Privacy policy

Under the EU General Data Protection Regulation (GDPR). Last updated: October 2026.

1. Controller

Digital Mind Agency Ltd., Evagora Pallikaridi 38, 8010 Paphos, Cyprus. Email: office@madevisible.io, phone +357 96562105. The controller decides on the purposes and means of processing personal data on this website.

2. What this site does and does not do

This is a static website. Fonts and flag icons are served from our own server. Before you opt in through the consent banner, no third-party scripts load and no data is sent to Google, Meta or any other third party. Statistics and marketing tools load only after your explicit consent (Google Consent Mode v2 keeps all signals denied until then), and you can withdraw that consent at any time.

3. Hosting and server log files

The website is hosted on servers operated by Dawico Deutschland GmbH within the European Union. When you access the site, the hosting provider automatically processes technical access data (server log files), such as the requesting IP address, date and time, the page requested, the referring URL and the browser used.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure, stable operation of the website). These logs are kept only for a short period for security and troubleshooting and are not merged with other data.

4. Contact form and free guide requests

If you use the contact form or request a free guide, we process the data you enter (such as name, email address and your message) to respond to you and to send the requested guide. Submissions are delivered to us by email; a basic anti-spam check (a hidden field and a timing check) is applied at submission. For the free-guide double opt-in we additionally store a consent-proof record (timestamp, IP address, browser/user-agent, your email address and the exact consent wording and version) as legal proof that you gave your consent. On the contact form you can also tick an optional box to receive tips and news by email. Only if you tick it do we send you a confirmation link, and only after you click it do we store the same kind of consent-proof record and add you to our newsletter (see "Newsletter and customer management (KlickTipp)" below).

• Purpose: replying to your enquiry, sending the requested resource, and documenting your consent.
• Legal basis: Art. 6(1)(b) GDPR (steps prior to a contract), Art. 6(1)(a) GDPR (your consent) for the guide, and Art. 6(1)(c)/(f) GDPR for keeping the consent-proof record (legal documentation of consent).
• Recipients: the controller and, for newsletter subscriptions after your confirmation, our email marketing provider Klick-Tipp Limited (see below). We do not sell this data.
• Retention: as long as needed to handle your request and meet legal retention duties, then deleted; the consent-proof record is kept for the duration of the legal limitation period.

Newsletter and customer management (KlickTipp)

We use KlickTipp, provided by Klick-Tipp Limited, 15 Cambridge Court, 210 Shepherd’s Bush Road, London W6 7NJ, United Kingdom, to send our newsletter and to manage our customer and booking contacts. KlickTipp processes this data on our behalf (Art. 28 GDPR).

• Newsletter (free guide, contact form): only if you ticked the box and confirmed via the link in our email (double opt-in), Art. 6(1)(a) GDPR. We store your email address, your name if given, your language, how you found us (for example a partner referral) and what you requested. You can unsubscribe at any time via the link in every email; this does not affect the lawfulness of processing before you withdrew.
• Bookings and orders: when you book a call or mentoring session or place an order, we store your contact details (name, email address, phone number if given, language, appointment time, customer or order reference, referring partner) in KlickTipp to manage the customer relationship, Art. 6(1)(b) and (f) GDPR. For bookings, orders and guide requests, if you already exist as a contact, we do not overwrite your stored master data. We only send you marketing emails if you have given separate consent.
• Transfer: the United Kingdom has an adequacy decision of the European Commission (Art. 45 GDPR).
• Retention: newsletter data until you unsubscribe or withdraw your consent; customer and booking contacts for as long as the customer relationship lasts and statutory retention duties apply, then deleted.

5. Payment processing (Stripe)

If you place an order for one of our paid products (website setup, care plan, blog automation add-on, code + design audit, or the visibility check's full report), checkout is handled by Stripe on a page hosted directly by Stripe, not by us. Stripe collects your email address, name, billing address (used to calculate VAT) and your payment method details directly; we never see or store your full card number. If you order as a business, you additionally enter your company name and VAT ID on our own checkout form beforehand; we store these in our own order record, and we ask Stripe to collect and validate the VAT ID again for tax purposes. To match the order, we pass Stripe a small amount of order data (an internal order reference, the product and price, the language you used, the referring partner's identifier if you came through one, and, for business orders, your company name and that the order is a business order), and Stripe confirms your email, name and the payment back to us so we can activate what you bought and send you a confirmation.

• Purpose: processing your payment and fulfilling the order you placed.
• Legal basis: Art. 6(1)(b) GDPR (performance of a contract). For business customers, the VAT ID is collected for tax purposes.
• Recipients: Stripe Payments Europe, Limited, Ireland, part of the Stripe group. This can involve a transfer of data to Stripe, Inc., USA, on the basis of the EU standard contractual clauses.
• Retention: we keep our own order record (order reference, product, amount, status, your email) for the duration of the contract and statutory retention periods. Stripe retains payment data under its own retention obligations; see Stripe's own privacy policy for details.

5a. Onboarding questionnaire and coordinator

After an order you can fill in an onboarding questionnaire (company and contact details, texts, images and files for your project; Art. 6(1)(b) GDPR). If you tick the save box, we store your answers on our server and e-mail you a link to continue (Art. 6(1)(a) GDPR); anyone holding this link can access the saved answers and files without a login. We delete answers that were not submitted once they have not been changed for 90 days, and an abandoned run without the save box after 7 days. The clean-up runs in the background from time to time, not on the exact day. Submitted questionnaires including files are kept as the basis for building your website; there is currently no automatic deletion period. You can ask for deletion at any time (Art. 17 GDPR).

When you finish the questionnaire, an AI service (Anthropic, Claude) checks your answers for gaps and suggests up to three follow-up questions. For this we send the answers entered so far, including contact details, to Anthropic; uploaded files are not included. After submission we receive your answers by e-mail and a short notice (among other things company name, e-mail address, chosen package, time spent, number of open steps, internal markers and the name of the referral partner) by Telegram to an internal account of the controller.

If your project is looked after by a coordinator named in your offer (for example an intermediary or partner), we show you this before you order. Only if you expressly agree there (Art. 6(1)(a) GDPR) do we e-mail them a link of their own to the questionnaire. With this link they can see and add to all answers and files in the questionnaire, without a login. The link is valid for 30 days and only for this questionnaire, ends when the questionnaire is submitted and is separate from your own link. We log the time, the offer, the exact wording and the coordinator's e-mail address. Without your consent you can still place your order, and the coordinator gets no access. You can withdraw your consent at any time with effect for the future by e-mail to office@madevisible.io; we then block their link, and the lawfulness of processing before the withdrawal is not affected. The coordinator is a recipient of this data; to the extent they process it for their own purposes, they are responsible for that themselves.

6. Cookies and consent-based tracking

We use no cookies that require consent unless you actively opt in. Tools are grouped into categories you control in the consent banner (Essential, Statistics, Marketing), and you can withdraw your consent at any time with effect for the future via the "Cookie settings" link.

Google Analytics 4 (Statistics)

Only with your consent (Art. 6(1)(a) GDPR). Provided by Google Ireland Ltd., Google Analytics measures, in aggregate, how the site is used so we can improve it. IP addresses are shortened (anonymised). The Google tag loads only after you opt in; before that nothing is sent to Google. This can involve a transfer of data to Google, including to the USA, on the basis of the EU standard contractual clauses and the EU-US Data Privacy Framework.

Microsoft Clarity (Statistics)

Only with your consent (Art. 6(1)(a) GDPR). Provided by Microsoft Ireland Operations Limited, Clarity records heatmaps and anonymised session recordings so we can see how the site is used and improve it. The Clarity tag loads only after you opt in; before that nothing is sent to Microsoft. This can involve a transfer of data to Microsoft, including to the USA, on the basis of the EU standard contractual clauses.

Facebook Pixel (Meta)

Only with your consent (Art. 6(1)(a) GDPR), given in the consent banner under Marketing for the service "Meta Pixel". The pixel, provided by Meta Platforms Ireland Ltd., measures the effectiveness of our advertising and helps build audiences for Facebook and Instagram ads. Without consent the pixel does not load and none of the following happens. With consent, the pixel in your browser sends Meta its own usage data (for example the page address, the referring page and browser information), and our server additionally sends events directly to Meta (Conversions API). Each event names its type (page view, enquiry, booking, started or completed order), its time and the page address without its query string. With page views and forms we send your IP address, your browser identifier (user agent) and Meta's cookie identifiers; with orders the browser identifier and cookie identifiers (_fbp, _fbc; if you arrive through a Meta ad, _fbc contains its click identifier). When you submit the contact form, request a guide, request a visibility check or an audit, book a call, or start or complete an order (a started order is reported even if you do not complete it), we also send your email address and, if the form asks for them and you entered them, your phone number (only if written with its country code) and your name, and for orders the order value. If you bought from us with this consent, we may also include your email address, hashed in the same way, in a customer list that we upload ourselves to Meta to reach existing customers or similar audiences. We send contact details only in hashed form (SHA-256, not in plain text). Hashed data still count as personal data: Meta can compare them with its own records and recognise you, which is exactly their purpose (Advanced Matching). IP address, browser identifier and cookie identifiers are sent unchanged. We do not send the content of your message. For an order we store the cookie identifiers and the browser identifier with the order only if you consented, and keep them as long as the order record; without consent we store none of them. The cookies themselves are set by Meta, which also determines how long they last. We are jointly responsible with Meta Platforms Ireland Ltd. (Art. 26 GDPR) only for collecting these data on our website and transmitting them to Meta; the arrangement is Meta's Controller Addendum (facebook.com/legal/controller_addendum). Matching the hashed contact details is done by Meta on our behalf as processor under Meta's Business Tools Terms; according to those terms Meta deletes the contact details after matching. Where Meta processes the data further for its own purposes, Meta alone is responsible, and its storage periods apply (Meta privacy policy). You can address questions and requests about the joint processing to us at office@madevisible.io or to Meta; we forward requests that concern Meta's systems to Meta. This can involve a transfer of data to Meta, including to the USA, on the basis of the EU standard contractual clauses and the EU-US Data Privacy Framework. You can withdraw your consent at any time via "Cookie settings". From then on we send nothing more from page views and forms. Our server does not learn about a withdrawal, so an order you started with consent may still be reported afterwards and your hashed email address may remain in customer lists; write to us and we will prevent that. Data already transmitted stays with Meta; the lawfulness of processing until withdrawal is unaffected (Art. 7(3) GDPR).

Google Ads

Only with your consent (Art. 6(1)(a) GDPR). Conversion measurement provided by Google Ireland Ltd. This can involve a transfer of data to Google, including to the USA, on the same legal bases. Without consent it does not load.

Partner referral

Only with your consent (Art. 6(1)(a) GDPR). If you reach this site through one of our partners' referral links, a cookie named "referred_by" remembers which partner referred you for 30 days, so we can credit that referral if you later place an order. The cookie is set only after you opt in and holds nothing beyond the partner's identifier. If you complete an order, this identifier is passed to our payment processor as part of the order so the referral can be credited; it is not shared with any other third party.

7. Scheduling tool (Calendly)

On our booking page we offer scheduling via Calendly (provided by Calendly LLC, USA). Calendly does not load automatically: it loads only after you actively click to load it on that page (Art. 6(1)(a) GDPR, consent). When you load it, your IP address and the details you enter to book are transferred to Calendly, including to the USA, on the basis of the EU standard contractual clauses. Until you click, no connection to Calendly is made. You can always reach us by email or phone instead.

8. Embedded media (360° tours and video)

Some pages embed interactive 360° tours (Matterport, provided by Matterport Inc., USA) and video (Bunny Stream, provided by BunnyWay d.o.o., Slovenia, EU). Neither loads automatically: each loads only after you actively click to load it (Art. 6(1)(a) GDPR, consent). When you load a tour or a video, your IP address is transferred to that provider, in Matterport's case including to the USA on the basis of the EU standard contractual clauses. Until you click, no connection to these providers is made.

9. Partner dashboard and referral programme

If you sign up as one of our referral partners, we process the data needed to run your account and pay commission: your name, email address, password (stored as a hash, never in plain text), two-factor authentication credentials, and, where you provide them, your billing and payout details (Art. 6(1)(b) GDPR, performance of the partnership agreement).

If your referral link or your assigned role credits you with a customer enquiry (see "Partner referral" under section 6), you see the limited contact details of that enquiry in your partner dashboard for as long as needed to follow it up and to calculate and document commission (Art. 6(1)(f) GDPR, our and your legitimate interest in administering the referral). We do not sell partner or referred-customer data to third parties, and access within the dashboard is limited to the enquiries a given partner is themselves connected to.

10. Social media publishing tool (madevisible.io Social)

We use and offer clients madevisible.io Social, our social media scheduling and publishing tool at social.madevisible.io (built on the open-source TryPost platform), to plan and publish content to connected social media accounts (for example YouTube, Instagram, Facebook, LinkedIn and TikTok).

When you or we connect a social media account, the tool stores the OAuth access token issued by that platform to publish content on the account's behalf and to read basic account information and post or channel analytics. It also stores the login credentials for the tool itself (name, email address, password as a hash) and the content (text, images, videos) scheduled or published through it.

• Purpose: scheduling and publishing social media content on behalf of a connected account, and reporting on its performance.
• Legal basis: Art. 6(1)(b) GDPR (performance of the managed-service or care-plan contract) or Art. 6(1)(f) GDPR (our legitimate interest, for our own accounts).
• Recipients: only the controller and the social media platform the content is published to, strictly as needed to publish it.
• Retention: for as long as the account stays connected. Disconnecting an account deletes the stored access token from our systems.

11. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15)
• rectification of inaccurate data (Art. 16)
• erasure (Art. 17) and restriction of processing (Art. 18)
• data portability (Art. 20)
• object to processing based on legitimate interest (Art. 21)
• withdraw consent at any time with effect for the future (Art. 7(3))
• lodge a complaint with a supervisory authority (Art. 77)

To exercise any of these, contact us at office@madevisible.io.

12. Changes

We may update this policy to reflect changes to the site or the law. The current version always applies, with the date shown above.