Privacy & GDPR
Karta is operated from Berlin, Germany, and fully complies with the EU General Data Protection Regulation (Regulation (EU) 2016/679, GDPR), the German Federal Data Protection Act (BDSG), and the ePrivacy Directive as implemented in EU/EEA member states.
1. Controller
The controller responsible for processing personal data on this site (Art. 4(7) GDPR) is:
2. What we collect and why
- Waitlist signups: email address, selected role, interface language. Legal basis: your explicit consent (Art. 6(1)(a) GDPR). Used only to contact you about early access.
- Newsletter / marketing: only if you tick the separate, unticked newsletter box and confirm the double opt-in email. You can unsubscribe at any time using the link in every email.
- Proof of consent: a hashed IP address, browser user-agent, timestamp and consent version, stored to prove valid consent (Art. 7(1) GDPR). The raw IP is never persisted.
- Server logs: minimal access logs (request path, status, truncated IP) for security and abuse prevention. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Retained no longer than 30 days.
3. Cookies & tracking
Karta uses strictly necessary first-party storage for your theme, language and consent choice (Art. 6(1)(f) GDPR, no consent required under § 25(2) TTDSG). Analytics and product-usage measurement (Google Analytics 4 by Google Ireland Ltd. and Contentsquare by Contentsquare SA) load only after you press Accept in the cookie banner (Art. 6(1)(a) GDPR, § 25(1) TTDSG). If you decline or ignore the banner, no analytics script is loaded and no analytics cookie is set. Google Analytics runs with IP anonymisation and consent mode. We do not set advertising cookies and do not run cross-site tracking. You can withdraw consent at any time by clearing site data in your browser.
4. Processors & EU hosting
We process data only with vetted providers under a Data Processing Agreement (Art. 28 GDPR). Hosting and database are operated within the EU/EEA. Where a provider may transfer data outside the EEA, we rely on the EU Standard Contractual Clauses (Art. 46 GDPR) and the EU to U.S. Data Privacy Framework where applicable.
5. Retention
Waitlist data is retained until you ask us to delete it, or for up to 24 months of inactivity, whichever comes first. Consent records are kept for the statutory limitation period.
6. Your rights (Art. 15 to 22 GDPR)
You have the right to access, rectification, erasure, restriction of processing, data portability, and objection. You may withdraw consent at any time with effect for the future. Write to hi@kartaspace.com. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), e.g. the Berlin Commissioner for Data Protection and Freedom of Information.
7. Security
Data is transmitted over TLS and stored with row-level security in an EU-hosted Postgres database. Access is limited to the controller. We follow Art. 32 GDPR appropriate technical and organisational measures.
8. Changes
We may update this notice to reflect product or legal changes. The current consent version is 2026-06-19.