Privacy notice

Waitlist and website. Last updated: 19 October 2026 (draft).

This notice explains what happens to your data when you visit ajoris.com or join the Ajoris waitlist. The short version: we only ask for your email, we use it only to send you Ajoris updates, and we don't sell it.

Who is responsible

The data controller is Dimas Tabro, an individual based in Indonesia.

Contact: privacy@ajoris.com for anything about your data, or hello@ajoris.com for everything else.

What we collect

• Your email address, when you join the waitlist. That's the only thing the form asks for.
• Sign-up details. When you join, the form also sends: the page address (including campaign tags such as utm_source, if the link had them), the page you came from, which version of the page you saw, and a random ID that exists only while the page is open.
• Form views. When this page loads, Kit's form script tells Kit the sign-up form was shown, with the page address, the page you came from and the same random page-only ID. This lets Kit count form views. It doesn't include your email.
• Email activity. Kit, our email provider, records whether you confirm, and whether you open and click our emails. It does this with tracking pixels and tracked links. It also handles technical data such as your IP address.
• Visit counts. We count page visits with PostHog without cookies. PostHog briefly receives your IP address and browser type, turns them into a code that changes every day, and doesn't store the IP address. No email, no profile, nothing stored on your device.

Sensitive data

Because Ajoris is made with ADHD folks in mind, being on this list could suggest something about your health. We never ask about diagnosis, medication or symptoms. By confirming your sign-up you explicitly agree to us holding your email on this list.

Cookies and your device

Ajoris sets no cookies and saves nothing on your device. We also stop Kit's form script from saving its own ID in your browser. One thing we can't switch off: Kit delivers its form script through Cloudflare, which may set a single security cookie (__cf_bm) that expires after 30 minutes. It helps tell people from bots and isn't used to follow you around the web.

Why we use it, and on what basis

• Waitlist emails: to tell you when Ajoris launches and send the occasional short update. The basis is your consent (GDPR and UK GDPR Art. 6(1)(a), and Art. 9(2)(a) to the extent it reveals health information). You give it in two steps: by joining with the form, which says you agree to get Ajoris emails, and then by confirming with the link in the first email we send you. Until you confirm, we send you nothing else, and unconfirmed sign-ups are deleted after 30 days. You can withdraw it anytime with the unsubscribe link in every email, or by emailing privacy@ajoris.com. Withdrawing doesn't affect what we did before.
• Visit counting: to know how many people visit and which version of the page works better. The basis is our legitimate interest in understanding, in aggregate, whether the page works (Art. 6(1)(f)). We think this is fair because the counting uses no cookies, stores nothing on your device, doesn't store your IP address, never involves your email, and only produces totals. You have the right to object to this at any time: email privacy@ajoris.com. Because we keep nothing that identifies you, we usually can't pick out your visits, so a content blocker that blocks PostHog is the quickest way to leave them out.

Giving us your email is optional. Without it we just can't tell you about the launch. We don't make automated decisions about you.

Who handles it for us

• Kit (Kit Inc., USA): stores the waitlist and sends our emails. Subprocessors: kit.com/dpa (Attachment 3).
• PostHog (PostHog Inc.): counts visits. Data is stored on PostHog's EU servers in Frankfurt, Germany, and some processing may happen in the US. Subprocessors: posthog.com/subprocessors.
• Cloudflare (Cloudflare Inc., USA): hosts this website and forwards emails sent to privacy@ and hello@ajoris.com.

Each works on our instructions under a data processing agreement. We don't sell your data.

International transfers

Ajoris is run from Indonesia, and Kit and Cloudflare are in the US. For Kit, we rely on the EU Standard Contractual Clauses (Module 2) in Kit's data processing agreement, plus the UK International Data Transfer Addendum for people in the UK. PostHog's and Cloudflare's agreements also include the Standard Contractual Clauses. You can read them at kit.com/dpa, posthog.com/dpa and cloudflare.com/cloudflare-customer-dpa, or ask us for a copy.

How long we keep it

• We keep your email until you unsubscribe.
• If you sign up but don't confirm, we delete your email after 30 days.
• If Ajoris doesn't launch, we send a short note and delete the list within 30 days.
• After launch, we delete anyone who hasn't clicked one of our emails within 6 months.
• If you haven't clicked any of our emails for 24 months, we send one email asking you to confirm you still want updates. If you don't confirm, we delete your email.

When you unsubscribe, we may keep a record that you opted out, only so we never email you again. Ask us and we'll delete that too.

Your rights

You can ask to see, correct or delete your data, to restrict or object to how we use it, and to get a copy you can take elsewhere. Email privacy@ajoris.com. We reply within one month.

Complaints

If you're unhappy with how we handle your data, email privacy@ajoris.com first. We'll acknowledge your complaint within 30 days and tell you what we've done about it.

You can also complain to a data protection authority:

• EU/EEA: the authority in the country where you live or work, or where you think the problem happened. Find yours on the EDPB members list. Ajoris has no establishment in the EU, so there is no single lead authority; your local one is the right place.
• UK: the Information Commission, at ico.org.uk/make-a-complaint.

Changes

If we change how we use your email, we'll tell you by email before the change applies. The date at the top shows the latest version.