Privacy

Last updated: 4 October 2026

Who is responsible

Period – Verein zur Förderung der Menstruationsforschung (in Gründung), represented by Marine Popoff (chair). Contact: hello@period.foundation. The address is in the Impressum.

What we collect when you sign up

Required: your e-mail address, your age band (not your exact age), whether you would like to take part in the study, and your consent to e-mails.

Optional: your first name, your region (country level), how you could help with your work, and, if you want to be shown as a supporter, your photo and a few words.

We do not ask about your health. Please do not send us health information, neither in the form nor by e-mail.

Why, and on what legal basis

To keep you informed about the association and the study, and to plan the study (for example, how many women live near Vienna). The legal basis is your consent (Art 6(1)(a) GDPR; § 174 TKG 2021 for e-mails). You can withdraw it at any time, with one click on your personal page or by e-mail. Withdrawal does not affect what happened before.

Showing your name, photo and words on the website, and to women you invite, is a separate, optional consent.

How we protect it

Your e-mail address is encrypted on our server with a key that only the association holds; the key that can unlock it is not stored on the server. To find duplicates we keep a one-way fingerprint of the address. Until you confirm your sign-up, the address is kept unencrypted so we can send the confirmation e-mail; after that it is deleted in readable form.

Data are stored in the European Union (Cloudflare D1 and R2 with EU jurisdiction).

Checking photos and words with AI

Before your name, photo or words are shown, an AI model checks them against simple rules: one real adult person, face visible, nothing offensive, no advertising, no health information. If the result is unclear, a person from the association looks at it. The AI does not identify who you are and does not use your photo for training. The check has no legal or similar effect on you; you can ask for a person to review it at any time.

The model runs on Cloudflare Workers AI.

Who processes data for us

Cloudflare, Inc. (hosting, database, photo storage, AI check, sending e-mails) and Google (our e-mail inbox for hello@period.foundation), each under a data processing agreement. Cloudflare and Google are US companies; transfers rely on the EU–US Data Privacy Framework and standard contractual clauses.

How long we keep it

Unconfirmed sign-ups: deleted after 30 days. Confirmed sign-ups: until you leave the list, or until the association no longer needs them for the study. Deleted data leave our backups within 30 days.

Cookies and tracking

This website sets no cookies and uses no tracking or advertising tools. Fonts are loaded from our own server. Our hosting provider keeps short technical logs (such as IP addresses) to run and protect the website.

Your rights

You can ask for access, correction, deletion, restriction, data portability, and object to processing (Art 15–21 GDPR). Write to hello@period.foundation. You can also complain to the Austrian Data Protection Authority (Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, dsb.gv.at).