Privacy Note

Last updated: 19 October 2026

This note explains how mycorra handles your personal data under the GDPR. The data controller is Exaptation GmbH, Osterbrooksweg 35-41, 22869 Schenefeld, Germany — contact mycorra.dispose365@passmail.net.

What we collect

• Account: your email address, and — if you enable them — passkey credentials and an encrypted two-factor secret.
• Billing: the invoice address you enter and payment metadata (amount, date, status, reference). Card/bank details are handled by Mollie, not by us.
• Usage: per-call records — timestamp, token counts, and cost — used for billing and your usage history.
• Prompts: the text you submit for inference is forwarded to our upstream model provider to produce a response.
• Waitlist: if you join the waitlist, your email address, whether you joined as someone who uses apps or builds them, and when you signed up and confirmed. See Waitlist.
• Website statistics: anonymous visit statistics collected without cookies. See Website statistics.
• Server logs: when you load a page, our servers log the request: time, requested address, browser identifier and a shortened (masked) IP address, and for signed-in requests your account email. See Server logs.

We do not use tracking cookies. The only cookie is a signed sign-in session cookie (and a short-lived one during payment return).

Why, and on what legal basis

• To provide the Service and process your inference — performance of a contract (Art. 6(1)(b)).
• To issue and retain VAT invoices — legal obligation (Art. 6(1)(c)); German tax law requires retention for up to 10 years.
• To keep the Service secure and prevent abuse — legitimate interest (Art. 6(1)(f)).
• To keep you on the waitlist and tell you when your spot opens — your consent (Art. 6(1)(a)), which you can withdraw at any time.
• To understand how the website is used and improve it, through anonymous statistics — legitimate interest (Art. 6(1)(f)). You can object at any time; see Website statistics.
• To run the servers, find errors and fend off attacks, through short-lived server logs — legitimate interest (Art. 6(1)(f)).

Providing your data is voluntary, but without an email address we can't create your account or put you on the waitlist. We don't make decisions based solely on automated processing, and we don't profile you.

Waitlist

When you join the waitlist we store your email address, the option you picked ("I use apps" or "I build apps"), the time you signed up and the time you confirmed. We then send you an email with a confirmation link (double opt-in). Your signup only counts once you click that link.

We use your address only to tell you when your spot opens and to let you create an account. We don't send newsletters or advertising, and we don't pass your address to anyone. The emails are sent from our own mail server.

• Unconfirmed signups are deleted automatically after 7 days.
• Confirmed signups are deleted when you create your account, when you leave the waitlist, or at the latest 12 months after you signed up.
• Leaving: every waitlist email contains a link to leave the list, which deletes your address immediately. You can also email us.

Withdrawing your consent doesn't affect the lawfulness of anything we did before you withdrew it.

Website statistics

We measure how our website is used with Plausible Analytics, open-source software that we run on our own servers. No data is sent to Plausible's makers or any other third party.

Plausible sets no cookies and builds no profile of you. It records the page you visit, the referring website, your browser, operating system, device type and country, and interactions on our homepage such as clicking a button or opening a question. To count unique visitors it uses a hash of your IP address and browser together with a salt that is changed every 24 hours, so a visit can't be linked to you or to your visits on later days. Your IP address itself is not stored.

Objecting: you can exclude your browser from the statistics at any time with the switch at the end of this page. It stores a single opt-out flag in your browser, and only because you ask for it. Blocking the script in your browser works as well.

Server logs

To deliver pages, find errors and protect the Service against abuse, our servers log each request: the time, the requested address, the response status, your browser's identifier and a masked IP address, and for signed-in requests your account email. The logs are deleted automatically after 7 days.

Who processes it

We use these processors, acting on our instructions:

• Mollie (payments) — Netherlands/EU.
• DeepInfra — runs the model that generates the response to your prompt. Your prompt and its response are processed on DeepInfra's infrastructure, which may be outside the EU.

The Service itself, our mail server and the Plausible statistics run on our own servers, not with a hosting provider. Backups of the statistics database are stored with Hetzner Online GmbH (Germany/EU) as our storage processor.

We do not sell your data or use your prompts to train models.

Retention

Account data is kept while your account exists. Invoice data is retained for the statutory period. Waitlist entries are deleted as described under Waitlist. As an alpha service, accounts and data may be reset before launch. Deleting your account removes your account data, except records we must keep by law (e.g. invoices).

Your rights

You may request access, correction, deletion, restriction, or portability of your data, object to processing based on legitimate interest, and withdraw your consent at any time. You can delete your account yourself under Account, and leave the waitlist with the link in any waitlist email. To exercise other rights, email mycorra.dispose365@passmail.net. You also have the right to lodge a complaint with a data-protection authority — in our case, the Hamburg Commissioner for Data Protection and Freedom of Information.

International transfers

Where a processor is outside the EU/EEA (e.g. DeepInfra running the model), transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses.

Contact

Exaptation GmbH · mycorra.dispose365@passmail.net