Privacy policy

This policy explains what personal data we process when you visit daidaloslabs.com or contact us through the website, why we process it and what rights you have. We keep data collection to the minimum needed to run the site and reply to inquiries.

Who is responsible

The controller of your personal data is:

• Daidalos Labs, Belgrade, Serbia
• Email: info@daidaloslabs.com

For any question about this policy or your data, write to us at the email address above.

What we process and why

Visiting the website

The website is a static site served by Cloudflare (Cloudflare Workers static assets), a service of Cloudflare, Inc. When you open a page, your browser sends technical request data to Cloudflare's servers, such as your IP address, user agent and the requested URL. Cloudflare processes this data in its logs and for security purposes, such as protecting the site from attacks, in order to deliver the site and keep it secure.

We do not have access to individual entries in these logs. The legal basis is our legitimate interest in operating a secure and available website.

Email, contact form and Labs waitlist

When you write to us by email, we receive your email address and whatever you put in the message. Our mailbox is hosted by Google (Gmail), email routing for our domain is handled by Cloudflare, and outgoing email is delivered through Brevo (EU).

When the online contact form or the Labs waitlist is enabled on the site, we also receive the information you enter in it:

• name
• email address
• company
• project type
• budget range
• timeline
• message

We use this data only to reply to your inquiry, discuss a possible project or let you know about Labs when there is news. The legal basis is taking steps at your request before entering into a contract and our legitimate interest in answering business inquiries.

The online forms are enabled only when we have connected a form service. In that case they are submitted directly from your browser to Formspree (Formspree, Inc., USA). Formspree acts as our data processor: it receives the submission and forwards it to us by email. Until then, the site offers an email link instead of a form.

Spam protection

When the online form is enabled, we use Cloudflare Turnstile to keep automated spam out of it, also provided by Cloudflare, Inc. Turnstile processes technical data from your browser and device, such as your IP address and browser characteristics, to tell humans from bots. The legal basis is our legitimate interest in protecting the forms from abuse.

Analytics

If analytics is enabled, we use Plausible Analytics (Plausible Insights OÜ, Estonia, EU) to understand how the site is used, for example which pages are visited and where visitors come from. Plausible does not use cookies and does not build profiles of individual visitors.

Even so, we load Plausible only after you give consent in our consent banner. The legal basis is your consent. You can withdraw it at any time through the "Cookie settings" link in the footer, and analytics stops loading from that point on. Analytics is currently switched off, so the site shows no consent banner and loads no analytics script.

Data stored in your browser

The site stores two small pieces of information in your browser's local storage: your consent choice and your theme preference (light or dark). This data stays on your device, is not sent to us and is not used for tracking. It is necessary for the site to remember your choices.

More details are in our cookie policy.

What we do not do

• We do not show advertising.
• We do not sell or rent personal data.
• We do not use your data for automated decision-making or profiling.

Who receives your data

Your data is processed by the following service providers, only to the extent needed for the purposes described above:

• Cloudflare, Inc. (USA): website hosting and security, email routing for our domain, and spam protection for the online form (Turnstile) when it is enabled
• Google (Gmail): the mailbox where we receive and answer email
• Brevo (EU): delivery of our outgoing email
• Formspree, Inc. (USA): form submission and delivery by email, only when the online form is enabled
• Plausible Insights OÜ (Estonia, EU): privacy-friendly analytics, only with your consent and only if analytics is enabled

We may also disclose data where required by law or by a binding order of a competent authority.

International transfers

Some of these providers, such as Cloudflare, Google and Formspree, are based in the USA, so personal data may be transferred outside Serbia and the European Economic Area. Where this happens, we rely on appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission or an adequacy decision, where applicable.

How long we keep data

• Enquiries (email, form submissions and waitlist sign-ups): kept no longer than needed to answer them and, at most, 24 months after our last contact, unless a contract follows. If a contract follows, we keep the data as long as the contract and legal obligations require.
• Server logs: kept by Cloudflare according to its own policies.
• Analytics: Plausible stores only aggregated statistics that do not identify individual visitors.
• Browser storage: stays on your device until you clear it.

Your rights

Under the EU General Data Protection Regulation (GDPR) and the Serbian Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti, "Sl. glasnik RS" br. 87/2018), you have the right to:

• access the personal data we hold about you
• have inaccurate data corrected
• have your data deleted
• restrict processing
• receive your data in a portable format
• object to processing based on legitimate interest
• withdraw consent at any time, without affecting processing that took place before withdrawal

To exercise any of these rights, contact us at info@daidaloslabs.com. We will reply without undue delay and within 30 days at the latest.

Right to lodge a complaint

If you believe we process your data unlawfully, you can lodge a complaint with a supervisory authority. In Serbia, this is the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti). If you live in the EU, you can also contact the data protection authority in your country.

Security

The site is served over HTTPS, forms are sent over encrypted connections and access to inquiries is limited to the people who need it to reply. No method of transmission or storage is completely secure, but we take reasonable measures to protect your data.

Changes to this policy

We may update this policy when the website or the services we use change. The date of the latest update is shown at the top of this page.