SIOLY Clothing

Privacy, in short

• We keep your email address, the language of the page you sign up on and where your signup came from.
• You first get an email to confirm. Without your click you are not on the list.
• We only write to you about SIOLY Clothing, and we do not measure whether you open our emails or which links you click.
• Unsubscribe any time. We then take you off the list, usually within a day, and delete your details. Only the proof of your consent (until the end of the third year after you leave) and a note not to email you again are kept.
• Joining is free. It is not a purchase or a reservation. By joining you confirm you are at least 16.

The details follow below in plain English. The binding text is the German privacy policy, section E: Datenschutzerklärung. Last updated 16 October 2026.

Who is responsible

Noah Sioly UG (haftungsbeschränkt), Hoheluftchaussee 139, 20253 Hamburg, Germany. Email: contact@noahsioly.com. SIOLY Clothing is Noah Sioly’s clothing brand. It is not the Sioly app.

What we keep and why

Your email address, the language of the page you sign up on and where the signup came from (for example the link on noahsioly.com, a marked link from a social network, or a direct visit). We use your address and language for emails about the launch of SIOLY Clothing and new drops, including first access for the waitlist. We also use the source to see how people find SIOLY Clothing; the legal basis for that is our legitimate interest (Art. 6(1)⁠(f) GDPR). Giving your email address is voluntary, but without it you cannot join. Joining is free and does not sign you up for any other newsletter.

Consent, age and confirmation

The legal basis for the waitlist emails is your consent (Art. 6(1)⁠(a) GDPR). You need to be at least 16; by joining you confirm that you are. After you ask to join, you get an email with a button to confirm (double opt-⁠in). Only once you confirm are you on the SIOLY Clothing list. If you don’t confirm, Brevo keeps no entry for you, only the sending log of that email, which it deletes after a month. We send that confirmation email on the basis of our legitimate interest (Art. 6(1)⁠(f) GDPR): we have to make sure, and be able to show, that the signup really came from you (Art. 7(1) GDPR). If you are already on the list, or you unsubscribed from our emails through Brevo before, no new email is sent.

No measuring of opens and clicks

Our Brevo account is set so that Brevo measures opens and clicks only for people who explicitly agreed to it. We do not ask for that on the waitlist. So nobody measures whether you open our emails or which links you click, not even in the confirmation email. If your email app loads images, it fetches the email’s header image from a Brevo server; Brevo then technically receives your IP address and details about your email app, as with any image from the internet.

Sizes and colour, if you want

After confirming, you can tell us which hoodie and jogger size you would pick and which colour you would like next. It is a wish, not an order, and no colour is promised. We keep your answers only at Brevo, with your waitlist entry, and use them to plan sizes and colours. The legal basis is your consent (Art. 6(1)⁠(a) GDPR), given when you send them. Right after saving you can remove your answers on the same page, later by email.

So that the page can match your answers to your entry, our server makes a key for every confirmation email; after you confirm, Brevo sends you on to our page with this key. It holds your email address and language in encrypted form and expires 180 days after the confirmation email was sent. It is made with every confirmation email, even if you never answer. The legal basis for this key is our legitimate interest in offering the optional question without an account or password (Art. 6(1)⁠(f) GDPR). The key also appears in Brevo’s and Vercel’s technical logs and in your browser history. Once the page has loaded and its script runs, it removes the key from the address bar and remembers it only for this browser tab, so the question still works after a reload (§ 25(2) no. 2 TDDDG); when the tab’s session ends, it is gone. The page does not pass it on to other sites.

Email service

Brevo (Sendinblue SAS, Paris, France) sends the confirmation and later emails and keeps the list for us, as our processor. It processes your address, your answers and the sending and confirmation data. Brevo’s own information is in its privacy policy. The waitlist is a list of its own. If you are also on another of our lists, it is the same contact at Brevo.

Proof of your consent

At Brevo, with your entry, we keep the version of the consent text you saw, the time of your request and your language. Brevo writes them only when you confirm, so they also prove the confirmation. They serve only as proof of your consent (Art. 6(1)⁠(c) and (f) together with Art. 7(1) GDPR) and are not used for profiling. We keep the wording of every version separately, without personal data.

The page and the form

Vercel Inc. (USA) delivers these pages through its worldwide network, usually from a location near you. In doing so, Vercel processes technical data such as your IP address, the page you opened, the time and browser details, also in logs that are kept for one to at most 30 days depending on settings. The form, the page shown after a failed signup, the size question, delayed delivery and the cleanup run in Vercel’s data centre in Frankfurt. When you open the page without choosing a language, we use the country Vercel derives from your IP address only to show the German or English version. If you sign up there, we keep that version’s language; the country itself is not stored. Vercel is certified under the EU-⁠US Data Privacy Framework, and standard contractual clauses apply as well; we send you a copy on request. Legal basis: our legitimate interest in a safe, fast and reachable page (Art. 6(1)⁠(f) GDPR).

Protection and delivery

Against spam and repeated requests we turn your IP address and email address into keyed checksums (HMAC). For IPv6 we count shortened network ranges (device, connection, network) instead of the full address. These are pseudonymous, not anonymous, and neither the plain email address nor the plain IP address is stored in the counter and address tables. A network counter expires one hour after it starts. The address entry holds the checksum of the mailbox, the number of requests and their time window, the state (waiting or sent), the language and a random request id; it expires 24 hours after the last allowed request or email. If a signup of that mailbox is still waiting for its email then, it stays until that email is sent or the signup expires. The size question’s counters expire after one hour. A job that runs every minute deletes whatever has expired.

Each server also keeps the mailbox checksum in memory for 15 minutes when a confirmation email went or goes to it, so a short database outage cannot trigger a second email. While the database cannot be reached at all, it also counts, per network, the emails it sends directly (for one minute) and, for the size question, address and network (for one hour). If it is unclear whether such a direct email went out, it keeps the mailbox checksum for 45 minutes. If it cannot tell the database the result of such a direct attempt at once, also when no email went out, it keeps that message for the next request that reaches the database: the checksums of the address and the mailbox, two random ids of the request, the language, the time of the attempt and its result, and, if it is unclear whether the email went out, the encrypted request. It keeps it for at most 15 minutes, or 45 minutes in that case. The server deletes expired entries at the next request, at the latest when it stops.

So that no signup is lost, every allowed request (email address, language, time, source and consent version) is stored encrypted (AES-⁠256-⁠GCM) in our technical database before you get an answer. Only if the database does not answer at all do we ask Brevo for the confirmation email directly, without storing it; if it stays unclear whether Brevo took the email, we store the request afterwards, so it is not sent a second time right away. The stored request is deleted as soon as Brevo has accepted the email or no email is needed (your address is already on the list, you unsubscribed through Brevo, or another spelling of the same mailbox already got the email): usually within seconds, longer during an outage, at most 60 days after your last request. All technical tables then stay in the database’s daily backups for up to 7 days. This database runs at Supabase (Supabase Pte. Ltd., Singapore); the database itself is in Frankfurt, Germany. Where Supabase accesses it from outside the EU, standard contractual clauses apply; we send you a copy on request. Legal basis: our legitimate interest in a safe form and in reliably delivering the email you asked for (Art. 6(1)⁠(f) GDPR).

When you write to us

If you write to contact@noahsioly.com, for example to unsubscribe or to ask for access or deletion, your email is kept in our mailbox at IONOS SE (Montabaur, Germany). An assistant system helps us sort and answer it, the same as in section B of the German policy; for that the text of your email goes to Anthropic PBC (USA), under EU standard contractual clauses. Legal basis: Art. 6(1)⁠(c) GDPR where we handle a request about your rights, otherwise our legitimate interest in answering you (Art. 6(1)⁠(f) GDPR).

Leaving

You can withdraw your consent at any time, with effect for the future. The unsubscribe link in our emails unsubscribes you at Brevo from all emails we send through Brevo, including other lists you joined (such as the Sionavo waitlist). To leave only SIOLY Clothing, write to contact@noahsioly.com, for example with the subject “SIOLY unsubscribe”. Other consents you gave separately are not affected.

After you unsubscribe through the link, a job that checks the list every hour takes you off the waitlist, usually within a day, and deletes the source of your signup and your size and colour answers. If you unsubscribe by email, we do the same.

We keep the consent version, the time and the language of your signup, together with the day you left, as proof of your earlier consent until the end of the third year after you leave; then a job deletes them (Art. 6(1)⁠(c) and (f) together with Art. 7(1) GDPR; §§ 195, 199 of the German Civil Code). After you unsubscribe through the link, Brevo also keeps your address with an unsubscribe note, so that no email from us reaches you. We keep the note while we send email through Brevo (Art. 6(1)⁠(f) GDPR). You can ask for full deletion by email at any time; we then keep the proof and the note only for these periods (Art. 17(3)⁠(b) and (e) GDPR) and delete everything else.

While you are signed up and the waitlist exists, we keep and use your address for SIOLY Clothing. When it ends, we delete the list and the waitlist details; the proof of your consent is kept as after leaving. If you ask, we delete your size and colour answers at once.

Your right to object

Where we rely on our legitimate interest (Art. 6(1)⁠(f) GDPR), you can object at any time on grounds relating to your particular situation: the source of your signup, the confirmation email, the key in the confirmation link, the proof of your consent, the page and the form, protection and delivery, your emails to us and the unsubscribe note after you leave (Art. 21(1) GDPR). You can object to the use of your address for our emails at any time without giving reasons (Art. 21(2) GDPR); that also unsubscribes you. An email to contact@noahsioly.com is enough.

Your rights

You have the right to access, correction, deletion, restriction and data portability, and the right to object described above. You can also complain to a data protection authority. An informal email to contact@noahsioly.com is enough.