDPR. You can delete it any time by withdrawing that consent, and it is deleted together with your account and your application.

Fonts are served from our own hosting, so no request goes to a third party for typography. Where we link to YouTube, TikTok, Instagram or LinkedIn, these are plain links. Nothing from those platforms loads until you click.

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21), plus the right to withdraw consent at any time (Art. 7(3) GDPR). Send your request to the email address in section 1.

You can also lodge a complaint with a supervisory authority. Ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin.

We update this policy when our setup changes. The version you are reading is the current one.