Privacy Notice
Last updated: 18 October 2026
This notice covers the website gastwlan.com and its contact form. Processing of personal data on behalf of our business customers within their WiFi, cloud or partner services is governed by separate agreements and information. This notice does not describe that processing. Data processing in booked WiFi, controller or partner services is described separately. It applies to people in the European Union and the European Economic Area under the General Data Protection Regulation (GDPR) and to people in Switzerland under the Swiss Federal Act on Data Protection (FADP). For people in Switzerland, the corresponding FADP terms apply.
1. Controller
Airfy Inc.
201 W. 5th Street, 16th Floor
Austin, TX 78701
United States
Email: sales@airfy.com
2. Visiting the website
When you open a page, our web server processes your IP address, date and time, the requested address, the status code, the amount of data transferred, the page you came from (referrer), your browser identifier (user agent) and the X-Forwarded-For header if your browser or a proxy sends it. It stores these data in log files. Error logs also contain your IP address.
Purpose: delivering the pages, secure operation, error analysis and defense against attacks.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website.
Retention: section 6.
The website sets no cookies. We use no analytics or advertising services. The pages load all content from our own web server. The only exception is Cloudflare Turnstile in the contact form (section 3).
3. Spam protection with Cloudflare Turnstile
The contact form uses Cloudflare Turnstile from Cloudflare, Inc. (USA). Turnstile tells requests from people apart from requests by programs. The Cloudflare script loads only when you use the form: when you click or tap into it, type in it, move into it with the Tab key, or submit it. It does not load when you open or scroll the page. Only once it loads does Cloudflare receive your IP address and technical details about your browser and connection. Turnstile stores one entry for challenges.cloudflare.com in your browser's storage (cf.turnstile.u). It sets no cookies. When you submit the form, our form service checks the result with Cloudflare.
Purpose: protecting the form against spam and abuse.
Legal bases: For storing and reading information in your browser, Art. 5(3) of Directive 2002/58/EC as implemented in national law (in Germany, Section 25(2) no. 2 TDDDG). This is strictly necessary for sending the form as you request. For all further processing, Art. 6(1)(f) GDPR. Our legitimate interest is keeping out automated requests.
Cloudflare processes these data on our behalf. Cloudflare also uses them as an independent controller to improve its bot detection. Cloudflare's notice applies to that: https://www.cloudflare.com/turnstile-privacy-policy/
You can prevent this by blocking scripts from challenges.cloudflare.com. You then cannot submit the form, but you can email us at sales@airfy.com.
4. Enquiry form
When you submit the form, we process your name, email address and message. These are required fields. Your business name is optional. The topic transmitted is ‘Contact’ or ‘More than three locations’.
The form details are transmitted without cookies to https://forms.airfy.ai/api/contact. The page language and the full page address, including URL parameters, are also transmitted. Technical details are also processed for spam checks: the time the page was opened and the result from Cloudflare Turnstile. A hidden field serves as a spam trap and remains empty in a regular enquiry.
Our form service runs on the same web server as the website. It does not store your enquiry. It forwards it by email through Twilio Ireland Limited's SendGrid delivery service to sales@airfy.com. The mailbox is processed in Google Workspace, see section 5.
To protect against overload, the form service counts requests only in memory: hourly by a shortened hash of your IP address and daily by website. Its own logs contain this hash, not your IP address. The web server in front of the form service logs each request with your IP address as described in section 2, but not the content of your enquiry.
The form service discards messages suspected of being spam without an error message. If you receive no reply, please write to sales@airfy.com.
Purposes and legal bases:
Responding to your enquiry: Article 6(1)(b) GDPR if you yourself intend to enter into a contract with us. In all other cases, such as enquiries for a business, Article 6(1)(f) GDPR applies. Our legitimate interest is responding to business enquiries.
Your IP address in the enquiry: investigating spam and misuse, Article 6(1)(f) GDPR.
You decide whether to use the form. The required fields listed above are necessary to submit it.
Retention period: section 6.
5. Email to us
If you write to us by email, the purpose and legal basis for responding described in section 4 apply. We process emails to sales@airfy.com and other addresses under airfy.com in Google Workspace mailboxes provided by Google LLC (USA). The form enquiries described in section 4 also arrive in this mailbox.
6. Retention periods
We automatically delete web server log files after no more than 14 days.
We delete form service logs after no more than six weeks.
You can request deletion at any time (sections 10 and 11). Statutory retention obligations take precedence.
7. Recipients
AirZen Networks Lda., Portugal: operation of the SendGrid sending account on our behalf under the existing processing model.
Twilio Ireland Limited, Ireland: delivery of form enquiries using SendGrid, through the sending account of AirZen Networks Lda. Twilio Ireland Limited uses Twilio Inc. (USA) for delivery.
Cloudflare, Inc., USA: spam protection (Turnstile) on our behalf; as an independent controller for improving bot detection (section 3).
Google LLC, USA: email mailboxes for addresses under airfy.com (Google Workspace), on our behalf.
Payment via Stripe
If you order a plan through the checkout, Stripe Payments Europe, Ltd., Dublin, Ireland, processes the payment. The purpose is payment processing. Stripe receives your payment and invoice data. gastwlan.com has no access to your card data.
8. Transfers to the United States
Recipients based in the United States are Cloudflare, Inc., Twilio Inc. and Google LLC. Each of them is certified under the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework (www.dataprivacyframework.gov). For people in the EU and the EEA, transfers to them rely on Commission Implementing Decision (EU) 2023/1795 of 10 July 2023. For people in Switzerland, they rely on Annex 1 of the Swiss Data Protection Ordinance (DPO).
We, Airfy Inc., are based in the United States. From there we access the data that our service providers in the EU process for us. Implementing Decision (EU) 2023/1795 and Annex 1 of the DPO cover certified companies only. Airfy Inc. is not certified.
9. No automated decision-making
We make no automated decisions within the meaning of Art. 22 GDPR or Art. 21 FADP. If the spam check fails, you can email us.
10. Your rights under the GDPR
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17) and restriction of processing (Art. 18). Where we process your data by automated means on the basis of a contract or your consent, you also have the right to data portability (Art. 20) if the statutory conditions are met. Where processing is based on your consent, you can withdraw it at any time with effect for the future. Please write to sales@airfy.com. You may lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR).
11. People in Switzerland
You may request access (Art. 25 FADP). You may request the handover or transfer of the data you gave us where the conditions of Art. 28 FADP are met. You may request the correction of inaccurate data, object to the processing and request erasure (Art. 32 FADP). You may contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern. Further information: https://www.edoeb.admin.ch/
12. Changes
We update this notice when our processing changes. The version published here applies.