Privacy policy

Who is responsible

The controller for the processing of personal data on this site, within the meaning of the General Data Protection Regulation (GDPR), is:

• Email: hello@pomeliolabs.com
• Phone: +355 68 424 8524

Hosting and delivery

This site is served through Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, which processes data on our behalf. To deliver the pages and protect them from attacks, Cloudflare processes the technical data your browser sends with every request: your IP address, the address requested, the date and time, and your browser's identification (user agent).

Two kinds of request also reach our own code on Cloudflare: sending the contact form, and calling up an address that does not exist. For those, a technical log with the request data is kept for at most seven days, so that we can find and fix errors.

Legal basis: our legitimate interest in a site that is fast, secure and works, Art. 6(1)(f) GDPR.

Cloudflare runs a worldwide network, so data can be processed outside the EU, including in the USA. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, so transfers to it rely on the European Commission's adequacy decision, Art. 45 GDPR. Cloudflare's data processing agreement also includes the EU standard contractual clauses.

The contact form

When you send the contact form, we process your name and your message, the email address or phone number you give us, or both, plus your business name, the service you are interested in and your approximate budget if you give them, and the language of the page you wrote from. To recognise abuse, we also record the IP address the form was sent from and the time it was sent.

We use this only to answer your enquiry and, if you ask for one, to prepare a quote. We use your phone number only to call you or message you on WhatsApp about this enquiry. We do not use any of it for marketing, and we do not pass it on to third parties.

Legal basis: where your enquiry concerns a possible project, steps taken at your request before entering into a contract, Art. 6(1)(b) GDPR. Otherwise, and for the IP address, our legitimate interest in answering the messages we receive and in recognising abuse, Art. 6(1)(f) GDPR.

The enquiry reaches us as an email, sent through and stored in our mailbox at ALL-INKL.COM - Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, which processes it on our behalf.

We keep your enquiry for as long as we need it to answer and follow it up. If no contract follows, we delete it at the latest two years after our last contact. If a contract follows, it becomes part of our business records and is kept for as long as commercial and tax law require.

Giving us this data is voluntary. Without a name, a message and a way to reach you, by email or by phone, we cannot answer you.

Keeping out spam

The form tells people from bots with a hidden field that only bots fill in, and by rejecting anything sent within two seconds of the page opening. Both checks use only what the form sends anyway.

To stop the form being sent in bulk, we count submissions per connection over ten minutes. For this, a hashed form of your IP address is kept in Cloudflare's storage (Workers KV) and deleted automatically after about eleven minutes.

Once an enquiry has been delivered, a safety copy with the same content as the email is kept in the same storage, in case the email goes missing on its way to us. It is deleted automatically after 30 days. This storage is replicated across Cloudflare's worldwide network; transfers outside the EU are safeguarded as described under Hosting and delivery.

Legal basis: our legitimate interest in a contact form that is not flooded with spam and does not lose enquiries, Art. 6(1)(f) GDPR.

Email, phone and WhatsApp

If you write to us by email or call us, we process what you tell us in the same way, on the same legal bases and for the same periods as an enquiry through the form.

If you message us on WhatsApp, or we message you at the number you left us, the message is carried by WhatsApp, a Meta service, which processes it under its own privacy policy and may transfer data to the USA. If you would rather avoid that, email and phone reach us just as well.

Statistics without cookies

To see which pages are read, we count visits with Plausible Analytics, which we run ourselves on a server we rent from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner processes the data on our behalf, and nobody else receives it. Plausible sets no cookies, stores nothing on your device and builds no profiles. Your IP address is used only for a moment to count unique visits and is not stored. What remains are anonymous totals, such as the pages viewed, how long you stay on a page and how far down you read it, the site you came from, clicks on links to other sites, and the browser, operating system and country. Of the contact form we count only whether it was sent, never what you wrote in it.

Legal basis: our legitimate interest in understanding how the site is used, measured in a way that respects privacy, Art. 6(1)(f) GDPR.

Cookies and your browser

This site sets no cookies and stores nothing in your browser. There is no consent banner because there is nothing to ask consent for.

Before the moving background starts, your browser checks whether your device has a graphics processor. That check happens in your browser only; nothing about it is sent to us.

Your rights

You have the right to access the data we hold about you (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or its processing restricted (Art. 18), and to receive it in a portable format (Art. 20). To use any of these rights, write to the email address above.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work (Art. 77 GDPR). The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.

Your right to object

Where we process your data on the basis of our legitimate interest, Art. 6(1)(f) GDPR, you have the right to object to that processing at any time, on grounds relating to your particular situation (Art. 21 GDPR). We then stop, unless we can show compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims. An email to the address above is enough.

No automated decisions

We make no decisions about you based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR.

Last updated: 24 September 2026