Privacy Policy
Last updated: August 5, 2026
Short version: we process the contact details you give us yourself, we collect visit statistics only if you consent, we use no advertising cookies, and we never sell your data.
Data controller
The data controller for this site is POI369 OÜ, registered at POI369 OÜ · Paavli tn 5a/1, 10412 Tallinn, Harju maakond (EE) · hello@poi369.com. For any privacy question, write to hello@poi369.com.
What data we collect
When you submit the contact form we receive your name, email address and message. There are no other fields.
When you buy a package, the payment step runs on Stripe: your card details never touch our servers. We only receive the line items, the amount and your billing email.
Our hosting provider keeps standard access logs: IP address, browser information, request time. These logs exist for security and debugging.
If you consent, we collect anonymous visit statistics through Google Analytics: which pages were viewed, how long the visit lasted, where the traffic came from. Without consent this measurement never runs.
Why we process it and on what basis
We process contact form data to respond to your request (GDPR art. 6(1)(b): pre-contractual steps). Server logs are processed under legitimate interest (GDPR art. 6(1)(f): security).
We do not add you to marketing lists and we do not sell or rent your data to third parties.
Cookies
We use no advertising or profiling cookies. The technically necessary ones always run: your language preference and your cookie choice itself are stored in your browser.
Beyond that there is only the analytics cookie, and it activates only if you accept it in the cookie banner shown on your first visit. If you decline, Google Analytics is never loaded. To change your mind later, clear the site data in your browser and the banner will ask again.
Service providers
Your data only passes through the infrastructure required to run the site:
- Our hosting provider - site server and access logs
- Resend (email delivery) - forwarding contact form messages and order notifications to us
- Stripe Payments Europe Ltd. - payment processing for package purchases; only Stripe sees card data
- Google Ireland Ltd. (Google Analytics) - anonymous visit statistics, only with your cookie consent
Retention
We keep contact messages for at most 24 months after the request is closed (for possible follow-up projects), then delete them. Want them gone sooner? Just say so.
Your rights
Under the GDPR you have the right to:
- Access your data and request a copy
- Request rectification and erasure
- Object to or restrict processing
- Data portability
- Lodge a complaint with the supervisory authority: the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee)
Changes
If we update this policy we will publish it on this page; the date above tells you when. Questions are always welcome.