Privacy policy

1. Data controller

The controller of personal data within the meaning of the General Data Protection Regulation (GDPR) is:

• STU DEVELOPMENT, sole proprietorship for services
• Owner: Jurica Stublić
• Address: Oreškovićeva 8f, 10000 Zagreb, Croatia
• VAT/OIB: 46839323933
• Email: jurica@webica.hr

For any question about the processing of your data you can contact me at jurica@webica.hr.

2. What personal data I collect

I collect data directly from you, through the contact form, the booking form and comments on my Instagram profile, along with the basic technical data needed for the site to run safely.

2.1. Contact form

• Name and surname
• Email address
• Company or project name (optional)
• Project type, rough budget and preferred timeline (optional)
• How you found me and, if you came through an AI tool, what you asked it (optional)
• The content of your message

The form does not create a user account and the data is not stored in a database. Your enquiry reaches me as an email and stays in my business inbox. If available, the page you came from, the page where you first landed on the site during that visit, and any UTM tags on the link are quietly attached to the enquiry, so I can tell where enquiries come from; this data is held temporarily in your browser's sessionStorage and clears when you close the tab.

2.2. Booking a call

• Name and surname
• Email address
• Phone number
• A short description of the project
• Rough budget (optional)

Unlike the contact form, this data is stored in my database, because without a record of the booking the slot cannot be confirmed, moved or cancelled. Your email address also goes to Google Calendar, which sends you an invite with a Google Meet link. Your IP address is recorded only as an irreversible cryptographic digest, used solely to limit the number of bookings.

2.3. Technical data

• IP address (security and abuse prevention)
• Browser and device type
• Date and time of access

2.4. Analytics (only with your consent)

If you accept analytics cookies, Google Analytics 4 records the pages visited, the source of the visit, an approximate location at city level, and the device and browser type. Google Analytics is configured so that the IP address is not stored. Without your consent the script does not load and no cookie is set, see section 7.

2.5. Comments on the webica.hr Instagram profile

• Instagram username
• Text of the comment and when it was written
• Replies in the same comment thread

When you comment on a post on the webica.hr Instagram profile, I retrieve the comment through the official Instagram API into my internal system so that I can reply to it. An AI tool (Claude, by Anthropic) helps me draft the reply; I review every draft and send the reply myself, so no automated decision is made about you. I do not retrieve private messages (DMs) or any other data from your profile. For Instagram itself, Meta is the controller under its own privacy policy.

3. Purposes and legal bases for processing

• Replying to your enquiry, scheduling the intro call and preparing a proposal, processed on the basis of steps taken prior to entering into a contract (Art. 6(1)(b) GDPR).
• Site security and abuse prevention, processed on the basis of legitimate interest (Art. 6(1)(f) GDPR).
• Measuring traffic and improving the site, processed on the basis of your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• Replying to a comment on the webica.hr Instagram profile, processed on the basis of legitimate interest (Art. 6(1)(f) GDPR) in answering what you wrote publicly under my post.

I do not send a newsletter or marketing messages, and I do not use your data for profiling or for automated decision-making.

4. Third parties processing data

I use established technical partners to run the site. I have a data processing agreement (DPA) in place with each of them:

• Resend (USA, EU-US Data Privacy Framework), delivery of email from the contact form.
• Vercel (USA, EU-US Data Privacy Framework), hosting and CDN.
• Google Ireland Limited, Google Analytics 4, only with your consent.
• Google Ireland Limited, Google Calendar and Google Meet, scheduling and holding the intro call, only if you book a slot.

To draft replies to comments on Instagram, I use Claude, an AI tool by Anthropic, PBC (USA). I send Anthropic only the comment text, the username and the post it refers to, and Anthropic processes them under its own terms of use and privacy policy. This involves a transfer of data to the USA.

I do not sell your data and do not share it with anyone outside that circle, unless required by law.

5. Retention periods

• Contact enquiries: 12 months from the last communication. If an engagement follows from the enquiry, the documentation is kept for the statutory periods (accounting and tax rules).
• Bookings: 12 months from the slot, whether the call took place or was cancelled.
• Instagram comments in my system: 12 months from the comment. On Instagram itself the comment stays until you delete it.
• Technical logs: 90 days.
• Analytics data in Google Analytics: at most 14 months, after which it is deleted automatically.
• Your cookie choice: until you change it yourself or clear your browser data.

After those periods the data is permanently deleted, unless the law requires longer retention.

6. Your rights

Under the GDPR you have the following rights in relation to your personal data:

• Right of access (Art. 15)
• Right to rectification of inaccurate data (Art. 16)
• Right to erasure, the "right to be forgotten" (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object to processing (Art. 21)
• Right to withdraw consent at any time

To exercise any of these rights, write to me at jurica@webica.hr.

Erasure: send the request by email from the address you used. I handle the request without undue delay and within one month at the latest, and confirm the erasure once done. Erasure is free of charge; exceptionally I may retain only data I am legally obliged to keep.

Withdrawing consent for analytics: at the foot of every page there is a "Cookies" link that reopens the choice. Withdrawing consent stops the analytics script from loading and deletes the associated cookies.

You also have the right to lodge a complaint with the supervisory authority: the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr.

7. Cookies

The site itself sets no cookie at all. Your analytics choice is remembered locally in the browser (localStorage, the webica-analytics-consent entry) and is not sent to the server.

Analytics cookies are set by Google Analytics 4, and only after you accept them:

• _ga, distinguishing visitors, duration 2 years.
• _ga_WZB1DMF23G, session state for this site, duration 2 years.

If you decline, the Google Analytics script does not load and none of those cookies are set. You can change your choice at any time through the "Cookies" link in the footer.

8. Changes to this privacy policy

I update this policy from time to time to keep it aligned with the law or with changes in how I work. The current version is always available on this page, and the date of the last change is given at the top of the document.