Privacy Policy

This Privacy Policy describes how Loovl OÜ processes personal data of visitors to klarproof.com and any subdomain. It is written to comply with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and the Estonian Personal Data Protection Act.

1. Who we are

• Controller: Loovl OÜ
• Estonian registry code: 17497447
• VAT number (KMKR): EE102982660
• Registered address: Ravi tn 19-1, 30326, Kohtla-Järve, Ida-Virumaa, Estonia
• Privacy contact: privacy@klarproof.com

We have not appointed a Data Protection Officer because we are below the GDPR thresholds requiring one. The mailbox above is the dedicated channel for all privacy-related requests.

2. What we collect, and what we don't

2.1 What we don't collect

• We do not use cookies for tracking, analytics, or advertising.
• We do not use Google Analytics, Facebook Pixel, Mixpanel, Amplitude, or any third-party analytics.
• We do not use cross-site tracking, persistent fingerprinting, or session-replay tools.
• We do not embed third-party advertising code.
• We do not set any third-party cookies.

2.2 Web server logs

Our web server (Nginx, hosted with Hetzner Online GmbH in the EEA) records standard access logs containing your IP address, timestamp, requested URL, response status, user agent, and referrer. These logs are kept for up to 14 days for security and abuse-prevention purposes (rate limiting, intrusion detection, fraud investigation). They are not used for marketing or analytics.

2.3 Analytics (Pulse)

We measure how the site is used with Pulse — our own privacy-friendly analytics, built and self-hosted by Loovl OÜ on our EU server (pulse.loovl.eu, Hetzner, EEA). It is not Google Analytics or any third-party service, and it is cookieless: it sets no cookies and no localStorage on your device.

For each page view, Pulse records the page path, the referring page, an approximate location (country, region, city) derived from your IP, your device type, browser and operating system, screen size, and any UTM campaign parameters present in the link. Full query strings are not stored — only UTM parameters are extracted — to avoid capturing tokens or other sensitive values.

Your IP address is never stored. It is used only momentarily, in memory, to derive the approximate location and a daily-rotating pseudonymous hash (a SHA-256 of your IP + user agent + a daily secret + the site ID). That daily secret rotates every 24 hours and is then deleted, so the same visitor cannot be re-identified across days, and there is no cross-site or long-term profiling. Bot traffic is filtered out.

All analytics data stays on our EU infrastructure and is never transferred to the United States. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — the measurement is minimal, pseudonymous and cookieless, which is why no consent banner is required. You can object at any time (Section 8); blocking pulse.loovl.eu in any content or privacy blocker also stops the measurement.

2.4 Browser-side preferences

The site uses your browser's localStorage to remember reading preferences across visits — your choice of theme (light / dark), colour palette, and font size. These values are stored in your browser only and never transmitted to us. You can clear them at any time via your browser's "clear site data" function. They are not personal data in our hands because we cannot read them.

2.5 Fonts

The site uses self-hosted fonts (Fraunces, Inter and JetBrains Mono), served from the same EU server (Hetzner, EEA) as the rest of the page. No fonts are requested from Google Fonts or any other third-party CDN, so your IP address is never disclosed to a font provider. If the fonts fail to load for any reason, the site remains fully usable with your system fonts (browsers fall back automatically).

2.6 When you email us

If you write to info@klarproof.com or privacy@klarproof.com, we keep the message, your email address, and any attachments for as long as needed to handle your inquiry, then archive for up to 24 months for follow-up reference.

2.7 Special categories of data

We do not knowingly collect special categories of personal data (Article 9 GDPR — health, biometric, religious, political, etc.). Please do not submit such data to us.

3. Why we process this data and on what legal basis

Purpose	Data	Legal basis (Art. 6 GDPR)
Detect and prevent abuse, fraud, brute-force attacks, scraping	Server logs (IP, timestamp, request)	Legitimate interest — Art. 6(1)(f). Necessary to keep the site available.
Measure site usage to improve our content (privacy-friendly analytics, Section 2.3)	Page path, referrer, approximate location, device/browser/OS, screen size, UTM — plus a daily-rotating pseudonymous hash; no IP stored	Legitimate interest — Art. 6(1)(f). Minimal, cookieless, pseudonymous.
Reply to your email	Email address, message content	Legitimate interest — Art. 6(1)(f), or Performance of pre-contractual measures — Art. 6(1)(b) if you contact us about a paid product.
Comply with legal obligations	Whatever data is responsive to a lawful request	Legal obligation — Art. 6(1)(c).

We do not engage in automated decision-making that produces legal or similarly significant effects on you (Article 22 GDPR).

4. How long we keep your data

Category	Retention
Web server access logs	14 days
Pulse analytics events (pseudonymous, no IP)	Up to 3 years
Daily visitor-hash secret (salt)	Deleted after 2 days
Email correspondence	24 months
Browser localStorage (theme, palette, font size)	Until you clear browser data — held by you, not us

When the retention period expires, we permanently delete the data through automated processes, unless an ongoing legal claim, fraud investigation, or legal obligation requires longer retention.

5. Cookies

We do not set any cookies on your browser — including our analytics, which is cookieless (Section 2.3). We do not need a cookie consent banner under the EU ePrivacy Directive because we do not store or access information on your device beyond the strictly-necessary localStorage preferences (Section 2.4) which you yourself trigger by changing a setting.

6. Who we share your data with

• Hetzner Online GmbH (Germany / Finland) — hosting and infrastructure. Both our web server logs and our Pulse analytics run on Hetzner infrastructure within the European Economic Area.
• Estonian and EU public authorities — only when legally required (court order, regulator inquiry). We will notify you of such requests unless legally prohibited.
• Professional advisors (lawyers, accountants) — bound by professional confidentiality, on a need-to-know basis.

We do not sell, rent, or trade personal data with anyone for marketing or advertising purposes.

7. International data transfers

All infrastructure that processes your data — web server logs and Pulse analytics alike — is located entirely within the European Economic Area (Germany and Finland, Hetzner data centres). We do not transfer your personal data to the United States or any other third country. Fonts are self-hosted (Section 2.5), so loading a page makes no third-country requests.

8. Your rights

Under the GDPR you have the following rights, exercisable at any time by emailing privacy@klarproof.com:

• Right of access (Art. 15) — a copy of any personal data we hold about you.
• Right to rectification (Art. 16) — correction of inaccurate or incomplete data.
• Right to erasure (Art. 17) — deletion of your data, except where retention is required by law.
• Right to restriction of processing (Art. 18) — pause processing while a dispute is being resolved.
• Right to data portability (Art. 20) — a structured, machine-readable copy of data you provided.
• Right to object (Art. 21) — object to processing based on legitimate interest, including our analytics. For direct marketing the objection is absolute; for other legitimate-interest processing we will weigh your specific situation.
• Right not to be subject to automated decision-making (Art. 22) — we do not make such decisions.

We will respond to all rights requests within 30 days. We may extend by a further two months for complex requests, in which case we will inform you within the first 30 days. Requests are free of charge unless they are manifestly unfounded or excessive.

Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon — AKI):

• Web: aki.ee/en
• Email: info@aki.ee
• Address: Tatari 39, 10134 Tallinn, Estonia

You may also lodge a complaint with the supervisory authority of the EU/EEA Member State where you live or work. We publish an editorial profile of AKI at /regulators/estonia/aki.

9. Security

The site is served as static HTML over TLS, with HTTP security headers, fail2ban, and rate limiting on the host. The klarproof website itself has no user accounts, comment forms, or payment processing. Usage analytics are recorded by our own Pulse system (Section 2.3) — pseudonymously and without storing your IP.

In the event of a personal data breach affecting your data, we will notify the Estonian Data Protection Inspectorate within 72 hours where required by Article 33 GDPR, and notify you without undue delay if the breach is likely to result in a high risk to your rights and freedoms (Article 34 GDPR).

10. Children

The site is not directed to children under the age of 16. We do not knowingly process personal data of children under 16. If you believe we have inadvertently collected such data, please contact privacy@klarproof.com and we will delete it.

11. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. The "Effective date" at the top will be updated. The current version is always available at https://klarproof.com/privacy.

12. Contact

For any privacy question, request, or complaint:

• Email: privacy@klarproof.com
• Postal address: Loovl OÜ, Ravi tn 19-1, 30326, Kohtla-Järve, Ida-Virumaa, Estonia

We aim to respond to privacy inquiries within five (5) business days.