The small print, made big*

The controller of your personal data under the GDPR is VEONIO OÜ, Sepapaja tn 6, 15551 Tallinn, Estonia (registry code 16255914) (“VEONIO”, “we”, “us”). We have not appointed a data protection officer because we are not legally required to. For anything related to privacy, write to privacy [at] veonio.com.

Hosting and delivery

The website is hosted and delivered by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) through Cloudflare Pages and its global network. When you open a page, your browser necessarily transmits technical data: IP address, date and time, the page requested, referrer, browser and operating system. Cloudflare processes this data to deliver the page, protect the site against attacks and keep it available. These logs are kept only briefly and are not combined with other data. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a secure, fast and reliable website.

Web analytics

We use Cloudflare Web Analytics to count page views and see which pages are popular. It works without cookies and without identifying individual visitors; we only see aggregated figures such as visits per page, referring websites and countries. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in understanding which content is useful.

Our fonts are served from our own domain. No data is sent to Google Fonts or similar services.

Features such as TL;DR mode on this page work only for the current visit and are not saved.

When you use the application form, the contact or careers form, the website enquiry form (“Get your fixed price”), or email us, we process the details you give us: for example name, email address, company, website, phone number, your answers about goals, company size, budget and timing, and your message. We use them to review your request, prepare a conversation and answer you.

• Form submissions are stored in a database operated by Cloudflare (Cloudflare D1) and forwarded to our mailbox by our email provider Resend.
• You receive a copy of your application by email.
• The website enquiry form asks for your website address and email address, optionally your name and a note. It is not stored in the database: it is forwarded to our mailbox by Resend, and you receive a short confirmation by email.
• Our mailboxes are hosted by Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).

Legal basis: Art. 6(1)(b) GDPR where your request relates to a contract or steps before one, otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering messages sent to us. For job applications also Art. 6(1)(b) GDPR (steps before an employment or service contract).

How we assess fit

The application form shows a “fit score” based on your own answers about budget, size and timing, and a link to book a call if it matches the projects we take on (currently from €10,000, starting within 12 months). This simple rule has no legal or similarly significant effect on you. A person reads every application, and you can always contact us directly instead.

The scorecard asks ten questions about how your company works, four questions about your company and plans, and your contact details. We use this data to create your report and show it immediately, to email you a copy, to notify Markus Behmann so any follow-up is relevant, and to decide whether we offer a strategy call (the same simple rule as above). Submissions are stored in our Cloudflare D1 database.

Legal basis: Art. 6(1)(b) GDPR for creating and sending the report you asked for; Art. 6(1)(f) GDPR for preparing a follow-up.

Scorecard playbooks. If you tick the box in the scorecard, we send a short series of emails with practical guidance for your focus areas (about five emails over two weeks). For this we store your name, email address, company, language and your score summary.

We don’t send a newsletter. The playbooks are sent through Resend. Every email contains an unsubscribe link; you can also withdraw your consent at any time by writing to us. We do not track whether you open our emails or which links you click. After you unsubscribe, we keep your address on a suppression list so that you receive no further emails. Legal basis: Art. 6(1)(a) GDPR (consent).

If you enter a website address in the website check on our relaunch page, our server (Cloudflare Pages Functions) reads the public pages of that website, such as the home page and its sitemap, to estimate how many pages and blog articles it has and which system, shop software, DNS provider and registrar it uses. For this it also asks Cloudflare’s public DNS service (cloudflare-dns.com, DNS over HTTPS) about the domain and queries the public domain registry data (RDAP, found via data.iana.org). From the registry we read only the registrar’s name, the status codes and the expiry date, no owner data. The requests come from our server, not from your browser.

We do not save the address, the result or any other personal data from the check. Your IP address is kept only in the server’s memory for up to ten minutes to limit how often one connection can run the check, and is never written to storage. The check is protected by Cloudflare Turnstile (see “Spam protection”). The short questions on our new-website page run in your browser and save nothing until you place an order. Legal basis: Art. 6(1)(b) GDPR (the check you asked for) and Art. 6(1)(f) GDPR (protection against abuse).

If you enter a website address in the live demo on our home page or on our Autopilot page, our server first runs the website check (see “Website check”). Our client portal (Cloudflare Pages Functions with our Cloudflare D1 database in the EU) then reads up to six public pages of that website for the brand profile and, for the AI-visibility check, its robots.txt, llms.txt, sitemap and up to 15 further public pages. The requests come from our servers, not from your browser. We send the text of up to six of those pages (at most about 21,000 characters) and the website address to Anthropic (USA) to draft a brand profile preview, three example posts and a week plan. Nothing else about you is sent.

We store the website address, the results and the text of the pages read with the demo run for 24 hours, so the page can show them to you, and then delete them. The domain, the language, the time, the AI cost and how long the steps took stay for 30 days for cost control and are then deleted. Your IP address is kept in the website server’s memory for up to ten minutes and is not stored: to limit how often one connection can run the demo, the portal keeps a keyed hash of it with the run, which cannot be turned back into the address without our key, changes every day and is deleted after 24 hours. Your browser holds a random key for the run only while the page is open; no cookies. The demo is protected by Cloudflare Turnstile (see “Spam protection”). Legal basis: Art. 6(1)(b) GDPR (the demo you asked for) and Art. 6(1)(f) GDPR (protection against abuse and cost control).

The rebuild offer is for businesses. These are the steps and the data they involve:

• Order (portal.veonio.com): company name, VAT ID, email address, optionally your name and website address, your answers to the short questions (stored as codes), your confirmation that you order as a business and, if you have one, a referral code. Legal basis: Art. 6(1)(b) GDPR.
• Account: after your payment we create a client record and a portal user for your email address. You log in with a single-use link sent by email. The portal sets one essential login cookie (HttpOnly, valid for 30 days). It sets no tracking or advertising cookies. The “no cookies” statement in this policy applies to veonio.com.
• Briefing: the texts you write, and logo and photos you upload (they may show people). They are stored in Cloudflare R2 (EU) and our Cloudflare D1 database. For the content you give us we act on your behalf; the data processing agreement from our terms applies. Please hand over personal data of other people only where you may.
• Crawl (relaunch): we read the public pages of your own website at the address you gave us, up to the included scope: titles, descriptions, headings, texts, image addresses and the list of old addresses for redirects. This can include names or contact details of employees that you publish there. We follow the site’s links and sitemaps within your domain only.
• Build: we have the new website drafted with an AI service (Anthropic). For this we send your briefing and the text of your old pages to Anthropic. The result is stored in a private repository at GitHub and shown to you as a preview; Cloudflare delivers it. Cloudflare’s browser rendering creates screenshots for our quality report. A person reviews every build before you see it.
• Go-live: to help you switch your domain we ask public DNS (Cloudflare DNS over HTTPS) about the domain you enter.
• Emails from the portal (invitation, notices, preview and payment links) are sent through Resend. Legal basis: Art. 6(1)(b) GDPR; for the content you give us, processing on your behalf (Art. 28 GDPR).

After the website check we may offer qualified companies a free preview of their rebuilt home page. If you request it, we store your email address, optionally name and company, your website address, your answers on budget and timing, the check result, a record of your consent (text and time) and a one-way hash of your connection (not your IP address) to limit abuse. Our server reads your old home page, and we send its title, description, headings, up to 12,000 characters of its text and its address to Anthropic to draft a one-page preview. Your name, email address and company are not sent. A person checks the result. Only if you consented, and only after that check, we email you a private link. The link works for 30 days, and the page is hidden from search engines. You can withdraw your consent at any time, and we then switch the link and the emails off. Legal basis: Art. 6(1)(a) GDPR (consent).

For companies we are in touch with, or whose website we think we could improve, we may prepare a personal page at veonio.com/for/… . It compares your public website with a website built by VEONIO. For this we store in our client portal: your website address, your company name, optionally the name of a contact person and a short personal note, and the scores we measured. We measure with Google PageSpeed Insights: our server sends the address of your website (and of our reference site) to Google, which loads the public page and returns speed, mobile and SEO scores; no other data goes to Google. The page is reachable only through its address, which contains a random part; it is not listed anywhere, excluded from search engines and sets no cookies. When you open it, our server fetches its content from our portal; nothing about your visit is stored. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in offering our services to businesses). You can object at any time by replying to us: we then take the page down at once and delete the data.

When you click one of our Google ads, Google adds a random click ID to the address of our page (gclid, on Apple devices also gbraid or wbraid). Our website keeps it only in the address: when you move on to our offer pages and to the order form in our client portal, the links carry it along. We set no cookies for this and store nothing in your browser; there is no Google tag on veonio.com.

If you start an order, the portal stores the click ID with your order and passes it to Stripe with the order details. Only if you pay the bet do we send Google Ads the click ID, the time of payment, the value of the order (50 €) and an order reference, through Google’s interface for importing conversions. We send no name, email address or company data. This lets Google count which ads lead to orders, so we spend our ad budget on what works. Google processes this data under the Google Ads terms and its privacy policy (Google Ireland Limited; transfers to the USA are possible). Payments in Stripe’s test mode are never sent. We clear the click ID 90 days after it was stored; the rest of the order is kept as described under “Payments and invoices”.

On our entry page veonio.com/website/ we test two versions of the headline. Which one you see is chosen at random each time the page loads. Your browser tells our server which version was shown and whether you clicked on to one of the two offers; we count only these numbers per day, without your IP address or any other data about you. The version also travels in the address to the order form, so we can count orders per version.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in measuring and improving our advertising and our website). You can object at any time; we then delete the click ID from your order. If you don’t want the click ID to be passed on, remove the part from “gclid=” onwards from the address, or open our website directly instead of through the ad.

You pay the bet and the later invoice on a payment page hosted by Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA). Stripe collects the payment details; we receive the payment status, Stripe’s customer and payment references, your company name, VAT ID, billing details and email address, but no card number. Stripe acts on our behalf and, for its own legal obligations such as fraud prevention, as a controller in its own right (see Stripe’s privacy policy). You receive the invoice from VEONIO OÜ. Payment and invoice data are passed to our accounting service Xolo, which supports our bookkeeping. Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (accounting duties).

If you already have a plan with us and we bill it yearly through Stripe, we give Stripe your company name, billing address, VAT ID, email address and the plan price for this. Stripe then emails you the invoice every year. Before each renewal our client portal sends you an email with the date and the amount. Legal basis: Art. 6(1)(b) GDPR (contract).

After go-live you can agree in the portal to the following. Each item is separate and optional:

• Two follow-up emails (about 14 and 60 days after go-live) with suggestions for add-ons. Each contains an unsubscribe link. The emails are sent through Resend.
• Referral voucher: we store your referral code and the order it was used for.
• “Built by VEONIO” link in the footer of your website.
• Case study: a before-and-after summary of your relaunch with measured values (such as number of pages and file size) and your company name. We publish it only if you agreed.

We store the wording and time of each consent. Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw it at any time on the go-live page of the portal or by writing to us.

If you book one of the following add-ons in the client portal, we process this data, on your behalf for your website’s content (Art. 28 GDPR) and otherwise to deliver what you booked (Art. 6(1)(b) GDPR):

• SEO articles, second language, social posts: the search terms and the short description of your readers that you enter in the portal, and the text of your website’s home page. We send them to Anthropic (USA) to plan topics and draft articles, translations and post texts. Names or email addresses of your contacts are not sent. A person at VEONIO edits every draft, and nothing goes live before you approve the preview. Drafts are stored in our Cloudflare D1 database and in your website’s private repository at GitHub.
• SEO health check: once a month our build service reads up to 20 public pages of your website, plus robots.txt and sitemap.xml, and stores the technical findings (such as missing titles or broken links) with their addresses.
• Monthly report: the aggregated visit figures of your website from Cloudflare Web Analytics (no cookies, no individual visitors), the list of changes that went live, and three suggestions. To write the suggestions we send these aggregated figures and your company name to Anthropic. The report is stored in the portal and emailed through Resend to the portal users of your company.

We keep these items as long as you are a client, so that you can look back at them in the portal.

So that our AI writes in your voice and states only facts your own texts prove, the portal keeps a brand profile for your company: tone, typical words, audience, offers, do’s and don’ts, image style, languages and a list of facts, each with its source. To make or change it, our build service sends the text of your website’s pages, your briefing, texts you published through the portal, the readers and search terms you entered in the portal and, if you change the profile in one sentence, that sentence to Anthropic (USA). Names or email addresses of your contacts are not sent. We do this on your behalf for your website’s content and marketing (Art. 28 GDPR) and to deliver our service (Art. 6(1)(b) GDPR).

The profile and its earlier versions are stored in our Cloudflare D1 database as long as you are a client. You can see and change it in the portal at any time.

For the websites we build and run for our clients, the portal keeps an inbox of the messages people send through the website’s contact form. We do this on behalf of our client, who is the controller for these messages (Art. 28 GDPR); the website’s own privacy policy describes it as well. After the website’s spam checks (Cloudflare Turnstile and further checks), we store the name, email address, optional phone number and message, the language and address of the website and the time, together with the status our client gives the enquiry (new, answered, won, lost). The sender immediately gets an automatic confirmation by email (sent through Resend) that the message has arrived; it does not repeat the message, and our client can switch it off. If an enquiry is still unanswered after one hour, our client gets a reminder. If our client asks for a reply draft, the message and our client’s brand profile are sent to Anthropic (USA) to write it; our client checks and sends the reply themselves. Taps on the website’s phone, WhatsApp and email links are counted per day without cookies and without any data about the visitor. If a message or a tap comes through a campaign page of the website (a page for a single offer or event), we also store which campaign it came through, so that our client sees what the page brought; the label is in the address of the page’s buttons, no cookie is needed for it.

The messages are stored in our Cloudflare D1 database in the EU and deleted automatically 12 months after they came in. The click counts contain no personal data.

Messages you send us through the forms on veonio.com itself (contact, application, scorecard, rebuild enquiry) also go to our own inbox in the portal, so that we can answer quickly. Here we are the controller. After the same spam checks we store what the form sends us (name, email address, phone number if given, your message and the answers you chose in the form), the language and the time, and delete it 12 months after it came in; the email we receive is kept as described under “How long we keep it”. After the contact form you get the automatic confirmation described above; after the other forms only the confirmation they already send. Reply drafts work as described above. Taps on our phone, WhatsApp and email links are counted per day in the same way, without cookies and without any data about you. Legal basis: Art. 6(1)(b) GDPR (answering your enquiry) and Art. 6(1)(f) GDPR (our interest in answering quickly).

Some of our clients send a newsletter to people who signed up on their website (or whom they invited) through our portal. We do this on behalf of our client, who is the controller for this data (Art. 28 GDPR); the website’s own privacy policy describes it as well. After the sign-up form’s spam checks (Cloudflare Turnstile and further checks) we store the e-mail address, the language and address of the website and when the person signed up, and send one e-mail with a confirmation link. Only after the confirmation (double opt-in) does the address get a welcome e-mail and the newsletter. Unconfirmed sign-ups are deleted automatically 30 days after they came in.

The e-mails are sent through Resend: from our client’s own domain, or, as long as that domain is not verified, the confirmation and welcome e-mail from our address with our client’s name and replies going to our client. Every e-mail after the confirmation carries an unsubscribe link. We do not measure whether an e-mail is opened or a link clicked. About once a year we ask long-standing subscribers whether they want to keep getting the newsletter; their answer is stored. When someone unsubscribes we delete the address at once and keep only a hash of it, so that it cannot be added again by mistake; our client can also delete subscribers at any time. The issues themselves are written with AI from our client’s own content (see “Brand profile”); no subscriber data goes to the AI. The data is stored in our Cloudflare D1 database in the EU.

For our clients the portal keeps a short link and a QR card that lead to their Google reviews, and texts for asking customers for a review. We do this on behalf of our client (Art. 28 GDPR). When someone opens the short link, we count the opening per day and per way in (QR code, link, e-mail, SMS, WhatsApp), without cookies and without storing anything about the person (no IP address, no device data), and pass them straight on to Google; from there Google’s privacy policy applies. Requests our client sends from their own phone or e-mail program are counted only by channel. If our client marks an enquiry from their inbox as “won” and confirms that the person agreed to be asked, the portal sends that person one e-mail (through Resend) with our client’s name as sender; we store when, by whom and with which confirmation it was sent, and never send a second one. To write the texts in our client’s tone, the client’s brand profile and name are sent to Anthropic (USA); no customer data is part of it. The review numbers our client enters (count and average) are stored with the date.

All of it is stored in our Cloudflare D1 database in the EU. The records of e-mails sent contain no copy of the person’s data; the enquiry itself is deleted after 12 months as described above.

Clients with the Autopilot can ask the marketing chat in our portal about their marketing, for example how last month went or what to post. To answer, we send to Anthropic (USA): the question as typed by the portal user, up to the last six messages of the same conversation, the company name, the client’s brand profile and the figures the answer needs from our own records for this client: aggregated visit figures from Cloudflare Web Analytics (no cookies, no individual visitors), the number of enquiries by status and the number of taps on the website’s phone, WhatsApp and e-mail links, the weekly report figures, the marketing score, the AI-visibility check, the review figures the client entered and the titles and status of the marketing calendar. The text, name, e-mail address and phone number of enquiries are never sent. If the user asks for it, the chat puts a draft on the marketing calendar; it is treated like every other draft there and nothing is published before the client approves it. We do this to deliver our service to the client (Art. 6(1)(b) GDPR) and, for the data of our client’s website, on their behalf (Art. 28 GDPR).

Questions and answers are stored with the portal user and the time in our Cloudflare D1 database in the EU and deleted automatically 6 months after they were written; the user can delete the conversation at any time. For cost control we keep, per question, the time, the number of AI tokens and the cost, without any content; after 6 months it is no longer linked to the user.

The button at the bottom right of every page opens a chat in which an AI concierge suggests one of our offers. Only when you open it does your browser load Cloudflare Turnstile (see “Spam protection”); nothing is stored in your browser, and reloading the page ends the chat. With your first message our server runs the spam checks and starts the conversation in our client portal (Cloudflare Pages Functions with our Cloudflare D1 database in the EU). There we store your messages and the answers, a short summary of what you need written by the AI, the offer shown, the page and language, and a keyed hash of your IP address that changes every day (for the limit of chats per visitor; the IP address itself is not stored). If a message contains a website address, our server runs the website check (see “Website check”) once and keeps its result with the conversation.

To answer, we send to Anthropic (USA): your messages of this conversation, the summary, the result of the website check and our list of offers and prices. Please do not type sensitive data into the chat. After 30 days we delete the messages, the summary, the website check and the IP hash; for up to 180 days we keep only figures without content (number of messages, cost, kind of offer, whether an order or an enquiry followed).

If you start the website order in the chat, your company name, VAT ID, e-mail address, name and website go into the order exactly as on our order page (see “Rebuild offer: order, client portal and project data”), Stripe opens the payment page, and the summary of the chat goes into your briefing. If you send your details to Markus, we store your name, e-mail address, phone number and note (both optional) together with the summary and your messages as an enquiry in our inbox in the portal and send you one confirmation e-mail (through Resend); the enquiry is deleted after 12 months, as described under “Inbox for enquiries to client websites”.

Legal basis: Art. 6(1)(b) GDPR (steps you ask for before a contract) and Art. 6(1)(f) GDPR (our legitimate interest in answering questions about our offers and in protecting the chat against abuse).

Clients with Autopilot Pro (and our own websites) can name up to three competitor websites in our portal. Once a week our bot “VEONIOBot” (user agent with a link to portal.veonio.com/bot) reads robots.txt, the sitemap, the home page, llms.txt, a news feed and at most eight further public pages of each of these websites, obeys robots.txt, waits at least two seconds between two requests, never logs in, never sends forms and never works around a protection page. Google and other platforms are not read. We keep the website’s address, the list of its pages, page titles, headings, prices shown on the pages read with the text around them, publication dates, the response time of the home page, the result of our AI-visibility check and a rating the website states about itself. These are business details; where a page names a person (for example a sole trader), that name can be part of a title or heading.

If something changed, we send these details (never the client’s enquiries or contact details) to Anthropic (USA), which writes a short summary in English and German and at most one marketing idea for the client; code checks that it only uses what was read and copies nothing. The client sees the summary in the portal and in the weekly report. We do this to deliver our service to the client (Art. 6(1)(b) GDPR) and, regarding the competitors’ public website data, on the basis of our and our client’s legitimate interest in observing the market (Art. 6(1)(f) GDPR). The reads of a website are kept for the last 26 weeks and deleted at once when the client removes the website; the weekly summaries are kept for 52 weeks. Website owners can keep the bot out with “User-agent: VEONIOBot / Disallow: /” in their robots.txt or object at any time via the contact details in our legal notice.

In the client portal we show your company at most one tip a month (for example a bigger plan when your visits get close to your plan’s limit, or articles when nothing new has gone live for a while), in the portal and in the monthly report, and a short checklist after your website goes live. For this the portal uses the aggregated visit figures of your website from Cloudflare Web Analytics (no cookies, no individual visitors), the dates of changes that went live and the add-ons you booked. It stores which tip was shown, whether a portal user hid it or switched tips off (with that user and the time), and the progress of the checklist. This stays in the portal and is not passed to anyone. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in pointing out services that fit your website). You can switch tips off at any time on the Marketing page of the portal; this also applies to the monthly report. We keep these entries as long as you are a client.

As soon as you click into a form, the Turnstile script is loaded from Cloudflare (not before) and runs a short, usually invisible check in your browser and transmits technical information (such as your IP address and browser characteristics) to Cloudflare to tell humans from bots. In addition, the form measures in your browser how long you take to fill it in and sends this duration with your message; it is not stored. The data is used only for this purpose. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in protecting our forms against abuse. Details: Cloudflare Turnstile privacy addendum.The same check protects the sign-in, order and homepage-preview forms in our client portal (portal.veonio.com). There Turnstile only loads once you click into the form.

If you book a call, you are taken to our scheduling provider (currently Motion, usemotion.com), where you choose a time and enter your name and email address. The provider passes the booking to our calendar. The video call itself takes place in the tool named in the invitation. Legal basis: Art. 6(1)(b) GDPR, steps before a contract at your request.

We use the following processors, each bound by a data processing agreement under Art. 28 GDPR:

Where data is transferred to the USA or another country without an EU adequacy decision, the transfer is based on the EU-U.S. Data Privacy Framework (for certified providers) or on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). We also share data with accountants, lawyers and authorities where the law requires it.

Our pages link to our profiles on LinkedIn and Facebook, and articles offer a “Share on LinkedIn” link. These are ordinary links: no data is sent to these networks unless you click them. After clicking, the privacy policy of the respective network applies.

Some pages have a “Write on WhatsApp” button. It is an ordinary link to wa.me: nothing from WhatsApp is loaded on our pages and no data goes to WhatsApp before you click. A click opens WhatsApp (app or website) with a prepared message that you can change before sending. From then on WhatsApp, a service of WhatsApp Ireland Limited (Meta), processes your data under its own terms and privacy policy; Meta may also process data outside the EU. If you write to us, we see your phone number, your WhatsApp name and your message and use them only to answer you (Art. 6(1)(b) and (f) GDPR). We count the click only as described under the inbox section: per day, without cookies and without any data about you.

• Server logs: only as long as Cloudflare needs them for delivery and security, generally a few days.
• Enquiries and applications: until your request has been dealt with; if no business relationship follows, we delete them after 24 months at the latest.
• Scorecard submissions: 24 months after your last contact with us, unless a business relationship follows.
• Playbook emails: until you unsubscribe or withdraw consent, then only on the suppression list.
• Accounting records: 7 years, as required by the Estonian Accounting Act.
• Website check: nothing is stored; your IP address stays in memory for up to ten minutes.
• Live demo: website address, results, the text of the pages read and the keyed hash of your connection 24 hours; domain, language, time and AI cost 30 days.
• Rebuild offer, if you do not carry on: we delete the preview, the briefing, your uploads, the crawl data and the build files within 30 days after the offer has ended. Order, payment and invoice records stay for 7 years as accounting law requires.
• Rebuild offer, if you become a client: project data for as long as the contract runs; after it ends, we hand over your export and delete the project data within 90 days after the hand-over. Invoices: 7 years.
• Homepage preview requests: up to 90 days after the link has expired, or earlier if you withdraw your consent or ask us to delete them.
• Personal comparison pages: online for at most 90 days; 30 days after that we delete the names, the note and the scores. If you object, the page goes offline at once and the data is deleted in our next daily deletion run.
• Ad click IDs: 90 days after they were stored. The headline test keeps only daily totals without personal data.
• Portal login: a session ends after 30 days at the latest.

You have the rights of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent at any time with effect for the future (Art. 7(3)). Right to object (Art. 21 GDPR): where we process data on the basis of our legitimate interests, you can object at any time for reasons arising from your particular situation; you can object to direct marketing at any time without giving reasons. We answer requests free of charge within one month and may ask you to confirm your identity first.

Send the email to [email protected]. You can also simply write to us in your own words.

All connections to this website are encrypted (HTTPS/TLS). Access to stored data is limited to the people who need it and protected by two-factor authentication. If a data breach is likely to put your rights at risk, we will inform you and the supervisory authority as the law requires.

We update this policy when the website, our services or the law change. The date at the top shows the current version.

If you are not satisfied with our answer, you have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).