Last updated: October 25, 2026

Privacy policy

The short version: we collect only what it takes to answer your enquiry. The site sets no cookies, measures no traffic, and never stores your IP address.

Who the controller is

The data controller is StackHouse — Dmytro Gaiduk, IČO 29982481, Prague, Czech Republic.

For anything to do with your data, write to dmytro@stackhouse.cz. There is no appointed data protection officer — the scale of processing does not require one — so the person who runs the site answers directly.

The Czech version of this policy is the binding one; this is a translation for convenience.

What we process

There is one place on this site where you hand us anything: the enquiry form. Apart from that, visits to the pages are counted anonymously — the last row below.

Data	Why we process it	Legal basis
Name, email, message	To reply to you and agree how to work together	Steps prior to a contract, Art. 6(1)(b) GDPR
Service tags you picked, the page you sent from, your language	To answer the actual question, in the right language	Steps prior to a contract, Art. 6(1)(b) GDPR
Salted hash of your IP address, truncated browser string	Spam protection and a cap on submissions per hour	Legitimate interest, Art. 6(1)(f) GDPR
Page address, the site you came from, browser and device type, country — no cookies and nothing that identifies you	To see which pages are read and how people find the site	Legitimate interest, Art. 6(1)(f) GDPR

Your IP address is not stored. What is stored is a one-way salted hash of it (SHA-256), which recognises a repeat submission from the same connection — not who you are.

What we don't do

No cookies, and nothing else written to your browser's storage.
No advertising or tracking scripts, and no analytics that follows you from site to site or builds a profile of you.
No IP address in readable form.
No profiling and no automated decision-making.
No selling your details and no passing them on for anyone else's marketing.

Visits are counted with Umami, which writes nothing to your browser and keeps no IP addresses: it shows how many people read a page, not who they are. If anything beyond that is ever added, this policy and the date above change with it.

How long we keep it

Data	Retention
An enquiry that did not lead to work	24 months from the last message
An enquiry that led to work	For the duration of the work, then for the statutory periods
Accounting and tax records	5 to 10 years, as Czech accounting and VAT law requires
Technical data behind the form protection	Deleted together with the enquiry it belongs to

You can ask for deletion sooner at any time. We will do it unless the record has to stay for a legal obligation — typically an invoice that has already been issued.

Who else sees it

Your enquiry is never passed to anyone for their own purposes. It is handled only by the providers the site cannot run without, under a data processing agreement and only to the extent they need.

Recipient	What they do for us	Where the data sits
Vercel Inc.	Runs the site	EU (Frankfurt)
Supabase Inc.	Stores the enquiries	EU (Frankfurt)
Resend	Delivers the email that tells us an enquiry arrived	EU / USA
Google Ireland Limited	Our mailbox (Google Workspace): the enquiry notification and our correspondence with you	EU / global network
Cloudflare, Inc.	Protects the form against bots (Turnstile)	EU / global network
Umami Software, Inc.	Counts visits to the site anonymously, without cookies (Umami Cloud)	EU / USA
Accountant, and a lawyer if needed	Bookkeeping and legal representation, only once work is agreed	Czech Republic

Some of them are US companies. The data itself sits in European regions; where a transfer outside the EU happens anyway, it rests on the European Commission's Standard Contractual Clauses or on certification under the EU–U.S. Data Privacy Framework. This list is accurate as of the date above — a move to our own EU server is planned, and the policy will be updated with it.

Your rights

Over your own data you have the right:

Of access — we tell you what we hold and give you a copy.
To have an inaccurate record corrected.
To erasure, where there is no longer a reason to keep it.
To restriction of processing while an objection or an inaccuracy is being resolved.
To portability — what you gave us, back in a machine-readable format.
To object to processing based on legitimate interest.
To lodge a complaint with the supervisory authority.

Write to dmytro@stackhouse.cz and we answer within one month. The supervisory authority is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz.

Security

The site and the form are served over HTTPS only.
The enquiry database is in the EU and is not publicly reachable.
No IP address is stored in readable form.
One person has access to the enquiries — the one writing back to you.
Credentials live in a password manager, not in email or chat.

Changes to this policy

This policy changes when what the site does changes — not to reword itself. The current version is always at this address, and the date of the last change is at the top.