Draft for the public beta. This text is not legal advice and must be reviewed by a lawyer before launch. Highlighted parts are placeholders to fill in.
Privacy Policy
1. Who we are
Kaffa (“we”, “us”) is a website builder operated by [legal name of the operator], [address], [company ID / OIB]. Contact for privacy questions: [privacy e-mail].
For personal data in your account we are the controller. For data your visitors send through your published website (for example the contact form) you are the controller and we act as your processor.
2. What data we process and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| E-mail address and login records | Creating and securing your account | Contract, Art. 6(1)(b) |
| Website content you create (text, images, settings) | Storing, editing and publishing your website | Contract, Art. 6(1)(b) |
| Messages from your website's contact form | Delivering enquiries to you | On your behalf as processor, Art. 28 |
| Technical logs (IP address, browser, errors) | Security, abuse prevention, fixing bugs | Legitimate interest, Art. 6(1)(f) |
| Feedback you send us | Improving Kaffa during the beta | Consent, Art. 6(1)(a) |
We do not sell personal data and we do not use it for advertising.
3. Data stored in your browser
During the beta, the editor saves your work in your browser's local storage so nothing is lost while you edit. This storage is strictly necessary for the service and is not used for tracking. You can delete it at any time in your browser settings.
4. Service providers
We use the following processors, bound by data processing agreements:
- [Supabase]: accounts, database and file storage (EU region)
- [Cloudflare]: hosting, content delivery and spam protection
- [Resend / Brevo]: sending e-mails about form submissions
- [Sentry]: error reporting, if enabled
Where data is transferred outside the EU/EEA, we rely on the EU Standard Contractual Clauses or an adequacy decision.
5. Published websites
Websites published with Kaffa load fonts and scripts from the same address as the website. They set no tracking cookies. Images or videos you embed from other services (for example YouTube) may be loaded from those services.
6. How long we keep data
- Account and website data: while your account exists, deleted within [30] days after you delete it
- Contact form messages: until you delete them, at most [12 months]
- Technical logs: at most [30] days
7. Your rights
You have the right to access, correct, delete and export your data, to restrict or object to processing, and to withdraw consent. To use these rights, write to [privacy e-mail]. You also have the right to lodge a complaint with a supervisory authority; in Croatia that is the Agencija za zaštitu osobnih podataka (AZOP), azop.hr.
8. Changes
We will announce material changes to this policy in the editor and by e-mail before they take effect.