Privacy policy

1. Who is responsible

Viacheslav Pyvovarov, a sole proprietor (фізична особа – підприємець) registered in Ukraine and trading as Weberloom (“we”). Contact: info@weberloom.com, +380 77 736 22 62. Our registered address and other details are in our Legal notice.

2. Your enquiry

The site has two enquiry forms. The short form asks only for your email address. The full form on the Contact page asks for:

• your email address (required);
• your name, your message, your company or website, and how you found us — search engine, AI assistant, recommendation, social media or other (optional).

Both forms also automatically record the language of the page from which you sent the enquiry. Nothing else is collected with the enquiry.

Why: to reply to you and, if you ask, to prepare a proposal or a contract. When you send a form, the site immediately emails you in the language of that page: after the short form, a few questions about your project; after the full form, a confirmation that we have your message. The answer to “how did you find us” shows which channels bring in enquiries.

Legal basis: if you write on your own behalf, steps taken at your request before entering into a contract (GDPR, Art. 6(1)⁠(b); Law of Ukraine “On Personal Data Protection” No. 2297⁠-⁠VI, Art. 11(1)⁠(3)). If you write on behalf of a business, and for the answer to “how did you find us”, our legitimate interest in answering business enquiries and knowing where they come from (GDPR, Art. 6(1)⁠(f); Law No. 2297⁠-⁠VI, Art. 11(1)⁠(6)).

Protection against abuse: so that no one can use the forms to send mass email, the site stores an encoded form (hash) of your IP address and of your email address. The site uses the IP address hash for one hour and the email address hash for 24 hours; after that, the record is no longer used and is erased at the next scheduled automatic clean-up. The site sends no more than one automatic email a day to the same address. Legal basis: our legitimate interest in protecting the site and the owners of addresses that someone else may enter (GDPR, Art. 6(1)⁠(f); Law No. 2297⁠-⁠VI, Art. 11(1)⁠(6)). If someone entered your address without your knowledge: do not reply to the email with questions, and we will not write to you again; reply to the confirmation email to say you did not send an enquiry, and we will not answer the enquiry. You can also ask us to delete the enquiry (section 7).

Where it goes: the enquiry is stored on this site’s server and arrives as an email in our mailbox on our own weberloom.com mail server. The automatic email to you is sent through the same mail server.

How long: the copy on the site is deleted automatically no later than 24 months after it arrives. The email and any follow-up messages are deleted 24 months after our last contact with you. If they become part of a contract, we keep them with our business records for five years, and in any case until martial law in Ukraine ends.

We need your email address to be able to reply, so neither form can be sent without it. If you prefer not to use the forms, write to the email address given above.

Emails to support. If you are our client and write to support@weberloom.com about a website or online store we built for you, we receive your email address, name, the text of your email and any attachments. We use them to reply to you and, if you ask for changes to the site, to estimate that work. Legal basis: our contract with you if you write on your own behalf (GDPR, Art. 6(1)⁠(b); Law No. 2297⁠-⁠VI, Art. 11(1)⁠(3)), or our legitimate interest in answering clients if you write on behalf of a business (GDPR, Art. 6(1)⁠(f); Law No. 2297⁠-⁠VI, Art. 11(1)⁠(6)). We keep such emails in the same way as correspondence about an enquiry: for 24 months after our last contact with you, and, if they become part of a contract, together with our business records. If you are not yet our client, we treat your email as an enquiry.

Telegram. You can also write to our bot @weberloom_bot. We then receive your messages and the files you send, and from your Telegram account your ID, name, username, profile photo and app language. A person reads and answers them; we use these data for nothing else, never for advertising or to train AI models. The legal basis and the retention are those of the email above. If you ask us, in the chat or at the address in section 1, we delete them sooner. Deleting the chat in Telegram does not delete our copy.

3. Server logs and the language of the home page

For every request to this site, our server records:

• the IP address the request came from;
• the date and time;
• the request method, the requested address (path and query string) and the protocol;
• the response code and the number of bytes sent;
• the page you came from, if your browser sends it;
• the browser’s user-agent string.

If a request causes an error, the error log records the time, the error level, the IP address and the error message and, depending on the error, also the requested address and the page you came from.

The text you type into the site search becomes part of the requested address, and the log records it with that address. If your browser sends the page you came from, the log records this text again when you next move within the site. This site’s logs do not contain what you type into the two enquiry forms or the values of cookies.

The mail server keeps a separate log: it holds the sender and recipient addresses of every email, including the address to which the site sends your automatic email. We need it to find delivery failures and abuse: this is our legitimate interest (GDPR, Art. 6(1)⁠(f); Law No. 2297⁠-⁠VI, Art. 11(1)⁠(6)).

Why: to keep the site secure and working — to detect attacks and to find and fix errors. We also count how often robots known by name, such as search engine robots, load our pages. These counts are kept separately for each robot and each day, without IP addresses.

Legal basis: our legitimate interest in a secure, properly working site and in knowing which robots read it (GDPR, Art. 6(1)⁠(f); Law No. 2297⁠-⁠VI, Art. 11(1)⁠(6)).

How long: logs are deleted within 90 days.

The language of the home page. When you open the home page without coming from another page of this site, our server checks whether the IP address of your request belongs to a network that RIPE NCC, the regional internet registry, lists for Ukraine. The list is a copy kept on our server, so no other service is queried. If the address is on the list, the server opens the Ukrainian version for you; otherwise you see the English version. The language switcher opens any other version.

Why: Ukrainian law requires the Ukrainian version of our site to load by default for users in Ukraine.

Legal basis: an obligation that Ukrainian law places on us (Law of Ukraine “On Ensuring the Functioning of the Ukrainian Language as the State Language” No. 2704⁠-⁠VIII, Art. 27(6); Law No. 2297⁠-⁠VI, Art. 11(1)⁠(5)), and our legitimate interest in meeting that obligation (GDPR, Art. 6(1)⁠(f)).

How long: the check runs in the server’s memory while it answers that request. Its result is not stored anywhere or passed on to anyone; the request itself is logged like any other.

4. Cookies and your device

This site stores nothing on your device: it sets no cookies. It does not load fonts, maps, videos or scripts from other websites. Because nothing on the site requires your consent, there is no cookie banner.

5. Who else sees your data

Our hosting provider, Hetzner Online GmbH (Germany), operates the server that hosts the site, its logs, our mail and the system in which we read and reply to your messages. It processes the data only on our instructions. A filter on this server sets automatic emails and spam aside; it deletes nothing.

Our task list, Multica, run by Index Labs (Hong Kong) Limited on Amazon Web Services and Vercel servers, learns only that a message has arrived: the channel, our mailbox and the domain of the sender’s address, but never your name, your address or the text of the message. A person reads, edits and sends every reply.

When you write to us on Telegram, your messages also pass through Telegram Messenger Inc. under its own terms and privacy policy.

We do not sell your data and do not pass it on to advertisers or anyone else, unless the law requires it.

6. Where your data is processed

We are established in Ukraine, and we process your enquiry there. The server is located in Germany.

7. Your rights

You can ask us for access to your data, to correct or erase it, to restrict its use, or for a copy in a portable format. You can also object to any use based on our legitimate interest. Ukrainian law also gives you the right to know where your data was obtained from and where it is stored. Write to the email address in section 1. We reply within one month and never later than 30 days, free of charge. Erased data remains in the server’s encrypted backups for up to 12 months. We do not use it, and if we restore the server from a backup, we erase it again.

You can complain to the data protection supervisory authority of the country where you live or work, or where you believe the infringement took place. In Ukraine, this is the Ukrainian Parliament Commissioner for Human Rights (Уповноважений Верховної Ради України з прав людини). You can also go to court.

Apart from the language check in section 3, we make no automated decisions about you and do no profiling.

8. Changes

When this policy changes, the date at the top changes with it.