The Iter is built with privacy by design. We collect only the minimum personal information you explicitly choose to share, deploy zero third-party behavioral advertising trackers, and never sell or share your personal data.
1. Data Controller & Contact Information
The Iter ("we", "us", or "our") is the Data Controller (under the EU/UK General Data Protection Regulation — GDPR) and the Business (under the California Consumer Privacy Act / California Privacy Rights Act — CCPA/CPRA) responsible for personal information collected on theiter.com. For any privacy questions or to exercise your legal rights, contact us at contact@theiter.com.
2. Categories of Personal Information Collected & Purpose (Notice at Collection)
When you join our early access waitlist, we collect: (a) Identifiers (Full Name and Email Address), (b) Voluntary Travel Preferences (your optional dream destination note), and (c) Consent Audit Metadata (UTC timestamp, selected language, and policy version). We collect this data solely to administer early access invitations and send product launch updates you requested. For security and anti-spam protection, our server temporarily processes a salted HMAC-SHA256 cryptographic hash of the connecting IP address for 15 minutes.
3. Legal Basis for Processing (European Economic Area, UK & Switzerland)
Under GDPR Article 6(1)(a), we process your name, email address, and optional destination note strictly on the basis of your explicit, active, and unbundled opt-in consent. Our ephemeral 15-minute anti-abuse rate limiting operates under Legitimate Interest (GDPR Article 6(1)(f)) to protect our service from automated abuse. If data is processed outside the EEA/UK, we rely on Standard Contractual Clauses (SCCs) and strict data-minimization safeguards.
4. Data Retention & Storage
Waitlist submissions are transmitted over encrypted HTTPS and delivered to our administrative inbox at contact@theiter.com. We retain waitlist records only until the completion of our public launch rollout plus six (6) months, or until you withdraw consent or request deletion, whichever occurs first.
5. Your European Privacy Rights (GDPR Articles 15–22)
If you reside in the EEA, UK, or Switzerland, you have the right to: (a) access your personal data, (b) rectify inaccurate data, (c) request immediate erasure ("Right to be Forgotten" under Art. 17), (d) restrict or object to processing, (e) receive your data in a portable format, and (f) withdraw your consent at any time without affecting prior lawful processing. You also have the right to lodge a complaint with your national Data Protection Authority (DPA).
6. Your United States Privacy Rights (CCPA/CPRA, VCDPA, CPA, CTDPA & CAN-SPAM)
If you are a resident of California or another US state with comprehensive privacy laws, you have: (a) the Right to Know what personal information we collect, use, or disclose; (b) the Right to Delete your personal information; (c) the Right to Correct inaccurate information; and (d) the Right to Non-Discrimination for exercising your privacy rights. DO NOT SELL OR SHARE DECLARATION: The Iter does NOT sell your personal information and does NOT share your personal information for cross-context behavioral advertising as defined under the CCPA/CPRA. In accordance with the US CAN-SPAM Act, every email communication includes a clear, frictionless way to opt out. To exercise any EU or US right, email contact@theiter.com with the subject "Privacy Request" or "Right to Erasure"—we respond within 15 business days.