Privacy Policy

Messages you send us

The contact form asks for your first and last name, your email address and a message. A phone number and links to your current site are optional. When you email or call us directly, we receive your email address or phone number and whatever you tell us.

Sending the form delivers your message to our inbox and emails a copy back to you as a confirmation.

We use these details to reply, arrange a call and prepare a quote. When you ask about work for yourself, the legal basis is Article 6(1)(b) GDPR: steps taken at your request before a contract. When you write on behalf of a company, it is Article 6(1)(f): our legitimate interest in answering the businesses that contact us.

No law or contract obliges you to give us these details. Without a name, an email address and a message, we can’t reply.

Visiting the site

Vercel hosts the site, and its servers log each request: your IP address, browser, the page requested and the time. If the contact form fails to send, the log also records the email address the message was for. We keep these logs to run the site and to trace faults and attacks, which is our legitimate interest under Article 6(1)(f) GDPR.

Analytics and your consent

Vercel Web Analytics counts visits, and it runs only after you click Accept on the banner. It records the page you open, the site that sent you, your country, device type, operating system and browser. A returning visit is recognized by a hash of your request that is deleted after 24 hours, and what we see are totals that identify no one.

The legal basis is your consent, under Article 6(1)(a) GDPR and Article 4a of the Bulgarian Electronic Commerce Act. If you click Decline, the analytics script never loads.

You can change your answer at any time through Cookie settings at the foot of every page. Withdrawing consent stops the counting from then on. Counting done before you withdrew stays lawful.

Your browser’s local storage keeps one entry, init-analytics-consent, which holds your answer and the date you gave it so the banner doesn’t return on every page. After six months it expires and the banner asks again. The site stores nothing else in your browser, apart from a security cookie that Vercel’s firewall sets for one hour if it ever asks your browser to pass a bot check.

Who processes your data

These companies process personal data for us, only on our instructions and under a data processing agreement with each:

• Vercel Inc. hosts the site, runs the contact form and provides the analytics.
• Resend, Inc. sends your message to our inbox and the confirmation to you.
• Google, through Google Workspace, hosts our inbox, which receives your message and sends our replies.

Transfers outside the EU

Vercel, Resend and Google are based in the United States, and your data is processed there. Each is certified under the EU-US Data Privacy Framework, which the European Commission found to protect personal data adequately in Implementing Decision (EU) 2023/1795. Their data processing terms also include the EU Standard Contractual Clauses, and we’ll send you a copy on request.

How long we keep it

• Messages that don’t lead to a project: 3 years from our last exchange, then deleted.
• Correspondence with clients: 5 years after the project ends, the general limitation period under Bulgarian law.
• Invoices and accounting records: 10 years from the start of the year after they were issued, as the Bulgarian Accountancy Act requires.
• Email copies held by Resend: 30 days.
• Request logs held by Vercel: 30 days at most.
• The analytics hash: 24 hours.
• Your banner answer: 6 months, in your own browser.

Your rights

Under the GDPR you can ask us to:

• give you a copy of the personal data we hold about you
• correct it if it is wrong
• delete it
• restrict its use while a question about it is settled
• send the data you gave us, in a machine-readable format, to you or to another company

You can also object at any time to a use that rests on our legitimate interest, and we stop unless we have compelling grounds that override yours.

Send requests to build@initcatalyst.com. We answer within one month, free of charge. A complex request can take up to two more months, and if it does, we tell you why within the first month. We may ask you to confirm who you are before we answer.

Complaints

If you believe we have handled your data unlawfully, you can complain to the Commission for Personal Data Protection (КЗЛД), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, kzld@cpdp.bg, www.cpdp.bg. You can also complain to the data protection authority of the EU country where you live or work.

Changes to this policy

When the way we handle personal data changes, we update this page and the date at the top.