Skip to content
CodeCraft Studio

Privacy Policy

Last updated: 17 October 2026

CodeCraft Studio respects your privacy. This page explains what data we collect, where and why, how long we keep it and what rights you have. We act in line with the General Data Protection Regulation (GDPR) and Croatian law. We do not sell personal data and we do not share it with third parties for marketing.

1. Who processes your data

The data controller is CodeCraft Studio. For any privacy question, write to us at [email protected].

2. What we collect and where

  • The “Request a quote” form on this site: full name, email address, the selected service and an optional project description. The data is sent to our team as an email; we do not store it in a database on the site.
  • Direct communication: messages you send us by email or through social media.
  • Technical data when you visit the site (IP address, browser and device type, time and requested page). It is logged by our hosting and network-security providers to deliver the site and keep it secure.
  • Analytics: the site uses Google Analytics (Google), which may set cookies and collect data about your visit (e.g. pages opened, time spent, approximate location, device and browser type) for statistics on how the site is used.
  • Client projects: data a client shares with us to build a website or app (e.g. texts, images, access credentials, app users' data).

3. Why, and on what legal basis

  • Answering your inquiry and preparing a quote (Art. 6(1)(b) GDPR – steps taken at your request before entering into a contract).
  • Performing a contract and working on a project (Art. 6(1)(b)).
  • Site security and preventing abuse such as spam (Art. 6(1)(f) – legitimate interest).
  • Visit statistics through Google Analytics (Art. 6(1)(a) – your consent, which you may withdraw at any time).
  • Complying with legal obligations such as accounting (Art. 6(1)(c)).

4. Data from our clients' projects

When we work on a website or app for a client, we use the data only to carry out that project. If the app processes data of its end users, the client is the controller and we act as a processor on the client's instructions and under a data processing agreement. We keep access credentials protected, use them only as far as necessary and delete or return them when the work ends.

5. What the websites and apps we build can collect

Which data a specific website or app collects depends on its features and on what we agree with the client. The client, as controller, decides what is collected and informs its users in its own privacy policy, while we help ensure that only what is necessary is collected. Most commonly this includes:

Websites and web apps

  • contact forms and email: name, email, phone, company, message, attachments
  • registration and user accounts: username, email, password (only in encrypted/hashed form), profile and settings
  • user-generated content: texts, comments, reviews, uploaded files and images
  • orders and bookings: delivery and billing address, date and time, selected products or services
  • payment: card details are entered with the payment provider; the site only receives status and amount
  • newsletter: email address and record of consent
  • sign-in with Google, Apple or Facebook: name, email and account identifier
  • automatic data on visit: IP address, browser, device, language, pages opened, clicks, traffic source
  • cookies and localStorage: necessary (session, cart), functional (preferences), analytics and marketing (only with consent)
  • location, camera or microphone in the browser, only with the user's permission
  • embedded third-party content: maps, videos, social media plugins and chat widgets

Mobile apps (Android and iOS)

  • data entered by the user: profile, account, content, messages, sign-in with Apple or Google
  • device data: model, operating system, app version, language, time zone, network connection, IP address
  • identifiers: device or installation ID, advertising ID (IDFA / Google Advertising ID), push notification token
  • location: approximate or precise (GPS), only with the user's permission and while needed for the feature
  • access to device features with permission: camera, photo library, microphone, contacts, calendar, files, Bluetooth, notifications, health data (HealthKit / Health Connect); biometric sign-in (Face ID / fingerprint) returns only “success/failure”, no biometric data
  • usage analytics and crash reports: screens opened, features used, session length, app state at the time of a crash
  • purchases and subscriptions: what was bought and subscription status; cards are processed by Apple, Google or the payment provider
  • ad networks (e.g. AdMob): advertising ID and device data to serve ads
  • data stored on the device: settings, sign-in token, cache and offline content

Our principles

  • We collect only what a feature actually requires (data minimisation).
  • We do not build in tracking tools without the client's knowledge and we do not sell user data.
  • We do not store payment card data; payments go through authorised providers.
  • Sensitive data (health, religious, political, biometric) is processed only if a project explicitly requires it, with an appropriate legal basis and safeguards.

6. Who else sees the data

Only providers we need to run the site process the data, under contractual data-protection obligations:

  • The hosting server of CodeCraft Studio – Vercel and Cloudflare: hosting, delivery of the site, network security, DNS and sending the form email.
  • FormSubmit – a form-delivery service, used only as a fallback if our own sending system is unavailable.
  • Google – visit statistics (Google Analytics).

7. Transfers outside the EU/EEA

Some of these providers may process data outside the European Economic Area (e.g. in the USA). In that case we rely on the safeguards required by law, such as standard contractual clauses or an adequacy decision.

8. How long we keep data

We do not keep anything forever. Inquiry data is kept only as long as needed to reply and agree on cooperation, then deleted. If we work together, data needed for contracts and invoices is kept as long as the law requires. Client project data is deleted or returned when the project ends unless agreed otherwise or required by law. Server logs are deleted by the providers on their own schedules. Google Analytics data is kept according to the retention settings of our account and Google's rules.

9. Security

The site is delivered over an encrypted connection (HTTPS). Access to data is limited to the people who need it, and inquiries are never made publicly available. No system is completely impenetrable, but we regularly maintain and update our solutions.

10. Your rights

You have the right to access, rectify and erase your data, to restrict processing, to data portability and to object, and to withdraw consent at any time. Send your request to [email protected] and we will reply without undue delay. If you believe we process data unlawfully, you can lodge a complaint with the Croatian Personal Data Protection Agency (AZOP, azop.hr) or your local supervisory authority.

11. Children

The site is not intended for people under 16 and we do not knowingly collect their data.

12. Changes

We may update this policy from time to time. The current version is always on this page, with the date of the last update shown at the top.