Policy version: 2026-06-27. Gostivo Web is currently presented as a web design service brand. Formal registration details can be added after they are confirmed.
1. Introduction
This Privacy Policy applies when you visit the Gostivo Web website, send a project enquiry, save cookie preferences or access administrator functionality.
2. Operator and contact
The website is operated under the name Gostivo Web. Until formal business registration details are confirmed, this page does not display a registered address, tax number, company number or supervisory authority. Privacy requests can be sent to hello@gostivoweb.com.
3. Information collected
When you submit an enquiry, the website may collect your full name, email address, optional business name, optional phone number, optional country, business type, current website URL, estimated budget, project timeline, message, privacy acknowledgement, optional marketing consent, consent timestamp, source page, referrer and browser user agent.
4. How enquiries are submitted
Public enquiries are submitted through a Netlify Function that validates the request server-side before storing the enquiry in Supabase. The browser does not receive server-only Supabase credentials or private API secrets.
5. Purposes and legal bases
Enquiry data is used to respond to your request, discuss a potential project, take steps before entering a contract, maintain website and form security, remember consent preferences and keep internal enquiry records. Optional marketing messages are sent only if you choose the marketing checkbox and can be withdrawn later.
6. Marketing communication
You can submit an enquiry without agreeing to marketing. If you opt in and later want to withdraw consent, email hello@gostivoweb.com.
7. Service providers
Netlify is used for hosting and serverless form handling. Supabase is used for enquiry storage and administrator authentication. Resend may be used for notification emails only when configured in production. Cloudflare Turnstile is used for anti-bot checks when configured. Google Analytics 4 is used only after Analytics consent is granted. Google advertising storage, ad user data and ad personalization are denied and no Google Ads tracking is enabled.
8. International transfers
Service providers may process data in countries outside your location. Where applicable, data handling depends on the provider's own infrastructure, security commitments and transfer mechanisms.
9. Retention
Unsuccessful enquiries are reviewed periodically and kept only while needed to respond or manage a potential project. Active client communications may be retained as required for the business relationship, records and legal obligations. Marketing consent records are kept until withdrawal or a regular consent review. Exact retention periods should be confirmed before full commercial launch.
10. Security
The project uses HTTPS on deployment, Supabase Row Level Security, administrator authentication, server-side validation and least-privilege environment variables. No website or online service can guarantee absolute security.
11. Your rights
Depending on the law that applies to you, you may have rights to request access, correction, deletion, restriction, objection, portability and withdrawal of consent. You may also have the right to complain to a relevant data protection authority.
12. Cookies and consent preferences
Cookie preferences and the selected English or Croatian language are stored in first-party localStorage. Google Analytics 4 loads only after Analytics consent is granted. See the Cookie Policy for the current list of cookies and browser storage used by this website.
13. Third-party links and updates
The website may link to external websites or services with their own privacy practices. This policy may be updated when services, providers, registration details or retention practices change.
14. Contact
For privacy questions, access requests, correction requests or deletion requests, email hello@gostivoweb.com.