Privacy Policy

Hosting and technical logs

This website and its serverless functions are hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When the website is accessed, Vercel processes technical connection data needed to deliver and secure the service, including the IP address, approximate location derived from it, requested path, date and time, browser/device information and diagnostic data. The legal basis is Article 6(1)(f) GDPR: the legitimate interest in securely and reliably providing the website. Runtime logs are retained for up to three days under the current platform settings/documentation. Vercel may process data in the United States and other countries and states that it uses the EU-U.S. Data Privacy Framework and, where required, Standard Contractual Clauses or other legal safeguards. See the Vercel Privacy Notice.

Local analytics storage

This website does not currently store analytics or click-tracking events in cookies or browser local storage and does not load Google Analytics or Plausible Analytics. Functional navigation events may be handled temporarily in the active page only and are not persisted by this website.

Visitor statistics (Vercel Web Analytics)

Since 25 September 2026 this website counts visits with Vercel Web Analytics, provided by Vercel Inc., the same provider that hosts it. For each page view it records the time, the page opened, the referring page (for example Facebook or Google), filtered URL parameters, the country and city derived from the request, the device type, operating system and browser. No cookies are used and nothing is stored in your browser. A returning visitor is recognised only by a temporary identifier calculated from the request, which is discarded automatically after 24 hours; the IP address is not stored in the statistics. We see the data only as aggregated statistics that cannot be linked to an individual.

The purpose is to understand how many people read the website and which channels they come from. The legal basis is Article 6(1)(f) GDPR: the legitimate interest in understanding the use of our own website. The aggregated statistics are available to us for one month; Vercel may keep them longer under its own policies. For transfers outside the EU, the information given above for hosting applies. See Vercel: Web Analytics privacy and compliance.

Own visit counter

Since 10 October 2026, alongside Vercel Web Analytics, this website counts page views, clicks on contact buttons (e-mail, WhatsApp, booking) and submitted forms with a counter we operate ourselves. For each of these actions one daily count is increased per page, referring website (the host name only, for example facebook.com), country derived from the request, and device class (mobile or desktop). No IP address, user agent, cookie or personal identifier is stored, nothing is stored on your device, and the counter cannot recognise returning visitors. The counts are kept in a database of our processor Supabase (Supabase Inc.), hosted in the EU.

The purpose is to see which pages and contact buttons are used. The legal basis is Article 6(1)(f) GDPR: the legitimate interest in understanding the use of our own website. The owner's own visits are excluded by a setting that is stored only in the owner's own browser.

Controller

Name: Goran Mikac (Freelancer)

Email: hello@goranmikac.com

Address: Suderstraße 87, 55120 Mainz, Germany

Get your website review form

The contact form requests your website URL and email address and may also include your message and selected focus area. These fields are needed to deliver and answer the requested review; without an email address, the form cannot be submitted. Processing is based on Article 6(1)(b) GDPR for steps requested before entering into a contract and, for other inquiries, Article 6(1)(f) GDPR based on the legitimate interest in answering business inquiries.

The form is technically transmitted through FormSubmit, an external form-to-email delivery service. FormSubmit receives the submitted fields and normal connection data to forward the inquiry to hello@goranmikac.com. Do not enter passwords, health data or other sensitive information. You can use email instead of the form. FormSubmit's public documentation does not specify a fixed retention period or all processing locations; therefore this service remains subject to vendor and legal review. See the FormSubmit privacy terms.

On the price list and webshop pages, we receive a copy of every enquiry by e-mail, and if you enter an e-mail address in the contact field, we automatically send one confirmation that your enquiry arrived. For this, the form fields (name, contact, website address, business or platform, note and the automatic check result) are passed to Resend (Plus Five Five, Inc., USA), see Subscription to notices. The website does not store this data. The legal basis is Article 6(1)(b) GDPR, steps prior to a contract at your request.

Project enquiries from the brief guide use the same Resend API in a single sending flow: Goran receives the email and full summary, and the sender receives an acknowledgement in the contact form language (HR/DE/EN). Fields include email, optional website and business, selected focus and summary/message. The guide sends nothing before you click Send. The summary is transferred in a URL fragment which is then removed; no cookies or local storage. The API briefly holds only a request hash, sending status and counters in instance memory to prevent repeated sending; no enquiry content is stored in a database. Emails remain in the mailboxes under the retention terms described above.

Subscription to notices about new rules

If you sign up for notices on the price list or webshop pages, we process your email address and the page where you signed up. We first send you an email with a confirmation link (double opt-in). Until you confirm, your address is not added to the recipient list; the link is valid for three days. After confirmation your address is added to the recipient list and we send you notices about new rules for price lists and webshops and about our related services. We do not track opens or clicks in these emails.

The legal basis is your consent under Article 6(1)(a) GDPR. You can withdraw consent at any time via the unsubscribe link in every email or by writing to hello@goranmikac.com; withdrawal does not affect the lawfulness of earlier processing. We keep your address until you unsubscribe. Emails are sent and the list is kept by Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA, as processor. Resend relies on the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses for transfers to the USA. See Resend's privacy policy and data processing addendum.

Weekly AI Digest for Small Businesses

Signing up on News covers the Weekly AI Digest for Small Businesses (Mikac Web & SEO) and occasional offers for related services. This consent is separate from price-list and webshop notices. The legal basis is your consent under Article 6(1)(a) GDPR. Every newsletter includes an unsubscribe link; you can also write to hello@goranmikac.com.

We record your email, signup source, language, exact consent wording, and signup and confirmation times. The confirmation email uses your signup language; your subscription starts only after your explicit confirmation click. Before confirmation, signup details travel in an encrypted confirmation link valid for 72 hours; no newsletter contact is added until confirmation. Confirmed contacts and their latest consent record are stored in a separate Resend news segment until you unsubscribe, without adding them to the price-list segment. Contact us by email to request deletion of consent records. Your News language choice is stored locally in your browser and is not sent to third parties. Signup analytics record only the source, without your email or confirmation token.

AI assistant

If you voluntarily use the AI assistant on the home page, the message, selected language and up to the last twelve messages from the current browser tab are sent through this website to the operator's separate backend at ai.goranmikac.com so that an answer can be generated. The widget does not create a stable user ID and does not persist the conversation in cookies or browser local storage. Processing is based on Article 6(1)(b) GDPR when you request information about services and otherwise on Article 6(1)(f) GDPR, the legitimate interest in providing and securing the requested assistant. Do not enter passwords, payment information, health data or other sensitive information. The backend's processor chain and retention still require a separate documented review; until that review is complete, the assistant should not be used for confidential information.

Email, WhatsApp and external links

Email and WhatsApp are optional contact channels. Data is transmitted to the relevant provider only when you select the link or send a message. WhatsApp is provided by WhatsApp Ireland Limited and may involve processing by Meta group companies outside the EEA. Use email if you do not want to use WhatsApp, and review the provider's EEA Privacy Policy. Other external links are governed by the privacy policy of the destination service.

Data retention

Vercel runtime logs are retained for up to three days under the current platform settings/documentation. Contact inquiries are retained only as long as necessary to answer the inquiry, manage any resulting contractual relationship and meet statutory retention duties. The separate FormSubmit and AI backend retention periods still require vendor review as described above.

Your rights

You may request access, correction, deletion, restriction of processing or data portability where applicable, and you may object to processing based on legitimate interests. Contact us by email. You also have the right to lodge a complaint with a supervisory authority, in particular the LfDI Rheinland-Pfalz.