Privacy notice

Updated 2026-10-08

Privacy notice

This notice covers the verdical.dev website, its visitor statistics, and the Verdical waitlist: the sign-up form and the emails that follow it. It says what we store about you, why, for how long, who else handles it, and how you delete it.

Who is responsible

The data controller is Torsvik Labs, an enkeltpersonforetak (sole proprietorship) owned by Jakob Martin Torsvik, org. no. 937 316 704, Norway. Write to privacy@torsviklabs.com about anything in this notice.

What we store

When you sign up:

Your email address.
Your answers, if you give any: how you build with agents today, the tools you use, the features that matter to you, what you would pay, and what you think is missing. Every question is optional.
Your consent: the text you agreed to, its version, and when you agreed.
When you signed up and when you confirmed, which version of the form you used, and where the sign-up came from (for example, the landing page).
How you found verdical.dev, if your browser tells us: the name of the website that sent you (for example, news.ycombinator.com, never the full address of the page), and the campaign tags of the link you arrived by (utm_source, utm_medium and utm_campaign, for example "newsletter", "email" and "launch"). The page with the form reads them when it opens and sends them with the form; nothing is saved in your browser.

To protect the form against abuse, we also keep, for about a day, a keyed hash of your IP address and of your email address, so we can count how many sign-ups come from one network and how many emails go to one address. The hash cannot be turned back into the address without a key that never leaves our database. An hourly job deletes these hashes once they are 24 hours old.

The companies that host the site and the sign-up service keep ordinary server logs (such as IP address, time and browser), and our email provider keeps a log of the emails it delivered (address, subject and time), for a limited period under their own retention rules, to run and secure their services. These logs are not part of the waitlist.

We do not use cookies, advertising trackers or session recording, and our emails contain no tracking pixels or tracked links.

Visitor statistics

To see how many people visit verdical.dev, which pages they read, where they come from, and how fast the pages load, the site uses Vercel Web Analytics and Vercel Speed Insights. Both are run by Vercel, which hosts the site, and are loaded from verdical.dev itself.

We set no cookies for them.
Page addresses are sent without tokens or query parameters: before a page view is sent, we remove everything after # and every query parameter except the three campaign tags above.
We only see totals, such as visits per page, per referring website or per country, never an individual visitor.
Vercel processes the data as our processor. How it handles it is described in Vercel's privacy policy.

The legal basis is our legitimate interest in knowing whether the site works and reaches people (GDPR article 6(1)(f)). The statistics are never linked to a waitlist sign-up.

Why, and on what legal basis

To keep you on the waitlist and email you about the beta and the launch of Verdical. The legal basis is your consent (GDPR article 6(1)(a)).
To learn what people need from Verdical, from your answers. The legal basis is your consent (GDPR article 6(1)(a)).
To learn which places and campaigns bring people to the waitlist, from the website that sent you and the campaign tags. The legal basis is our legitimate interest in knowing where to tell people about Verdical (GDPR article 6(1)(f)).
To stop abuse of the form, with the short-lived hashes above. The legal basis is our legitimate interest in keeping the service working (GDPR article 6(1)(f)).

You will get a confirmation email first. Until you click the link in it, you are not on the waitlist.

We do not sell your data, share it with advertisers, or use it to email you about anything other than Verdical.

How long we keep it

If you do not confirm, your sign-up is deleted 7 days after the latest sign-up with your address (by an hourly job, so within the hour after).
If you confirm, we keep your sign-up for as long as the waitlist runs. When the waitlist closes, we delete it.
If you ask us to delete it, it is deleted at once (see below).

The website that sent you and the campaign tags are part of your sign-up: they are kept and deleted with it.

Who handles it for us

These companies process the data on our behalf, under data processing agreements:

Supabase stores the waitlist on servers in the EU (Stockholm, Sweden) and runs the sign-up service in the EU (Frankfurt, Germany).
Resend sends the emails, from its EU region (Ireland).
Vercel hosts the verdical.dev website and runs its visitor statistics (see above).

Some of these companies are based in the United States. Where data leaves the EEA, the transfer relies on the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.

Your rights

You can ask to see the data we hold about you, to correct it, to get a copy of it, or to have it deleted. You can withdraw your consent at any time; that does not affect what we did before you withdrew it. You can also object to how we use your data.

To delete everything at once, use the delete link at the bottom of any email from the waitlist. Your sign-up and your answers are deleted straight away, and you get one last email saying so. The rate-limit hashes for your address stay until they are a day old, so the form cannot be abused by signing up and deleting over and over. The provider logs described above are not deleted at once; they expire under the providers' own rules. For anything else, write to privacy@torsviklabs.com.

If you think we handle your data wrongly, you can complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no), or to the data protection authority where you live.

Changes

If this notice changes, we update the date above. If a change affects what you agreed to, we ask for your consent again.