Privacy Policy

Data controller

The controller is Lukáš Kubala, sole trader trading as Alpinefy, Lietava 111, 013 18 Lietava, Slovakia, Company ID (IČO) 52742580. All details are in the legal notice.

Contact email: hello@alpinefy.com

We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and applicable local law.

What data we process

Depending on interaction, we may process:

• Visiting the website: to deliver the pages, Cloudflare processes technical data such as your IP address, browser type and the address of the page you open. Before you consent, the website loads nothing from other providers.
• Forms (contact, service inquiry, review): what you fill in (for example name, email, phone, company, website, message, budget, timeline, the estimate from the pricing calculator or a rating), the page and language of the form, the time of sending, the country derived from your IP address and your browser type. The stored record contains your IP address only as a one-way hash.
• Chat on the website: the answers come from prepared texts in your browser, and what you type there reaches us only when you send us a message from the chat; that message (name, email, optional phone, your text and the messages of the conversation) is processed and kept like a form submission.
• Campaign data with a form: only if you have allowed analytics, the form also sends the campaign parameters (UTM), click IDs (gclid, fbclid, msclkid), the landing page and the referring website of your visit.
• Job applications (Career page): your name, email, optional phone, country and city, the languages you speak, your sales experience and your message. We use them only to assess your application and to contact you.
• Emails to hello@alpinefy.com: your email address and what you write or attach.
• Webcheck: the website address you enter and the results of the check. We do not ask for your name or email. To prevent abuse, we count checks per visitor and day with a one-way code derived from your IP address.
• Client account (alpinefy.com/login and app.alpinefy.com), for our clients only: name, email, company, language and role; messages and files we exchange (for example designs or invoices); sign-in data (time, device type and browser); for passkeys only the public key, because your fingerprint or face data never leave your device; and, if you turn on notifications, the push address of your browser.
• Analytics, only after consent: usage data such as pages viewed, clicks, scrolling, device and browser data, collected by Google Analytics 4 and Microsoft Clarity.

Purpose and legal basis

We process data only for legitimate, specific purposes:

• Responding to inquiries and pre-contract communication (Art. 6(1)(b) GDPR).
• Handling service requests and business communication (Art. 6(1)(b) and Art. 6(1)(f) GDPR).
• Assessing job applications and contacting applicants (Art. 6(1)(b) GDPR, steps before a contract).
• Providing the client account and app to our clients (Art. 6(1)(b) GDPR).
• Running Webcheck when you start a check, and protecting it from abuse (Art. 6(1)(f) GDPR).
• Publishing your review after approval, based on your consent (Art. 6(1)(a) GDPR).
• Analytics and UX improvement via GA4 and Clarity, based on consent (Art. 6(1)(a) GDPR).
• Knowing which campaign an inquiry came from, based on consent (Art. 6(1)(a) GDPR).
• Security, abuse prevention and service continuity (Art. 6(1)(f) GDPR).
• Keeping accounting and tax records when we work together (Art. 6(1)(c) GDPR).

Filling in a form is voluntary, but without your contact details we cannot reply. We do not make automated decisions about you.

Retention period

We retain personal data only as long as necessary for the original purpose or legal obligations.

• Form submissions: the stored record is deleted automatically after 365 days.
• Job applications: at most 12 months after you apply, then deleted.
• Inquiry and project communication is usually retained up to 24 months unless a longer period is required by law or contract.
• Webcheck results: 90 days. The code derived from your IP address: 26 hours.
• Technical logs of our server code: at most 7 days.
• Client account: for as long as we work together. A sign-in lasts 90 days, a sign-in link is valid for 15 minutes and an invitation for 7 days.
• Published reviews: until you ask us to remove them.
• Analytics data: for the retention period set in Google Analytics 4 and Microsoft Clarity.
• Contracts and invoices: as long as tax and accounting law requires.

Recipients and processors

We use trusted processors that support our service delivery:

• Cloudflare, Inc. (hosting and delivery of the website, our server code, storage of form submissions and Webcheck results, sending of form notifications and client app emails, forwarding of emails sent to hello@alpinefy.com, database and files of the client app).
• Google (Gmail, the mailbox that receives emails to hello@alpinefy.com and form notifications).
• Google (PageSpeed Insights, which receives the website address you check in Webcheck).
• Google (Google Tag Manager and Google Analytics 4, consent-based).
• Microsoft (Clarity, consent-based).
• The push service of your browser provider, for example Apple, Google or Mozilla, only if you turn on notifications in the client app. The content of a notification is encrypted for your device.

An approved review is published on the website with your name, company and text. Anyone who has the link to a Webcheck result can open it. We pass data to public authorities only when the law requires it.

Transfers outside the EU

Cloudflare, Google and Microsoft may process data in the USA. Cloudflare, Inc., Google LLC and Microsoft Corporation are certified under the EU-U.S. Data Privacy Framework, for which the European Commission has decided that it ensures an adequate level of protection.

Your rights

Under GDPR, you may request:

• Access to your data.
• Correction or completion of inaccurate data.
• Deletion or restriction of processing where applicable.
• Data portability where technically feasible.
• Withdrawal of consent at any time (for consent-based processing).
• Objection to processing based on legitimate interest.

You can lodge a complaint with the supervisory authority in Slovakia: Úrad na ochranu osobných údajov Slovenskej republiky, Galvaniho 7/B, 821 04 Bratislava, dataprotection.gov.sk. You can also contact the supervisory authority in the EU country where you live or work.

See also the Cookie Policy for what is stored in your browser and how to change your choice.