Privacy Notice

Who is the data controller?

The data controller and website operator is Codama Labs Korlátolt Felelősségű Társaság (Codama Labs Kft.), with its registered office at 1183 Budapest, Üllői út 454. C. lház. 4. em. 7. ajtó, Hungary, company registration number 01-09-457059, tax number 33061526-2-43.

For privacy and inquiry matters, contact hello@codamalabs.ai.

What do we collect and why?

When you send an inquiry through the contact form, we collect the details you provide so we can understand, evaluate, and respond to your project or service inquiry, communicate about a possible engagement, and protect the form from abuse.

The form collects your name and email address, together with the optional company name, existing-website choice, website URL, and project description you provide.

What is our lawful basis?

We process contact-form data under GDPR Article 6(1)(b) where processing is necessary to take steps at your request before entering a contract, and under GDPR Article 6(1)(f) based on our legitimate interest in receiving, responding to, and administering business inquiries where you act as a contact person for an organisation.

We do not use contact-form data for newsletters, advertising, audience creation, or unrelated marketing, and we do not offer a marketing opt-in.

Who do we share your information with?

Access is restricted to authorised people within Codama Labs responsible for reviewing or operating inquiries.

We use the following contracted service providers to operate the contact flow: Vercel (hosting, server execution, PII-safe operational logs, and cookieless web analytics), Neon (durable storage of accepted inquiries), Resend (delivery of the inquiry-notification email), Google Workspace (a restricted destination mailbox), and Slack (a minimised internal operational notification containing only an opaque submission identifier). Google Analytics 4 is used only after your explicit opt-in; with your separate optional Ads measurement choice, Google also receives conversion-measurement data for Google Ads.

These providers may process data in the European Economic Area and the United States, where they operate; where personal data is transferred outside the EEA, we rely on the applicable transfer safeguards those providers publish, such as standard contractual clauses. Current provider privacy and DPA information is available at: Vercel (https://vercel.com/legal/privacy-policy), Neon (https://neon.tech/trust), Resend (https://resend.com/legal/privacy), Google and Google Workspace (https://policies.google.com/privacy), Slack (https://slack.com/privacy-policy), and Google Analytics (https://support.google.com/analytics/answer/6004245). We do not sell personal information.

How long do we keep your information?

Rejected, invalid, and rate-limited requests are not stored. Accepted inquiry records are held for 12 months unless they become an active client engagement, in which case only necessary information is transferred to the applicable client records and the website-lead copy is deleted within 30 days.

Inquiry correspondence is kept for 12 months after the last substantive exchange unless it forms part of an active contract or a separate legal-retention requirement.

Operational records are retained within the following limits: Slack notifications are deleted after no more than 90 days; Vercel runtime logs are retained for no more than 30 days and never contain submitted values; Neon backup and change history is limited to a 7-day window; Resend retains email delivery data for 30 days under its ordinary retention; and Vercel Web Analytics retains aggregated analytics for no more than 12 months. Google Analytics 4 event data is retained for 2 months.

Your rights

You have the right to access the personal information we hold about you, to ask us to rectify or erase it, to restrict or object to processing, to request portability where it applies, to withdraw analytics or Ads measurement consent at any time, and to complain to the Hungarian supervisory authority.

To exercise any of these rights, contact hello@codamalabs.ai.

Analytics and consent

Vercel Web Analytics operates without cookies and without prior opt-in, based on our legitimate interest in understanding basic site usage and technical performance. It is limited to aggregated measurement and to the approved coarse events in our typed analytics contract, and does not receive form values, contact details, submission identifiers, or other direct identifiers. It strips query strings and any potentially sensitive URL material, and retains aggregated data for no more than 12 months.

Google Analytics 4 loads only after you explicitly allow analytics cookies. Optional Google Ads conversion measurement, provided by Google, helps us understand which ads lead to inquiries using the same GA4 lead event. It requires analytics consent. Both purposes rely on your consent under GDPR Article 6(1)(a). Accept cookies allows both; Decline rejects both. Cookie settings lets you allow analytics with Ads measurement off and change or withdraw either choice at any time from the footer. Withdrawal stops future collection without affecting prior lawful processing. We ask again after six months or a material purpose change.

With your analytics consent, we use PostHog EU Cloud to measure page views, calls to action and contact-form steps and outcomes. We send only approved route names and coarse event properties with a temporary anonymous identifier kept in page memory. Page events include the page address without query string or fragment. We do not send names, email addresses, company names, messages, submission IDs or query strings, except the ad parameters described below with Ads measurement consent. IP addresses are discarded. Session replay, heatmaps, general interaction capture and console, error and network capture are disabled. You can withdraw consent in Cookie settings. Events use a two-month retention window; events outside that window are removed at the next monthly cleanup.

With Ads measurement consent, only the Google Ads click identifiers gclid, gbraid and wbraid may be included in the measured page URL. With Ads measurement consent, we also attach the Google Ads click identifiers (gclid, gbraid, wbraid) and campaign UTM parameters of your landing page, with a came_from_ad flag, to PostHog events for the rest of that browser session; they are kept in session storage and deleted when you withdraw Ads measurement consent. All other query parameters, URL fragments and referrer query parameters are removed. Google manages measurement cookies; we do not store click identifiers in an application database or send them with contact-form submissions. We do not send form values, contact details, user IDs, submission IDs or free-form properties to Google Analytics or Google Ads. Google Signals, personalised advertising, remarketing, enhanced conversions, user-provided-data collection and cross-domain tracking remain disabled. GA4 event data is retained for two months.

We store only your versioned analytics and Ads measurement choices and decision date in local storage (codama-analytics-consent). Choices are valid for up to 180 days. After analytics consent, Google Analytics uses _ga and _ga_<container-id> cookies to distinguish browsers and maintain session state; their default lifetime is two years, subject to browser limits and Google settings. After Ads measurement consent, linked Google tags may also use _gcl_* advertising-measurement cookies with a 90-day lifetime. Cookie lifetimes differ from GA4 event-data retention. Google's cookie information is at https://policies.google.com/technologies/cookies.