Privacy policy
Last updated: 6 November 2026
1. Who is responsible
The controller of your personal data on klawsfx.com is Kyriakos Kaitezidis, trading as KlawsFX, Xanthi, Greece. Contact for anything in this policy: contact@klawsfx.com. We have not appointed a data protection officer.
2. What we collect, why, and on what legal basis
| Situation | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Visiting the site (server and proxy logs) | IP address, date and time, requested URL, HTTP status, bytes sent, referrer, browser user agent, country | Security, abuse prevention, troubleshooting, anonymous traffic counts | Art. 6(1)(f) legitimate interest |
| Cookieless statistics (Umami, self-hosted) | Page path (no query strings), page title, referring site, browser, operating system, device type, screen size, language, country, events such as button clicks. No IP address is stored. | Aggregate statistics to improve the site | Art. 6(1)(f) legitimate interest. Switched off if your browser sends Do Not Track. |
| Google Analytics 4 (only after you click Accept) | Page views and events, device and browser information, approximate location, and the identifiers stored in the _ga cookies | Understanding how visitors use the site | Art. 6(1)(a) consent |
| Contact form | Name, email, your message. The message is only emailed to us and is not stored in our database. We store name, email, language, form type and the source details (see "How you reached us") for up to 24 months. | Replying to your enquiry and keeping a record of it | Art. 6(1)(b) steps at your request before a contract; Art. 6(1)(f) for the record |
| Free website check (/audit) | Email, website address you enter, the check results, language | Running the check, emailing you the report, contacting you once about the results | Art. 6(1)(a) consent (the tick box on the form) |
| Booking a free call (/book) | Name, email, optional note, chosen time slot, language, Google Meet link | Scheduling and holding the call, sending confirmation | Art. 6(1)(b) steps at your request before a contract |
| Buying a tool (Stripe checkout) | Email and name given at checkout, product and plan, payment status. Your email is stored with the licence record. Card details are entered at Stripe and never reach us. | Completing the sale, delivering the download or licence key, licence support, invoicing | Art. 6(1)(b) contract; Art. 6(1)(c) tax and accounting obligations |
| Free licence or trial of an app | First and last name, email, product, the licence key issued | Issuing and validating your licence key and emailing it to you | Art. 6(1)(b) contract; Art. 6(1)(f) preventing misuse (one key per email) |
| Bot protection on forms (Cloudflare Turnstile) | Technical signals from your browser and your IP address, checked by Cloudflare | Keeping bots away from forms that issue keys or send email | Art. 6(1)(f) legitimate interest |
| How you reached us (lead attribution) | With a form submission (contact, website check), booking or checkout we store the page you first landed on (path), the external referring page (host and path, no query string), the campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and only whether an ad click marker (gclid or fbclid) was present, never its value. | Knowing which channels bring enquiries | Art. 6(1)(f) legitimate interest |
Lead attribution is captured in memory during your visit. No cookies or browser storage are used for it. When a form is sent, an anonymous Umami event "lead" is recorded with only the form type and no personal data.
Google reviews shown on the site are public reviews that we copied to our own server (reviewer name, rating, text). No Google widget is loaded when you view them. You are not required to provide any data, but without it we cannot answer a form, book a call or issue a licence. No decision about you is made solely by automated means.
3. Who receives your data
| Recipient | Role | What for | Location and safeguard |
|---|---|---|---|
| OVHcloud (OVH SAS / OVH Ltd) | Hosting provider | Our own virtual server hosts the site, database and Umami | Data centre in London, United Kingdom (EU adequacy decision, Art. 45) |
| Cloudflare, Inc. | Processor | CDN, DNS, TLS, security and anti-bot proxy; Turnstile | USA: EU-US Data Privacy Framework (certified) and Standard Contractual Clauses |
| Resend | Processor | Sends our emails (form notifications, reports, confirmations, licence and download emails) | USA: EU–US Data Privacy Framework (certified) + Standard Contractual Clauses |
| Google Ireland Limited (Gmail, Calendar, Meet) | Processor | Receives enquiries in our inbox; creates the calendar event and Meet link for booked calls and emails the invitation | Ireland; may transfer to Google LLC (USA) under the EU-US Data Privacy Framework and Standard Contractual Clauses |
| Google Ireland Limited (Google Analytics 4) | Processor | Analytics, only after your consent | Ireland; may transfer to Google LLC (USA) under the EU-US Data Privacy Framework and Standard Contractual Clauses |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Independent controller for payment data, processor for the rest | Takes the payment on its hosted checkout page and tells us the buyer, product and status | Ireland / USA: EU-US Data Privacy Framework and Standard Contractual Clauses |
| Our licence service | Our own system | Mints and validates licence keys (receives name, email, plan) | Operated by us |
| Umami | Self-hosted by us | Cookieless statistics at stats.klawsfx.com | On our own server. No third party receives the data. |
We do not sell your data. Public authorities receive data only where the law requires it (for example tax authorities for invoices).
4. Transfers outside the EU
Our server is in the United Kingdom, which has an EU adequacy decision. Some providers above are in the USA. These transfers rely on the EU-US Data Privacy Framework where the provider is certified and on Standard Contractual Clauses (Art. 46 GDPR). You can ask us for details at contact@klawsfx.com.
5. How long we keep it
- Raw server and proxy logs: deleted automatically, normally within 7 days. We keep only anonymous daily totals (hits, bandwidth, error codes, bot names, country totals) that contain no IP addresses.
- Umami statistics: kept as statistics that cannot identify a person, for as long as they are useful for comparisons.
- Google Analytics 4: event-level data 2 months, user-level data 14 months.
- Contact form records (name, email, language, form type, source): deleted after 24 months. The message is not stored in our database; it stays in our email until you ask us to delete it or the purpose ends.
- Source (attribution) details on website checks, bookings and checkouts: removed after 24 months.
- Website check data: kept for up to 12 months.
- Bookings and licence records (including the buyer email stored with a licence): until you ask us to delete them or the purpose ends.
- Purchases and invoices: as long as needed for the purpose and as required by tax law.
- Your cookie choice: stored in your browser only, and asked again after 12 months.
6. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and, where we rely on legitimate interest, the right to object (Art. 21). Where we rely on consent you can withdraw it at any time without affecting what happened before: the cookie choice via , other consent by email. To use any right write to contact@klawsfx.com. We answer within one month.
You can complain to the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifisias 1-3, 115 23 Athens, www.dpa.gr, complaints@dpa.gr, or to the authority of your own country.
8. Changes
If we change this policy the date above changes with it. Material changes are announced on this page.