Privacy policy

What data I collect and why

The site only collects data you submit yourself, and only to get back to you:

• Contact forms: name, contact (email or Telegram), message. Basis — steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
• SEO audit form: your website address; when ordering the full report — your email, to deliver the report. Basis — your request.
• Meeting booking (Cal.com): name, email, chosen time. Basis — your request.
• Server and Cloudflare technical logs: IP address, requested pages. Basis — legitimate interest (site security and operation).

Analytics — only with your consent

The site uses Google Analytics 4 (via Google Tag Manager) to understand which pages are useful to visitors. Basis — your consent (Art. 6(1)(a) GDPR): trackers start only if you clicked “Accept” in the banner. Without consent, analytics stays off and no analytics cookies are set. You can withdraw consent at any time via the “Cookie settings” link in the site footer — analytics cookies are then deleted. GA4 data is pseudonymised and Google does not store IP addresses; some processing happens on Google servers in the USA under the EU standard contractual clauses. Data is never sold or shared with third parties for marketing.

Cookies

On plain browsing the site sets no cookies. They can appear only in two cases, both up to you:

• NEXT_LOCALE (your chosen language) — only if you switch the language yourself; a functional cookie that requires no consent.
• Google Analytics cookies (_ga and similar, up to 13 months) — only after you click “Accept” in the banner; deleted when you withdraw consent via “Cookie settings” in the footer.
• The color theme and your banner choice are kept in your browser’s localStorage and never reach the server.

Where data is stored and who processes it

Form submissions and Cal.com bookings are stored in a database on my own server in a Hetzner data center (Germany, EU). Audit automation runs on the same server (n8n). Processors:

• Hetzner Online GmbH (Germany) — server hosting.
• Cloudflare, Inc. (USA) — traffic proxying and site protection; sees visitor IP addresses. The transfer relies on the EU standard contractual clauses.
• Email provider — delivery of notifications to hello@dofollow.md.

How long data is kept

Form submissions and audit-form emails — up to 12 months from submission, then deleted. Technical logs — up to 30 days. Correspondence after we start working together is kept as long as accounting and tax law requires.

Your rights

At any time you can:

• request a copy of your data (right of access);
• correct inaccurate data;
• have your data deleted (right to be forgotten);
• restrict or object to processing;
• receive your data in a machine-readable format (portability).

Exercising your rights and complaints

Write to hello@dofollow.md — I reply within 30 days. If you believe your rights are violated, you may lodge a complaint with Moldova’s National Center for Personal Data Protection (CNPDCP, datepersonale.md).