Privacy Policy

We treat privacy the way we treat everything else here: say what happens, and claim nothing beyond it. This policy describes what data reaches us, why, and what happens to it afterwards.

We are established in the European Union and we comply with the General Data Protection Regulation. If anything here is unclear, write to us.

The data controller for your personal information is:

What you give us

• Contact form: your name, your email address, your company if you choose to give it, and your message.
• Email: whatever you write when you email us directly.

What the site handles on its own

• Your IP address, for the length of the request. The contact form uses it for two things: to limit how many messages one address can send in an hour, and to run the anti-bot check described below. We do not store it, and it is not included in the message that reaches our inbox.
• Aggregate visit data. We use Vercel Analytics. It sets no cookies. Your IP address is processed for a moment to count the visit and is never stored, so we can see how many people came and never who.

The analytics gives us page views and visitor counts, where visitors came from, country-level location, and the type of device and browser. All of it aggregated.

We do not run a newsletter and we collect no email addresses for one. If that ever changes, it will have its own signup, its own consent, and this page will say so before anything is collected.

• To answer you. When you write, we use your details to reply.
• To do the work. If you become a client, we use your details to run the engagement.
• To keep the form usable. The IP check and the anti-bot check exist so the contact form is not buried under automated submissions.
• To improve the site. Aggregate analytics tell us which pages are read.

Under the GDPR, each purpose needs a basis. Ours are:

• Steps taken at your request: answering an enquiry you sent us. Replying is the thing you asked for.
• Contract: processing we need in order to deliver work you have engaged us for.
• Legitimate interest: keeping the contact form usable through rate limiting and the anti-bot check, and understanding aggregate traffic. Neither involves profiling you.
• Consent: only where we ask for it explicitly. Today we ask for it nowhere.

We do not sell your data, and we share it with nobody for advertising. Three service providers process it on our behalf:

• Resend: delivers the contact form message to us and the confirmation to you. They see what the form contained.
• Vercel: hosts the site and provides the aggregate analytics.
• Cloudflare: provides Turnstile, the check that runs on the contact page to tell a person from a bot. It receives your IP address and signals from your browser when you open that page, before you send anything.
• Legal requirements: if we are legally obliged to disclose information, we will.

Resend, Vercel and Cloudflare are United States companies, so your data may be processed outside the European Economic Area. Each is engaged under a data processing agreement that relies on the European Commission's standard contractual clauses and, where the provider is certified, on the EU-US Data Privacy Framework.

If you want to see the terms we are on with any of them, ask and we will send them.

• Contact messages: in our mailbox for up to two years after our last exchange, then deleted. Ask sooner and we delete sooner.
• Client records: for the length of the relationship plus seven years, which is what Estonian accounting law requires of the underlying documents.
• Server logs: a submission rejected as spam is logged as a reason code and nothing else. No name, no email address, no IP.
• Analytics: aggregate figures only, with no personal data in them, kept indefinitely.

Under the GDPR you have the right to:

• Access: get a copy of the data we hold about you.
• Rectify: have inaccurate or incomplete data corrected.
• Erase: have your data deleted.
• Restrict: limit how we process it.
• Portability: receive it in a machine-readable format.
• Object: object to processing based on legitimate interest.
• Withdraw consent: wherever processing rests on consent.

To exercise any of them, email contact@innovacastle.com. We answer within 30 days.

You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or to the supervisory authority where you live.

This site sets no cookies. Not one.

It stores a single item on your device: the language you chose, so the site keeps speaking it on your next visit. It stays in your browser, it never reaches us, and clearing your browsing data removes it.

Our analytics uses no cookies either. There is no tracking cookie, no advertising cookie, and no third-party cookie anywhere on the site.

• Everything travels over TLS. There is no unencrypted path to us.
• Hosting runs on Vercel, with Cloudflare in front of the contact page.
• Access to the mailbox is limited to the people who need it.
• Credentials live in the deployment environment, never in the code or the repository.
• The contact form is protected by four independent checks, so an automated submission has to defeat all of them.

No system is perfectly secure. These are reasonable measures, not a guarantee, and we would rather say so.

When the site changes what it does with data, this page changes in the same breath, and the date at the top moves. If a change materially affects how we use data you have already given us, and we have a way to reach you, we will tell you directly.

If you have a question about this policy or about data we hold:

We usually answer within two or three business days.