Privacy Policy

PROOF48 runs proof48.com and designs and builds websites. PROOF48 is the controller of the personal data described here. For anything about your data, write to [email protected].

When you send the start form, we collect:

• your name, business name and email address
• your current website and the reference website you pick
• the business description, pages and notes you write
• the language you want the site in
• your IP address, used to stop spam (max 3 sends per 15 minutes)

The form is saved on our own server. Our team gets a short Telegram message with your name, business, email and reference site so we can approve the build quickly. We send you a confirmation email through Resend, our email provider. We use all of this only to build your site and talk to you about it.

When you buy a plan, you pay on a Stripe Checkout page, and you manage your subscription in the Stripe customer portal. Your card details go to Stripe and never touch our server. We receive what Stripe sends us: your name, email, the plan and the payment status. Stripe processes payment data under its own privacy policy and may set its own cookies on its pages.

When you first visit the site, a banner asks whether you accept analytics cookies. You can accept or reject with equal ease. If you reject, Google Analytics does not set any cookies and does not collect any data about your visit. You can change your choice at any time with the “Cookie settings” link in the footer.

Three analytics tools run on this site:

• Google Analytics 4, from Google Ireland Limited. It sets cookies (_ga and _ga_ followed by a code) that last up to 2 years, and your IP address reaches Google. Some data may be transferred outside the EU under Google’s terms. We only activate this after you accept. You can also block it in your browser or with the Google Analytics opt-out add-on.
• Plausible Analytics, hosted by Plausible in the EU. It sets no cookies and stores no personal data. It counts page views.
• Umami, which we host ourselves on our own server. It sets no cookies and does not store your IP address. It counts page views and clicks on the start, email, phone and WhatsApp links, plus form sends and checkout clicks.

Our own site sets one cookie, NEXT_LOCALE, only when you switch language. It remembers English or Romanian for a year and holds nothing else.

The site runs on our server at Hetzner in Germany and sits behind Cloudflare for DNS, security and speed. Both see your IP address and browser details for each request, like any web server. See Cloudflare’s privacy policy.

We handle your form and payment data because you asked us to build a site, which is a contract or the steps before one (GDPR Art. 6(1)(b)). Analytics, spam protection and security rest on our legitimate interest in running the site (Art. 6(1)(f)). We do not sell your data and we do not send you marketing without your consent.

We keep project data for as long as we work together, then for as long as tax and accounting law requires for invoices. If you send the form and we never start a project, write to us and we delete it.

Under the GDPR you can ask us to:

• show you the data we hold about you and give you a copy
• correct data that is wrong
• delete your data
• limit how we use it, or object to it
• hand it to you in a format you can take elsewhere

Write to [email protected] and we reply within 30 days. You can also complain to your data protection authority. In Romania that is ANSPDCP, dataprotection.ro.

When we change what runs on the site, we update this page and the date at the top.