Back to Home

Privacy Policy

Last updated: 2 July 2026

1. Data Controller

PromptsFlow, obrt za računalno programiranje ("we", "us", "our") is the data controller responsible for your personal data.

Registered address: Tepli bok 27A, 21223 Okrug Gornji, Croatia. OIB: 76368856795. VAT ID: 76368856795.

For questions about this policy, contact us at hello@promptsflow.agency.

2. Data We Collect

We may collect the following categories of personal data:

  • Identity data: name.
  • Contact data: email address, website or store URL.
  • Message content: information you provide in contact form messages.
  • Technical data: browser type, operating system, device type, and referring URL (via cookieless analytics; IP addresses are not stored in identifiable form).
  • Usage data: pages viewed and navigation paths (via cookieless analytics).
  • Newsletter data: email address and a record of your marketing consent when you subscribe.

3. Legal Basis for Processing (GDPR Art. 6)

  • Consent (Art. 6(1)(a)): newsletter subscriptions.
  • Contractual necessity (Art. 6(1)(b)): processing needed to respond to your enquiries or provide our services.
  • Legitimate interest (Art. 6(1)(f)): cookieless website analytics, website security, and fraud prevention.

4. How We Use Your Data

  • To respond to contact form submissions and service enquiries.
  • To send marketing communications where you have opted in via our newsletter form.
  • To analyse anonymous website traffic and improve user experience.
  • To comply with legal obligations.

5. Data Sharing & Processors

We do not sell your personal data. We use the following trusted processors who handle data on our behalf:

  • CARNET (Croatia) — website hosting (EU servers).
  • Supabase Inc. — database hosting for contact submissions and newsletter subscribers (EU region: eu-north-1, Stockholm).
  • Umami Analytics (Umami Software Inc.) — cookieless website analytics via cloud.umami.is. Analytics data may be processed outside the EEA; where required, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.
  • Klaviyo Inc. — email marketing platform, used when we send newsletters. Subscriber data is transferred to Klaviyo based on your consent.

6. Data Retention

We retain personal data only as long as necessary for the purposes set out in this policy:

  • Contact form submissions: up to 24 months.
  • Newsletter subscribers: until you unsubscribe or withdraw consent.
  • Analytics data: according to Umami Cloud retention settings.

7. Your Rights (GDPR Chapter III)

Under EU data protection law you have the right to:

  • Access the personal data we hold about you.
  • Rectify inaccurate or incomplete data.
  • Erase your data ("right to be forgotten").
  • Restrict or object to processing.
  • Data portability — receive your data in a structured, machine-readable format.
  • Withdraw consent at any time without affecting the lawfulness of prior processing.
  • Lodge a complaint with your national Data Protection Authority.

In Croatia, the supervisory authority is the Croatian Personal Data Protection Agency (AZOP).

To exercise any of these rights, contact us at hello@promptsflow.agency.

8. Analytics & Cookies

We do not use cookies for tracking or marketing on this website. Fonts are served locally from our servers; we do not use third-party font CDNs such as Google Fonts.

We use Umami Analytics in cookieless mode to collect aggregated usage statistics. Umami does not use cookies, does not track users across websites, and does not store personally identifiable information. No cookie consent banner is required for this setup.

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via our website. We encourage you to review this page periodically.