What this site collects, which is almost nothing.

Who is responsible

FACTIONER SRL, trading as DigitalFullstack, a company registered in Romania. Under the GDPR we are the data controller for everything described here.

There is no email address published on this site, deliberately: an address in a page footer is harvested within days and the spam then buries the real messages. To reach us about anything in this policy, write to the postal address above or use the form on the audit page and say what you need. A request about your own data does not have to be a business enquiry and will not be treated as one.

The two forms

One on the audit page and one on the agency page. They are the only places this site asks you for anything.

The audit form asks for your name, your email address, your Bubble app URL, your current plan and one line about the problem. The agency form asks for your name, your work email, your agency, what you need and one line describing it. Every field is on the screen in front of you. Nothing is collected in the background, and there is no hidden field capturing anything beyond a honeypot that only automated submissions ever fill in.

When you submit, the contents become a single plain-text email to one mailbox belonging to one person. That is the whole system. There is no database, no CRM, no marketing automation, no lead scoring, and no sequence that starts running afterwards. You get a reply from a person or you get nothing.

How long it is kept

The email stays in that mailbox for as long as the conversation is live and for as long afterwards as we might reasonably need it, which in practice means while you are a client and for the period we are required to keep business records. We do not copy it anywhere else.

Ask us to delete it and we will, and we will confirm when it is done. The only exception is anything we are legally required to retain, such as invoices, which is an accounting obligation rather than a choice.

Analytics

We use Plausible, which sets no cookies, stores nothing on your device and does not build a profile of you or follow you to other sites. It counts page views and records the referrer, country, browser and device type in aggregate. None of that identifies you.

This is why the site has no cookie banner. There is nothing to consent to, and adding a banner to ask about analytics that collect no personal data would waste your time to look compliant.

One event is recorded from the cost calculator: which of the three verdicts it produced. The figures you typed into it are never sent anywhere. The calculator runs entirely in your browser, and if you close the tab your numbers are gone.

Who else can see anything

Three companies, and the list below is the whole list. The site loads no fonts, scripts, embeds, maps, chat widgets, ad tags or social buttons from anyone else. Fonts are served from this domain rather than fetched from Google, so visiting this site tells Google nothing.

VercelHosting and content delivery

Standard server request logs, which include IP addresses and user agents.

Vercel is incorporated in the United States, so its US parent can access this data under its data processing terms.

ResendSending form submissions as email

Whatever you typed into a form, at the moment you submit it. Nothing is sent to Resend if you never submit one.

United States. Resend is US-incorporated and stores message metadata and logs in the US whichever sending region is configured.

PlausibleAggregate traffic analytics

Page views, referrer, country, browser and device type. No cookies, no cross-site identifier, and nothing that identifies you personally.

European Union.

Two of those are in the United States, so submitting a form involves transferring your details there. That transfer is covered by the standard contractual clauses in those providers’ data processing terms. We are telling you this plainly rather than claiming European data residency we cannot deliver while a US provider sends our email.

What we never do

We do not sell your data, share it with advertisers, add you to a mailing list, retarget you, or pass your details to anyone except the providers listed above. We do not run automated decision-making or profiling of any kind. If you are a client, we do not name you publicly without asking first, and for agencies we do not name you at all.

Your rights

If you are in the EU or the UK, the GDPR gives you the right to ask what we hold about you, to have it corrected, to have it deleted, to receive a copy, to object to what we are doing with it and to restrict it. Our legal basis for the forms is taking steps at your request before entering a contract, and for analytics it is a legitimate interest in knowing whether the site works.

If you are in California, the CCPA and CPRA give you the right to know what has been collected, to have it deleted and to have it corrected, and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information, so there is nothing to opt out of, and we will not treat you differently for exercising any of these rights.

Ask, and it gets done. If you think we have handled something badly, tell us first and we would rather fix it. You also have the right to complain to a supervisory authority. Ours is the Romanian data protection authority, ANSPDCP.

Children

This site sells business services and is not intended for anyone under 16. We do not knowingly collect anything from children.

Changes

If this policy changes in substance, the date at the top changes with it. There is no mailing list to notify, which is itself the point.