Privacy Policy

Last updated: {{LAST_UPDATED}}

DRAFT — the operator details are placeholders and this has not been reviewed by a lawyer or a data-protection adviser. The factual descriptions below were checked against the code actually running on this site; the legal bases, retention periods and the question of whether a processing record or DPAs are required still need professional review.

This policy explains what personal data byfriday.co collects, why, and what happens to it. The controller is Oleksandr Mamieiev, {{ADDRESS}} — see the Impressum page.

Data-protection contact: hello@byfriday.co.

The short version

We collect what you type into the quote form, and nothing else about you.

There is no analytics, no advertising, no tracking pixel and no social plugin on this site.

Web fonts are served from this server, not from Google.

Two cookies exist: one remembers your language, one remembers your cookie choice.

The quote form

When you send a quote request we receive and store:

What you typed: your name, email address, any notes, a design link, and — if you attached one — the design file itself. The file is stored on this server, in a folder that is not listed publicly and cannot run code; only we can reach it. Ask us and we delete it.

What you selected: site type, sections, features, extras and the delivery option, plus the estimate calculated from them.

Technical data recorded with the submission: the page you submitted from. Your IP address and your browser’s user-agent string are not stored.

Why

To answer you and to quote for the work — that is, to take steps at your request before entering into a contract, and our legitimate interest in responding to an enquiry. {{LEGAL_BASIS_REVIEW}}

The page you submitted from is recorded so that we know which language and which offer a request came from. It is not used to profile you and not used for marketing.

How long

Quote requests that do not become projects are deleted after 12 months. Where a project goes ahead, the record is kept for as long as we must keep business records under {{RECORDS_LAW}}, currently {{RECORDS_RETENTION_YEARS}} years.

Who else sees it

We use these providers, and only these:

{{EMAIL_PROVIDER}} — sends the notification to us and the confirmation to you. Receives your name, email address and the content of your request.

Cloudflare Turnstile — the anti-bot check on the form, when it is enabled. Receives technical signals from your browser. It is designed not to profile users and sets no advertising cookie.

netcup GmbH, Karlsruhe, Germany — hosts this site and therefore processes everything that passes through it.

We do not sell personal data, and we do not share it with anyone for their own purposes. {{TRANSFER_STATEMENT}}

Cookies

This site sets two cookies. Neither is used for advertising and neither tracks you across other sites.

glingo_lang — remembers which language version you are reading, so requests made in the background stay in that language. Session length. Strictly necessary for the site to work as you asked.

cp_consent — records the choice you made in the cookie banner, so we do not ask again. Stores only your choice, its timestamp and the policy version. Up to 365 days.

There are currently NO analytics, advertising or personalisation cookies on this site. The banner offers those categories because the underlying software supports them; today, choosing “Accept all” and choosing “Reject all” set nothing extra either way. If we ever add analytics, they will not run unless you opt in first.

You can change your choice at any time from the “Cookie settings” link in the footer.

WordPress’s own cookies

If you log in to the administration area, WordPress sets session cookies. These only affect logged-in users, not visitors.

Web fonts

The typefaces on this site (Inter and Space Grotesk) are served from this server. They used to be loaded from Google’s font CDN, which transmitted every visitor’s IP address to Google before any consent was asked; that has been changed. No request leaves this domain when you view a page.

Server logs

We keep standard web-server logs on that server, which include IP addresses, for 14 days, for security and troubleshooting. {{LOGS_REVIEW}}

Your rights

If the GDPR applies to you, you have the right to ask for a copy of your data, to have it corrected or erased, to restrict or object to processing, and to receive it in a portable form. Where processing rests on consent, you can withdraw that consent at any time without affecting what was done beforehand.

Write to hello@byfriday.co and we will answer within one month. You can also complain to a supervisory authority — for us that is Prezes Urzędu Ochrony Danych Osobowych (UODO), Warszawa, Poland.