Privacy Policy

1. Data Controller

GDPRGard.eu is operated by Zirlandia Milkovic, a freelance GDPR consultancy based in Rijeka, Croatia (EU), who is the data controller for all processing described in this policy. For data-related enquiries contact: privacy@gdprgard.eu

2. What Data We Collect

• Contact form: Name, email address, website URL, and message content — collected via Formspree (formspree.io).
• Tool usage: Documents, text, or images you upload to any GDPRGard tool (ContractGuard, InvoiceExtract, HRForge, etc.) are sent to our server function and to Anthropic's API for processing. We do not store these files or their contents.
• Cookies: Necessary session cookies and service-processor data (Formspree, Netlify, Anthropic — none of which set tracking cookies) by default. Google AdSense marketing/advertising cookies only with your explicit consent. Meta Pixel advertising-measurement cookies (_fbp) only with your explicit consent.
• GDPRChat assistant: The messages you type are sent to Anthropic's API to generate a reply and are not stored by us. Your consent choice is saved in your browser; where consent logging is enabled, a minimal event (timestamp and policy version, no message content) is also sent to Formspree. Please do not enter personal data in the chat.
• Purchases: Payment for eBooks and toolkits is handled on a checkout page hosted by Stripe. We receive the contact and billing details you enter at checkout (such as name, email address and country), your order details and the payment confirmation — never your card number. We use your email address to send your download link.
• GDPRGard Compliance Skills plugin: This open-source plugin runs inside the tool you install it in, such as Claude Code. It collects, stores and sends nothing to us, and contains no analytics or tracking. Whatever you analyse with it stays in your own session and is handled under the terms of the AI service you use.
• Analytics (optional): If you allow the Analytics category in the cookie banner, we count clicks on our book, checkout and tool buttons: which button, on which page. Only daily totals are stored. No cookie is set, and no IP address, browser details or anything that identifies you is stored.
• Abuse protection: To keep the free AI tools available, our servers count how many requests each visitor makes per day. The count is kept under a keyed one-way hash of your IP address, never the address itself, and is deleted within a few days.
• Access codes and AI credits: If you ask for the free trial of the paid AI tools, we use your email address once to send you an access code. We store only a one-way hash of the address (not the address itself), the code, how many free-trial uses and credits are left, and the date of last use. If you buy credits, Stripe passes your email address to us and the credits are added to your code the same way. The code is kept in your browser's local storage so the tools recognise you. Resend sends these emails. Legal basis: performing the service you asked for (Art. 6(1)(b) GDPR).

3. Legal Basis for Processing (Art. 6 GDPR)

• Contact form data: Consent (Art. 6(1)(a)) — you voluntarily submit this data to request a consultation or our services.
• Tool processing: Legitimate interest (Art. 6(1)(f)) — necessary to provide the service you requested.
• Necessary cookies: Legitimate interest (Art. 6(1)(f)) — required for the website to function.
• Marketing cookies (Google AdSense): Consent (Art. 6(1)(a)) — the AdSense script only loads after you explicitly allow the Marketing category in the cookie banner.
• Marketing cookies (Meta Pixel): Consent (Art. 6(1)(a)) — the Meta Pixel only loads after you explicitly allow the Marketing category in the cookie banner.
• GDPRChat assistant: Consent (Art. 6(1)(a)) — you tick a consent box before the chat starts and can withdraw it at any time with the “Withdraw” link in the chat window.
• Purchases and delivery: Performance of a contract (Art. 6(1)(b)) to process your order and deliver your download; legal obligation (Art. 6(1)(c)) to keep accounting and tax records.
• Analytics (click counts): Consent (Art. 6(1)(a)) — the counter only runs after you explicitly allow the Analytics category in the cookie banner.
• Abuse protection (usage limits): Legitimate interest (Art. 6(1)(f)) — keeping the free tools available and preventing misuse and excessive costs.

4. Third-Party Recipients

• Anthropic (anthropic.com): Processes the content of your uploads and requests via API to generate the tool's output. US-based, operates under Standard Contractual Clauses for EU data transfers.
• Formspree (formspree.io): Processes contact form submissions when you request our services or send an enquiry. US-based, operates under Standard Contractual Clauses.
• Netlify (netlify.com): Hosts this website and injects a small performance-telemetry script (Netlify RUM) that reports aggregate page-load timing to Netlify as part of the hosting service; it sets no cookies and does no cross-site tracking. Netlify also derives aggregate page-view and visitor counts from its server logs (no cookies and no script on your device); we only see totals, not individual visitors. US-based, operates under Standard Contractual Clauses for EU data transfers. Legal basis: legitimate interest (Art. 6(1)(f)) in operating and monitoring the availability of the site.
• Google AdSense (google.com): Shows and measures ads, setting third-party advertising cookies (IDE, __gads, __gpi, test_cookie, NID, FCCDCF). Only loads after you explicitly allow the Marketing category in the cookie banner — never before. Google Ireland Ltd / Google LLC, transfers covered by Standard Contractual Clauses. Legal basis: consent (Art. 6(1)(a)).
• Meta Pixel (facebook.com): Measures whether our ads on Facebook and Instagram lead to visits and purchases, setting the cookie _fbp and sending page views, checkout clicks and purchase events (order value and currency) together with your IP address and browser details. Only loads after you explicitly allow the Marketing category in the cookie banner — never before. Meta Platforms Ireland Ltd; data may be transferred to Meta group companies in the US, and Meta describes its safeguards in its privacy policy. We and Meta act as joint controllers for the collection and transmission of this data. Legal basis: consent (Art. 6(1)(a)).
• Stripe (stripe.com): Hosts the checkout and processes your payment on our behalf (Stripe Payments Europe Ltd, Ireland, and Stripe, Inc., USA). Stripe also acts as an independent controller for fraud prevention and its own legal obligations; it relies on the EU-US Data Privacy Framework and Standard Contractual Clauses for US transfers. We never see or store your card details.
• Resend (resend.com): Sends the delivery email with your download link (Compliance Field Kit) to the address you gave at checkout. US-based; relies on the EU-US Data Privacy Framework and Standard Contractual Clauses for EU data transfers.
• Supabase (supabase.com): Hosts the database that stores the daily click totals (London region, United Kingdom, which has an EU adequacy decision). The totals contain no personal data. The events reach it through Netlify functions, which do not pass on your IP address.

5. Data Retention

• Contact form submissions: retained by Formspree per their policy (90 days on the free plan).
• Server access logs (Netlify): IP address and browser type, used only for security and uptime, kept for 30 days.
• Uploaded documents and tool inputs: not stored by us — processed in real time and discarded when your session ends.
• Cookie consent choices: stored in your browser for 365 days.
• Purchase records: kept for 11 years from the end of the business year to which they relate, as required by Croatian accounting and tax law, then deleted.
• GDPRChat messages: not stored by us; Anthropic handles API data under its own retention terms.
• Analytics click counts: kept as daily aggregate totals without personal data, with no fixed deletion date.
• Usage-limit counters: a one-way hash of your IP address with a daily request count, deleted within a few days.
• Access codes: a code that only holds the free trial, with no credits, is deleted after 12 months without use. A code that ever held purchased credits is deleted after 24 months without use once no credits are left. Markers that stop a Stripe payment from being credited twice are deleted after 30 days. Purchase records are kept as stated above.

6. Your Rights (Art. 15–22 GDPR)

You have the right to: access your data, correct inaccuracies, request deletion, restrict processing, data portability, and object to processing. To exercise any right, email privacy@gdprgard.eu. We will respond within 30 days.

You can withdraw any consent at any time, without affecting the lawfulness of processing carried out before withdrawal: use the “Withdraw” link in the chat window, or the cookie-settings icon for cookies. You also have the right to object to processing based on legitimate interest. We do not make decisions based solely on automated processing that produce legal or similarly significant effects (Art. 22).

7. Complaints

You may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP): azop.hr

8. Changes to This Policy

If our architecture or third-party services change, this page is updated to reflect that — we don't let this page go stale while the product changes underneath it.

9. Contact

Data controller contact for privacy matters: privacy@gdprgard.eu · gdprgard.eu