Privacy Policy

Introduction

At Innova Castle, we believe privacy is a fundamental right, not a checkbox. This policy explains what data we collect, why we collect it, and what we do with it.

We comply with the General Data Protection Regulation (GDPR) and other applicable privacy laws. If you have questions, just reach out.

Who We Are

The data controller for your personal information is:

What We Collect

Information you give us

• •Contact form: Name, email, company (optional), and your message
• •Email: When you email us directly
• •Newsletter: If you choose to subscribe, just your email address

Information collected automatically

We use Vercel Analytics, a privacy-focused analytics tool that does not use cookies and does not collect personally identifiable information. It gives us:

• •Page views and visitor counts (aggregated)
• •Referral sources (how you found us)
• •Country-level location (not your exact location)
• •Device type and browser (for optimisation)

How We Use Your Information

• •To respond to you: When you contact us, we use your info to reply
• •To deliver projects: If you become a client, we use your details to manage the project
• •To send updates: If you subscribe to our newsletter (only with your consent)
• •To improve our site: Aggregate analytics help us understand what works

Legal Basis for Processing (GDPR)

Under GDPR, we process your data based on:

• •Consent: When you submit a contact form or subscribe to updates
• •Contract: When we need your data to deliver services you've requested
• •Legitimate interest: For basic analytics and security, where it doesn't override your rights

Who We Share Your Data With

We don't sell your data. Ever. We only share with:

• •Resend: Our email service provider. They process contact form submissions and transactional emails. GDPR compliant.
• •Vercel: Our hosting provider and analytics. Privacy-first, no personal data collected.
• •Legal requirements: If we're legally required to disclose information

How Long We Keep Your Data

• •Contact form submissions: Up to 2 years after your last interaction, unless you ask us to delete sooner
• •Client data: For the duration of our business relationship plus 7 years (for legal/tax purposes)
• •Analytics: Aggregated and anonymised, kept indefinitely

Your Rights Under GDPR

You have the right to:

• •Access: Request a copy of the data we hold about you
• •Rectify: Correct inaccurate or incomplete data
• •Erase: Request deletion of your data ("right to be forgotten")
• •Restrict: Limit how we process your data
• •Portability: Get your data in a machine-readable format
• •Object: Object to processing based on legitimate interests
• •Withdraw consent: Unsubscribe from communications at any time

To exercise any of these rights, email us at contact@innovacastle.com. We'll respond within 30 days.

You can also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local supervisory authority.

Cookies & Analytics

Good news: we keep this simple.

Our analytics (Vercel Analytics) is privacy-first and doesn't use cookies at all. It collects aggregate data only — we can see how many people visit, but we can't identify individuals.

Security

We protect your data with:

• •SSL/TLS encryption for all data in transit
• •Secure hosting infrastructure (Vercel + Cloudflare)
• •Limited access on a need-to-know basis
• •Regular security reviews

No system is 100% secure, but we take reasonable measures to protect your information.

Policy Changes

We may update this policy occasionally. When we make significant changes, we'll update the "Last updated" date at the top. For major changes that affect how we use your data, we'll notify you directly if we have your contact information.

Questions?

If you have questions about this policy or how we handle your data, we're happy to help: