Privacy policy

Under the EU General Data Protection Regulation (GDPR). Last updated: August 2026.

1. Controller

Digital Mind Agency Ltd., Evagora Pallikaridi 38, 8010 Paphos, Cyprus. Email: office@madevisible.io, phone +357 96562105. The controller decides on the purposes and means of processing personal data on this website.

2. What this site does and does not do

This is a static website. Fonts and flag icons are served from our own server. Before you opt in through the consent banner, no third-party scripts load and no data is sent to Google, Meta or any other third party. Statistics and marketing tools load only after your explicit consent (Google Consent Mode v2 keeps all signals denied until then), and you can withdraw that consent at any time.

3. Hosting and server log files

The website is hosted on servers operated by Dawico Deutschland GmbH within the European Union. When you access the site, the hosting provider automatically processes technical access data (server log files), such as the requesting IP address, date and time, the page requested, the referring URL and the browser used.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure, stable operation of the website). These logs are kept only for a short period for security and troubleshooting and are not merged with other data.

4. Contact form and free guide requests

If you use the contact form or request a free guide, we process the data you enter (such as name, email address and your message) to respond to you and to send the requested guide. Submissions are delivered to us by email; a basic anti-spam check (a hidden field and a timing check) is applied at submission. For the free-guide double opt-in we additionally store a consent-proof record (timestamp, IP address, browser/user-agent, your email address and the exact consent wording and version) as legal proof that you gave your consent.

• Purpose: replying to your enquiry, sending the requested resource.
• Legal basis: Art. 6(1)(b) GDPR (steps prior to a contract) and Art. 6(1)(a) GDPR (your consent) for the guide.
• Recipients: only the controller. We do not sell or share this data.
• Retention: as long as needed to handle your request and meet legal retention duties, then deleted.

5. Payment processing (Stripe)

If you place an order for one of our paid products (website setup, care plan, blog automation add-on, code + design audit, or the visibility check's full report), checkout is handled by Stripe on a page hosted directly by Stripe, not by us. Stripe collects your email address, name, billing address (used to calculate VAT) and your payment method details directly; we never see or store your full card number. If you order as a business, you additionally enter your company name and VAT ID on our own checkout form beforehand; we store these in our own order record, and we ask Stripe to collect and validate the VAT ID again for tax purposes. To match the order, we pass Stripe a small amount of order data (an internal order reference, the product and price, the language you used, the referring partner's identifier if you came through one, and, for business orders, your company name and that the order is a business order), and Stripe confirms your email, name and the payment back to us so we can activate what you bought and send you a confirmation.

• Purpose: processing your payment and fulfilling the order you placed.
• Legal basis: Art. 6(1)(b) GDPR (performance of a contract). For business customers, the VAT ID is collected for tax purposes.
• Recipients: Stripe Payments Europe, Limited, Ireland, part of the Stripe group. This can involve a transfer of data to Stripe, Inc., USA, on the basis of the EU standard contractual clauses.
• Retention: we keep our own order record (order reference, product, amount, status, your email) for the duration of the contract and statutory retention periods. Stripe retains payment data under its own retention obligations; see Stripe's own privacy policy for details.

6. Cookies and consent-based tracking

We use no cookies that require consent unless you actively opt in. Tools are grouped into categories you control in the consent banner (Essential, Statistics, Marketing), and you can withdraw your consent at any time with effect for the future via the "Cookie settings" link.

Google Analytics 4 (Statistics)

Only with your consent (Art. 6(1)(a) GDPR). Provided by Google Ireland Ltd., Google Analytics measures, in aggregate, how the site is used so we can improve it. IP addresses are shortened (anonymised). The Google tag loads only after you opt in; before that nothing is sent to Google. This can involve a transfer of data to Google, including to the USA, on the basis of the EU standard contractual clauses and the EU-US Data Privacy Framework.

Microsoft Clarity (Statistics)

Only with your consent (Art. 6(1)(a) GDPR). Provided by Microsoft Ireland Operations Limited, Clarity records heatmaps and anonymised session recordings so we can see how the site is used and improve it. The Clarity tag loads only after you opt in; before that nothing is sent to Microsoft. This can involve a transfer of data to Microsoft, including to the USA, on the basis of the EU standard contractual clauses.

Facebook Pixel (Meta)

Only with your consent (Art. 6(1)(a) GDPR). The pixel, provided by Meta Platforms Ireland Ltd., measures the effectiveness of advertising. This can involve a transfer of data to Meta, including to the USA, on the basis of the EU standard contractual clauses and the EU-US Data Privacy Framework. Without consent the pixel does not load. If you complete a purchase, we also send your email address to Meta in a one-way cryptographically hashed form (SHA-256, never in readable text) so Meta can better attribute the purchase to the ad that led to it (Advanced Matching). This happens only with your consent, alongside the same purchase event our server already reports to Meta, and does not disclose your address to Meta in any readable form.

Google Ads

Only with your consent (Art. 6(1)(a) GDPR). Conversion measurement provided by Google Ireland Ltd. This can involve a transfer of data to Google, including to the USA, on the same legal bases. Without consent it does not load.

Partner referral

Only with your consent (Art. 6(1)(a) GDPR). If you reach this site through one of our partners' referral links, a cookie named "referred_by" remembers which partner referred you for 30 days, so we can credit that referral if you later place an order. The cookie is set only after you opt in and holds nothing beyond the partner's identifier. If you complete an order, this identifier is passed to our payment processor as part of the order so the referral can be credited; it is not shared with any other third party.

7. Scheduling tool (Calendly)

On our booking page we offer scheduling via Calendly (provided by Calendly LLC, USA). Calendly does not load automatically: it loads only after you actively click to load it on that page (Art. 6(1)(a) GDPR, consent). When you load it, your IP address and the details you enter to book are transferred to Calendly, including to the USA, on the basis of the EU standard contractual clauses. Until you click, no connection to Calendly is made. You can always reach us by email or phone instead.

8. Embedded media (360° tours and video)

Some pages embed interactive 360° tours (Matterport, provided by Matterport Inc., USA) and video (Bunny Stream, provided by BunnyWay d.o.o., Slovenia, EU). Neither loads automatically: each loads only after you actively click to load it (Art. 6(1)(a) GDPR, consent). When you load a tour or a video, your IP address is transferred to that provider, in Matterport's case including to the USA on the basis of the EU standard contractual clauses. Until you click, no connection to these providers is made.

9. Partner dashboard and referral programme

If you sign up as one of our referral partners, we process the data needed to run your account and pay commission: your name, email address, password (stored as a hash, never in plain text), two-factor authentication credentials, and, where you provide them, your billing and payout details (Art. 6(1)(b) GDPR, performance of the partnership agreement).

If your referral link or your assigned role credits you with a customer enquiry (see "Partner referral" under section 6), you see the limited contact details of that enquiry in your partner dashboard for as long as needed to follow it up and to calculate and document commission (Art. 6(1)(f) GDPR, our and your legitimate interest in administering the referral). We do not sell partner or referred-customer data to third parties, and access within the dashboard is limited to the enquiries a given partner is themselves connected to.

10. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15)
• rectification of inaccurate data (Art. 16)
• erasure (Art. 17) and restriction of processing (Art. 18)
• data portability (Art. 20)
• object to processing based on legitimate interest (Art. 21)
• withdraw consent at any time with effect for the future (Art. 7(3))
• lodge a complaint with a supervisory authority (Art. 77)

To exercise any of these, contact us at office@madevisible.io.

11. Changes

We may update this policy to reflect changes to the site or the law. The current version always applies, with the date shown above.