Privacy
What Typestate collects, why, and what you can do about it. As of 20 October 2026.
Controller
Lütfi Demirci, Typestate, Neckarstr. 21, 12053 Berlin, Germany.
Telephone +4x9 qz17null6 nope94094spam01wz98, email hexllqzo@nulltynopepe0stspamatwze.nocoxm
No data protection officer is appointed, because the thresholds that require one (Article 37 GDPR, section 38 BDSG) are not met.
What this notice covers
The website typestate.com and its forms, the cockpit at platform.typestate.com and the MCP server at mcp.typestate.com. We are the controller for your account, your use of the service and your messages to us (Article 4(7) GDPR).
The data that customers store about their own users in their own backends we process on the customer's behalf (Article 28 GDPR, see the data processing agreement). The customer is then the controller. Users of such a backend contact the customer.
Visiting the website
Your browser sends what is technically necessary to serve the page: your IP address, the date and time, the address requested, how much data was sent, and your browser and operating system.
Legal basis: Article 6(1)(f) GDPR. The legitimate interest is serving the site and defending it against attack.
The website is served by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, so this is a transfer to the United States. Cloudflare is certified under the EU-US Data Privacy Framework (Article 45 GDPR) and also relies on the European Commission's standard contractual clauses.
The website sets no cookies and loads nothing from other servers. There are no advertising networks, no profiling and no social media embeds.
Counting page views
This site counts its visitors with Plausible Analytics, from Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia. A script from plausible.io sends one event for each page you open, and one when you submit a form, follow a link to another site or download a file.
Plausible records the address of the page, the page you came from, your browser, operating system and device type, your country, region and city, and how far you scroll and how long the page is open. It takes the browser and operating system from your browser's identification string and the location from your IP address, and it stores neither the IP address nor that string.
Plausible sets no cookies and stores nothing in your browser. To count one visitor once a day, it makes a hash from your IP address, your browser's identification string, the name of this site and a value that it changes every day. It deletes that daily value after 24 hours, so a visit tomorrow cannot be connected with a visit today.
Plausible stores each event and visit to make its statistics, and we see only the totals on its dashboard. Plausible keeps the data on servers in Germany and processes it on our behalf under a data processing agreement.
The platform at platform.typestate.com, where you sign in and manage your account, also counts with Plausible, and it runs no script in your browser for it. Our server sends Plausible one event for each page you open there. It sends one more when you view the sign-up page, open your account, sign in for the first time, connect your first agent, create your first service, and put a service online for the first time, for testing or for your customers. Each event holds the address of the page without any code, token or name in it, and the domain of the site you came from. The request carries the identification string and the IP address of the browser or agent that acted. Plausible uses them for the daily hash above and stores neither. An event never holds your email address or the name of your account.
Legal basis: Article 6(1)(f) GDPR. The legitimate interest is knowing which pages people read, so that we can improve them.
The contact form
Stores your name, your email address, your message, the time it arrived, and your company if you give one.
Legal basis: Article 6(1)(b) GDPR where the enquiry is heading towards a contract, otherwise Article 6(1)(f), the legitimate interest being to answer enquiries.
We use your email address only to answer your enquiry. We do not sell it, we do not pass it to anyone for their own purposes, and we do not add it to a newsletter or any other mailing list.
Your message is deleted once the enquiry is finished, at the latest after 12 months, unless a statutory retention period applies to it.
The form has one field that people never see. If it is filled in, the submission is treated as automated and discarded without being stored.
While you type, your browser keeps a copy of the form in this tab (session storage), so a failed send does not lose your text. The copy never leaves your browser, and it is gone when you close the tab or the message arrives. Legal basis: section 25(2) no. 2 TDDDG.
Asking for an account
When you choose a plan on typestate.com and send the form, we store your email address, the plan, the language and, if you give them, your name, your company, your agent and what you are building.
Purpose: to contact you. Legal basis: Article 6(1)(b) GDPR.
Storage: 12 months.
The notification list
Stores your email address, the page you left it on, and the time.
Legal basis: your consent, Article 6(1)(a) GDPR. You can withdraw it at any time by email. Withdrawing does not affect processing that already happened. After you withdraw, we delete your address.
Where form data is stored
Submissions from the contact form, the account request and the notification list are stored by a Typestate backend in a database at Cloudflare, Inc. (USA). The basis for the transfer is the same as for visiting the website.
Your account on the platform
Data: email address, password (stored only as a hash), account name, team members with their email addresses, time of the last sign-in, the chosen plan and budgets.
Purpose: to perform the contract and protect access. Legal basis: Article 6(1)(b) GDPR.
Location: sign-in data is held by a platform service that runs on Cloudflare. The rest of the account data is held in the database on our server at Hetzner in Germany.
Storage: until the contract ends, then 30 more days, then deletion (terms, section 7). Invoices and accounting records are kept as long as the law requires, up to 10 years (section 147 AO, section 257 HGB); the legal basis for that is Article 6(1)(c) GDPR.
Abuse protection: at each sign-in attempt and each new account we count the IP address and the email address for a short window, to stop automated sign-ups. These counters are held in memory only and never stored. Legal basis: Article 6(1)(f) GDPR.
The cockpit cookie
The cockpit sets one cookie, named _typestate_key. It holds the email address of the signed-in person, the account identifier and the time of sign-in, and it is signed so that it cannot be changed.
It keeps you signed in across pages. The cockpit does not work without it. Legal basis: section 25(2) no. 2 TDDDG (strictly necessary, no consent needed), and Article 6(1)(b) GDPR for the processing after that.
It lasts until you close the browser. The platform refuses a sign-in older than 7 days. The cockpit sets no other cookies and runs no counting script in your browser.
Your agent's connections (MCP)
Data: the name and version of the agent program, the label of the key used, the IP address, the start and last activity of the session, and each action the agent takes.
Purpose: to show you what your agent did, to find faults and to detect abuse. Legal basis: Article 6(1)(b) GDPR, and point (f) for abuse detection.
Storage: 90 days.
Your content and the compiler
We store your descriptions, tests, settings, secret values (encrypted), messages to us and the records of your backends, to provide the service. Legal basis: Article 6(1)(b) GDPR. Storage: as long as your account.
The platform turns your descriptions and tests into program code with a language model. For that they are sent to OpenRouter, Inc. (USA), which passes them to Deep Infra Inc. (USA), which runs the open DeepSeek model, and in some cases to Anthropic Ireland, Limited (Ireland), which uses Anthropic, PBC in the United States for it. With OpenRouter and Deep Infra there is no contract under Article 28 GDPR and there are no standard contractual clauses yet; we have asked for both. The records of your backends and the data of your users are never sent to a language model provider. Do not write personal data of your users into descriptions and tests.
We do not use your content to train language models.
Server logs
Data: IP address, time, address requested, status code, browser identifier, and platform log output that can contain account identifiers and email addresses.
Purpose: operation, fault finding and defence against attack. Legal basis: Article 6(1)(f) GDPR.
The logs are collected at Better Stack in a data centre in Nuremberg. Storage: at most 30 days; on the server itself at most 250 MB.
The platform's email (sign-in, confirming your address, password) is sent through Plus Five Five, Inc. (Resend), USA. This processes your email address and the content of the email.
Email to hello@typestate.com is held in a Google Workspace mailbox (Google Cloud EMEA Limited, Dublin, Ireland). We delete it once the matter is closed, unless a statutory retention period applies.
Payments
When you order a paid plan, the payment is handled by Stripe Payments Europe, Limited, Dublin, Ireland. You enter card or bank details only at Stripe; they never reach our servers. We store the Stripe identifiers of the customer, subscription, payment and invoice, the amounts and the status.
Stripe is itself the controller for the payment data. Stripe can transfer data to Stripe, LLC in the United States, which is certified under the EU-US Data Privacy Framework. Legal basis: Article 6(1)(b) and (c) GDPR.
Recipients and transfers to third countries
Who processes data on our behalf, where and on which basis is listed on the subprocessors page. We have a contract under Article 28 GDPR with each of them, except OpenRouter and Deep Infra, where it has been requested. A transfer to the United States rests on the EU-US Data Privacy Framework (Article 45 GDPR) or on standard contractual clauses (Article 46(2)(c) GDPR).
Authorities receive data only where the law requires it.
Automated decision making
There is no automated decision within the meaning of Article 22 GDPR. The platform stops Sandbox when the plan's limit is reached; that is an agreed quantity limit and not a decision about you.
Giving your data is optional
The website requires nothing of you. For an account we need your email address and a password; without them we cannot open an account.
Your rights
You have the right of access, correction, deletion, restriction of processing and data portability (Articles 15 to 20 GDPR). You can withdraw a consent at any time with effect for the future (Article 7(3) GDPR). Write to the address above.
Right to object: where processing rests on a legitimate interest (Article 6(1)(f) GDPR), you can object to it at any time on grounds relating to your particular situation (Article 21 GDPR).
You can also complain to a supervisory authority. The competent one is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin.