What this site collects, which is almost nothing.

Who is responsible

FACTIONER SRL, trading as DigitalFullstack, a company registered in Romania. Under the GDPR we are the data controller for everything described here.

There is no email address published on this site, deliberately: an address in a page footer is harvested within days and the spam then buries the real messages. To reach us about anything in this policy, write to the postal address above or use the form on the Own page and say what you need. A request about your own data does not have to be a business enquiry and will not be treated as one.

The forms

Two forms: the application on the Own page, and the booking form on Book a call. They are the only places this site asks you for anything.

The Own application asks for your name, your work email, your company, your live product URL, the closest stack, your team, your budget, a start date and one line about what changed. Every field is on the screen in front of you. Nothing is collected in the background, and there is no hidden field capturing anything beyond a honeypot that only automated submissions ever fill in. If you allowed X’s pixel, two more hidden fields say so and carry the X click ID from the ad you arrived from, if there was one. What that is for is under Advertising.

Booking a call asks for your name, your email, a time and five answers about your app, two of them optional, behind the same honeypot. One hidden field carries your browser’s time zone, so the emails show the call in your time. It creates an event in Lucian’s Google calendar with those details, and Google emails you the invite and the Meet link. We email you a confirmation, then a reminder a day before the call, if it is more than a day away, and an hour before. Decline the invite and the reminders stop.

When you submit either form, the contents become a single plain-text email to one mailbox belonging to one person, and a booking also becomes that calendar event. That is the whole system. There is no database, no CRM, no marketing automation, no lead scoring, and no sequence that starts running afterwards beyond the reminders for a call you booked. You get a reply from a person or you get nothing.

How long it is kept

The email stays in that mailbox, and a booking in that calendar, for as long as the conversation is live and for as long afterwards as we might reasonably need it, which in practice means while you are a client and for the period we are required to keep business records. We do not copy it anywhere else.

Ask us to delete it and we will, and we will confirm when it is done. The only exception is anything we are legally required to retain, such as invoices, which is an accounting obligation rather than a choice.

Analytics

We use Plausible, which sets no cookies, stores nothing on your device and does not build a profile of you or follow you to other sites. It counts page views and records the referrer, country, browser and device type in aggregate. None of that identifies you.

None of that needs your consent, so the cookie question at the bottom of the page is not about Plausible. It is about X’s ad pixel, described next.

One event is recorded from the cost calculator: which of the three verdicts it produced. The figures you typed into it are never sent anywhere. The calculator runs entirely in your browser, and if you close the tab your numbers are gone.

Advertising

We advertise on X, and X’s pixel tells us which ads bring people here. It loads only if you choose Allow. Choose Decline, ignore the question, or send a Global Privacy Control signal from your browser, and it never loads.

If you allow it, X receives the pages you view here, the X click ID from the ad you came from, if any, your IP address and browser, and reads or sets its own cookies, which X can link to an X account if you have one. X uses this to count results for our ads and can use it to show you our ads on X. Clicking a button to book a call is counted too. Completing a booking sends X your email address and the booking’s ID, so X can match the booking to an ad and count it once, but not your name, your answers or the time.

If you allowed it and then apply through the Own form, our server also tells X that an application arrived. It sends a SHA-256 hash of your work email, your IP address and browser, and the X click ID from the ad you came from, if any. It does not send your name, your company or anything else you typed.

The legal basis is your consent. Withdraw it here and the pixel stops loading from the next page. Cookies X already set stay until they expire or you clear them in your browser.

Who else can see anything

The list below is the whole list. The site loads no fonts, scripts, embeds, maps, chat widgets, ad tags or social buttons from anyone else. Fonts are served from this domain rather than fetched from Google, so visiting this site tells Google nothing.

VercelHosting and content delivery

Standard server request logs, which include IP addresses and user agents.

United States. Vercel is US-incorporated, and this project's functions are configured to execute in its Washington DC region (iad1).

ResendSending form submissions and booking emails

Whatever you typed into a form, at the moment you submit it. If you book a call, also your name, email and the call’s time in the confirmation and the reminders sent to you. Nothing is sent to Resend if you never submit one.

United States. Resend is US-incorporated and stores message metadata and logs in the US whichever sending region is configured.

GoogleCalendar and video for booked calls

If you book a call: your name, email, the time, your time zone and your answers, kept as an event in Lucian’s Google Workspace calendar, plus the invite Google emails you and the Meet call itself. Nothing is sent to Google if you never book.

Google Workspace data centers, which may be outside the European Union, including in the United States.

PlausibleAggregate traffic analytics

Page views, referrer, country, browser and device type. No cookies, no cross-site identifier, and nothing that identifies you personally.

European Union.

XAd measurement, only if you allow it

If you allow its pixel: the pages you view here, the X click ID from the ad you came from, your IP address and browser, and X’s own cookies, which X can link to an X account. If you book a call, your email address and the booking’s ID, and nothing else you typed. If you apply through the Own form, a SHA-256 hash of your work email and the X click ID from the ad you came from. Nothing at all if you decline.

United States. X Corp. is US-incorporated, and X’s own privacy policy governs what it does with this data.

Vercel and Resend are in the United States, and Google may store a booking there, so submitting a form or booking a call involves transferring your details there. That transfer is covered by the standard contractual clauses in those providers’ data processing terms. We are telling you this plainly rather than claiming European data residency we cannot deliver while a US provider sends our email.

What we never do

We do not sell your data, add you to a mailing list, or pass your details to anyone except the companies listed above. The one advertiser that can see anything is X, and only if you allowed its pixel. We do not run automated decision-making or profiling of any kind. If you are a client, we do not name you publicly without asking first, and for agencies we do not name you at all.

Your rights

If you are in the EU or the UK, the GDPR gives you the right to ask what we hold about you, to have it corrected, to have it deleted, to receive a copy, to object to what we are doing with it and to restrict it. Our legal basis for the forms is taking steps at your request before entering a contract, and for analytics it is a legitimate interest in knowing whether the site works. For X’s pixel and the application it reports, it is your consent.

If you are in California, the CCPA and CPRA give you the right to know what has been collected, to have it deleted and to have it corrected, and the right to opt out of the sale or sharing of personal information. X’s pixel counts as sharing for advertising. It only runs if you choose Allow, so declining is the opt-out, a Global Privacy Control signal is honored as one, and a yes can be withdrawn under Advertising above. We do not sell personal information, and we will not treat you differently for exercising any of these rights.

Ask, and it gets done. If you think we have handled something badly, tell us first and we would rather fix it. You also have the right to complain to a supervisory authority. Ours is the Romanian data protection authority, ANSPDCP.

Children

This site sells business services and is not intended for anyone under 16. We do not knowingly collect anything from children.

Changes

If this policy changes in substance, the date at the top changes with it. There is no mailing list to notify, which is itself the point.