Privacy policy

Controller

Dataplex OÜ
Narva mnt 5
10117 Tallinn
Estonia

Email: [email protected]

We have not appointed a data protection officer because the legal requirements for doing so are not met. Please send any data protection enquiries to the address above.

In short

• We process the data you give us to answer your request, set up your website and run your subscription.
• Statistics and marketing tools only use cookies after you have consented — and only run if they are switched on for this site. Google Ads and Microsoft Advertising also measure without consent, in a cookie-free mode.
• We do not sell your data.

When you just visit the website

When you open a page, our servers process technical data that every browser sends: IP address, date and time, the page requested, browser and operating system. We need this to deliver the site and keep it secure (legal basis: Art. 6(1)(f) GDPR — our legitimate interest in a secure, working website). Server logs are kept only as long as needed for this purpose.

The website is delivered through Cloudflare (Cloudflare, Inc.; in the EU via Cloudflare’s European network), which protects it against attacks and connects visitors to our servers without opening them directly to the internet. Cloudflare processes connection data (including the IP address) for this purpose.

To protect our public forms (teardown, makeover and sign-in requests) against automated abuse, Cloudflare Turnstile checks once per visit that a person is using the form. Cloudflare processes your IP address and browser characteristics for this and sets no tracking cookies. We also keep what is entered in these forms, including rejected attempts, together with the result, the country reported by Cloudflare and a keyed hash of your IP address (not the address itself). We use this to detect misuse and delete it after 180 days. Legal basis: our legitimate interest in a secure service that is not misused (Art. 6(1)(f) GDPR).

Cookies and similar technologies

Necessary cookies are always set, because the site does not work without them:

• kw_consent — stores your consent choice (12 months).
• kw_locale — remembers your language (12 months).
• kw_country — remembers the country you chose or that we detected, so that prices are shown in the right currency (12 months). If you have not chosen a country, we derive it from the country code our network provider (Cloudflare) sends with the request, or from your browser language. We do not store your IP address for this.
• kw_human — remembers for two hours that you passed the bot check on a public form, so you are not asked again.
• kw_customer / kw_admin — keep you signed in to the customer area or the admin (session cookies with a limited lifetime).

Everything else — statistics and marketing — only happens with your consent (Art. 6(1)(a) GDPR). The exception is the cookie-free ad measurement of Google Ads and Microsoft Advertising: on our public pages their tags also load without consent, set and read no cookies and report page views, funnel steps and enquiries together with technical data such as your IP address, browser and the page address (which can contain an ad click ID). Legal basis: legitimate interest in measuring our advertising (Art. 6(1)(f) GDPR); you can object at any time. You can change or withdraw your consent at any time in the cookie settings; withdrawing is as easy as giving consent.

Our own visit measurement

With your consent to statistics, the site counts page views and steps such as checkout starts. A random visit ID is kept in your browser’s sessionStorage (not a cookie) and disappears when you close the tab. We store the event, the page path without query string, the referring domain, the language and — where relevant — the selected plan. No IP address and no browser fingerprint are stored. This data stays on our own servers.

Teardown requests

If you request a free teardown, we process your name, email address, website address and your optional message to review your website and send you our written findings by email (Art. 6(1)(b) GDPR — steps prior to a contract at your request). We keep the request as long as needed to handle it and any follow-up conversation.

Makeover requests and the customer area

If you request a website makeover, we create a customer area for you. We process your email address, name, optional company, your website address, your goals and — only if you consented to marketing — the ad click IDs and campaign parameters with which you reached us (gclid, gbraid, wbraid, msclkid, utm_*).

In the customer area we process what you provide there: answers to the questionnaire, design proposals and your decision on them, chat messages, support requests, change requests including attachments, quotes, project and domain details (including domains you ask us to register). Sign-in works with single-use links sent by email. Legal basis: Art. 6(1)(b) GDPR (contract or steps prior to a contract).

Files you attach to chat messages or change requests (images, PDF, Word, Excel, PowerPoint, text and CSV files, up to 10 MB each) are checked automatically before we store them, to protect you and us from harmful content. Images are re-encoded: location data, camera details and other embedded metadata are removed. Documents with macros, scripts, embedded programs or links that load external content are rejected. Files are stored on our servers in Germany (see "Hosting"), are only accessible to you and our team after signing in, and are kept for the duration of the business relationship like the rest of your customer area. Legal basis: Art. 6(1)(b) GDPR, and for the security check Art. 6(1)(f) GDPR (our legitimate interest in keeping our systems and your data safe).

Orders and payment

Plans are booked through Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland). Stripe processes your billing address, company name, email address, VAT ID (if given), payment method, the plan booked and the payment status. We receive the information needed to manage your subscription from Stripe; we do not see your full card details. The payment form is Stripe's own form, embedded on our website: for it your browser loads Stripe's script from js.stripe.com, and Stripe uses cookies and device signals to prevent fraud (Stripe's own responsibility, see stripe.com/privacy). Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for statutory retention of invoices.

Before checkout we ask for your billing country and, for EU businesses, your VAT ID. We check the VAT ID with the European Commission's VAT Information Exchange System (VIES), which returns whether it is valid and the registered name and address. We use the result to apply the correct VAT (Estonian VAT, VAT of your EU country, or reverse charge) and store it with your customer record and on your invoices. Legal basis: Art. 6(1)(b) and (c) GDPR (correct invoicing under VAT law).

Your payment method is saved with Stripe as your default payment method – for the subscription and, when you pay for a domain, also from that payment. If you book an add-on or an extra change beyond your monthly change points, we charge it to that payment method — only after you have confirmed the booking. We store the booking with the time of your confirmation, the version of the notice you confirmed, the amount and the Stripe invoice number, and record which changes used points of your monthly allowance and their position in the queue. Legal basis: Art. 6(1)(b) GDPR; the booking records are kept like invoices (Art. 6(1)(c) GDPR).

Domains

If you register or transfer a domain through us, we pass the registrant details required for registration to our domain registrar Namecheap, Inc. (Phoenix, USA) and, via Namecheap, to the responsible registry. Legal basis: Art. 6(1)(b) GDPR.

Sending emails

Transactional emails — sign-in links, confirmations, notifications about your project — are sent via Scaleway Transactional Email (Scaleway SAS, Paris, France). Processed: email address, name and the content of the message. Legal basis: Art. 6(1)(b) GDPR.

AI assistance in support

To help our team answer chat messages and change requests faster, the text of a message can be analysed by an AI model of Anthropic (Anthropic, PBC, USA) or, as an alternative, via OpenRouter (OpenRouter, Inc., USA). Neither uses your data for training; Anthropic deletes it after 30 days at the latest, and via OpenRouter we only use providers that do not store inputs. The AI only makes suggestions to our team; nothing is sent to you or decided automatically. Legal basis: Art. 6(1)(f) GDPR (efficient handling of your requests).

AI assistant in the project chat. If you choose "Ask AI", your question, the recent messages of the conversation and the data of this project shown in your customer area (plan, initial project and acceptance, tickets and change points, design previews, proposals, domains – no payment data) are sent to the AI model we use (Anthropic or, as an alternative, a model via OpenRouter with zero data retention; neither uses your data for training). Answers are marked as AI-generated; the AI cannot book or change anything, and our team reads along. For our team we also keep a short AI-generated internal summary of each project's status, based on the same data. Legal basis: contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering quickly (Art. 6(1)(f) GDPR).

Statistics and marketing services

Only after your consent and only if the respective service is switched on for this site:

• Google Analytics 4 (Google Ireland Limited, Dublin, Ireland) — statistics. Cookies: _ga, _ga_*.
• Google Ads conversion measurement (Google Ireland Limited) — cookie-free without consent, cookies only with marketing consent. Cookies: _gcl_au, _gcl_aw.
• Microsoft Advertising conversion measurement (Universal Event Tracking, UET; Microsoft Ireland Operations Ltd., Dublin, Ireland) — cookie-free without consent, cookies only with marketing consent. Cookies: _uetsid, _uetvid, MUID. The ad click ID msclkid is only kept with your consent.
• Microsoft Clarity (Microsoft Ireland Operations Ltd., Dublin, Ireland) — statistics. Usage analysis with heatmaps and recordings of how the public pages of this website are used (scrolling, clicks, mouse movements). It is never active in the customer area, the admin area, the checkout or on sign-in pages. Text you type and form contents are masked in your browser before anything is sent. Cookies: _clck, _clsk, CLID, ANONCHK, MR, MUID, SM. Microsoft stores the data for the periods it specifies for Clarity. Microsoft may process data in the USA; the transfer is based on the EU-US Data Privacy Framework.
• Meta Pixel (Meta Platforms Ireland Ltd., Dublin, Ireland) — marketing. Cookies: _fbp, _fbc.

These services process your IP address, cookie identifiers, the page visited and the reported event. Legal basis: Art. 6(1)(a) GDPR. You can withdraw your consent at any time in the cookie settings.

Hosting

Our website, application and database run on servers of a hosting provider in Germany (name on request). Uploaded files and backups are stored there as well. Encrypted backups may additionally be stored with Scaleway (Scaleway SAS, Paris, France) in the EU. Backups are rotated automatically: daily copies are kept for about a week, weekly copies for about a month.

Recipients and processors

We use the providers named above as processors under data processing agreements, or — where they act on their own responsibility (Stripe for payment processing, Namecheap and the registries for domain registration) — as independent recipients. Within our company, only people who need the data for their work have access to it.

Transfers to third countries

Our application and database run in the European Union. Some providers named above are based in the USA or can access data from there (Cloudflare, Namecheap, Anthropic, OpenRouter, and Google, Microsoft and Meta for the consent-based services). Where a provider is certified under the EU-US Data Privacy Framework, the transfer is based on this adequacy decision; otherwise on the European Commission’s standard contractual clauses. US authorities may be able to request access to data held by these companies under US law, and your legal remedies there are weaker than in the EU.

Retention

We delete personal data as soon as it is no longer needed for the purpose for which it was collected, unless statutory retention periods require us to keep it — in particular for invoices and accounting records. Data in your customer area is kept for the duration of the business relationship and then deleted, unless such retention obligations apply.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on our legitimate interest (Art. 21). You can withdraw any consent at any time with effect for the future.

A message to [email protected] is enough. We answer within one month.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). Our competent authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, aki.ee); you can also contact the supervisory authority where you live or work.

Automated decisions

We do not make decisions based solely on automated processing that have legal effects on you or similarly significantly affect you (Art. 22 GDPR).

Changes

We update this policy when our services or the law change. The current version is always available on this page.