Privacy policy

This policy explains what inoku.com stores about you, why, for how long and what you can do about it. The short version: ordinary server logs, one cookie that remembers your answer to the cookie notice, and the messages you send us so that we can reply.

Who is responsible

The controller is Inoku, Larnaka, Cyprus, reachable at hello@inoku.com. Full details are in the legal notice.

What this site does not do

• No tracking cookies and no advertising cookies.
• No analytics, no Google Analytics, no tracking pixels.
• No third-party requests. Fonts, images, styles and the one script come from our own server.
• No accounts, no log-in, no profiling.

Cookies

The site sets one cookie, inoku_consent, and only after you answer the cookie notice. It stores your answer (essential only, or all categories) and the date, so that the notice doesn’t come back on every page. It holds nothing that identifies you, it is sent only to inoku.com, and it expires after 180 days. If your browser has JavaScript off, the notice never appears and no cookie is set.

The categories in the notice are:

• Essential. The consent cookie itself. Always on, because without it we can’t remember that you answered.
• Functional. Reserved for preferences you may set on this site in future, for example in the beta tools. Nothing uses it today. If that changes, this page will say what is stored and why before it goes live.

You can change your answer at any time through “Cookie settings” in the footer, or by deleting the cookie in your browser.

We register the site with Google Search Console and Bing Webmaster Tools so that we can see how it appears in search results. Both are verified with a meta tag in the page; neither sets a cookie, runs a script or sends any request from your browser. The data they show us comes from the search engines’ own systems, not from your visit.

Server logs

Our web server (Caddy) writes an access log. A log line can hold your IP address, the time, the page or file requested, the response code, your browser’s user-agent string and the referring page, if any.

We keep these logs for 14 days and then delete them. We use them only to keep the site running, find faults and detect abuse. The legal basis is our legitimate interest in operating a secure website (Article 6(1)(f) GDPR). Requests reach us through Cloudflare, Inc., which proxies the site and so processes connection data (your IP address and the request) on our behalf to serve and protect it.

Messages you send us

The forms on this site post to our own server, which turns what you typed into one email, sends it to our mailbox through Infomaniak’s mail servers and keeps no copy. Its own log records only the time, which form it was and whether the email was sent: never the content, your address or your IP. To stop floods, it counts submissions per IP address for ten minutes in memory only; that count is never written anywhere. The web-server access log described above applies to that request as to any other. If the email can’t be sent, the page says so and asks you to write to us directly; nothing is stored in that case either.

When you write to us, by form or by email, we receive what you give: name, email address, company, your message and any other fields on that form. We keep them in our mailbox so that we can reply. The legal basis is your request (Article 6(1)(b) GDPR) or, where you contact us without asking for anything, our legitimate interest in answering (Article 6(1)(f)).

We keep correspondence while the conversation is live and for two years after it ends, unless a legal duty or a dispute requires longer. Design-partner applications are deleted when the programme ends, unless you ask us to keep them. Security reports are handled the same way; if you ask for credit, we publish only the name you give us.

Our mailbox is hosted by Infomaniak Network SA in Switzerland, a processor acting on our behalf. Switzerland is covered by an EU adequacy decision.

Who else sees your data

Nobody, apart from the hosting and email providers above, who act on our instructions. We don’t sell, rent or share personal data, and we don’t use it for advertising. We disclose data only if the law requires it.

Hosting is with Hetzner Online GmbH in Helsinki, Finland. Any transfer outside the European Economic Area rests on an adequacy decision or on the EU standard contractual clauses.

Your rights

Under the GDPR you can ask us to:

• tell you what personal data we hold and give you a copy (Article 15);
• correct it (Article 16);
• delete it (Article 17);
• restrict how we use it (Article 18);
• hand it over in a portable format (Article 20);
• stop processing based on legitimate interest (Article 21).

Write to hello@inoku.com. We reply within one month, and may first ask you to confirm your identity.

Complaints

If you think we’ve handled your data badly, tell us first and we’ll try to put it right. You can also complain to a supervisory authority, in particular in the EU country where you live or work. Our authority is the Office of the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy). The European Data Protection Board lists all of them.

Changes

If this policy changes, the date at the top of the page changes with it. We won’t apply a change to data we already hold without telling you.