Privacy Policy

Who is responsible for your data

The data controller is Ondřej Jasenský, trading as ShadowGhost, a sole trader (OSVČ) registered in the Czech Republic under IČO 29553458, registered address Bezručova 4201, 430 03 Chomutov, Czech Republic.

Because the business is established in the European Union, the General Data Protection Regulation (GDPR) applies to how your data is handled, regardless of which country you're contacting me from.

For any question or request about your data, contact contact@shadowghost.eu.

What data I collect, and why

Project requests: your name, email, country, and, if you're ordering as a business, your company name, registration number, VAT number, and address. I use this to respond to your request and, if we go ahead, to deliver the work and issue an invoice. Providing your name, email, and country is needed to handle a request, without them I can't respond to it.

Order communication: messages exchanged through the order chat while a project is active, so we can talk about the work. To help me reply faster, I can ask an AI assistant, an OpenAI model accessed through Vercel's AI Gateway, to draft a suggested reply; doing so shares the chat history and relevant order details, like your project description and current status, with that model. I always review and edit the draft myself before anything is sent, and nothing reaches you without a human reading it first.

Order tracking and documents: the private link you use to check on your order is stored on my servers in a hashed and encrypted form, never as plain text. Once delivery is confirmed, you can download an invoice and contract PDF built from your order details straight from the order status area of the contact form.

Reviews: if you choose to leave one after a project is delivered, your name, optional role or company, your review text, and a rating. Reviews are checked before they're published.

Occasional updates: if you tick the optional box on the request form, your name and email are added to a mailing list I use to occasionally share news, offers, or updates. This only happens with your explicit consent, and you can unsubscribe at any time using the link in any such email or by contacting me directly.

Push notifications: if you opt in, your browser creates a subscription identifier tied to your order, used only to notify you about updates to that order.

Poll voting: if you vote in a poll shown on the site, your browser stores a random voter token, not linked to your name or any other personal data, for up to five years, used only to stop the same poll being voted on twice.

Direct emails: if you email me directly, I keep the message thread to respond and keep a record of the conversation. Just like order chat, I can ask the same AI assistant to draft a suggested reply from that thread, which I always review and edit myself before anything is sent. This applies even if you've never submitted a request through this site.

Digital keys and partner inquiries: these are handled directly by email rather than a form on this site, so no personal data is captured or stored here as part of that process.

Team profiles: the team section of the site shows a staff member's name, position, and, if they've provided a Discord ID, their public Discord profile picture. The picture is looked up from that ID through a third-party lookup service (japi.rest) and served through this site's own servers, so visitors' browsers never contact Discord or that service when viewing the page.

Company lookup: if you enter a Czech company registration number (IČO) on the request form, it's checked against ARES, the public business register run by the Czech Ministry of Finance, to fill in your company name and address for you.

Basic technical data: to keep the site and forms secure against bots and abuse, some technical request data is processed automatically and briefly through Upstash (rate limiting) and Vercel BotID (bot detection), not used to build a profile of you.

Why I'm allowed to process this data

To take steps towards, and perform, a contract with you, for project and order-related data.

Because you've given consent, for push notifications, the optional mailing list, and the explicit data-processing consent you give on the request form, all of which you can withdraw at any time.

Because I have a legitimate interest in running and securing the business, for fraud prevention, abuse protection, and replying to general inquiries, balanced against your rights.

Because the law requires it, for the minimum accounting and tax records Czech law requires me to keep.

Who your data is shared with

Your data is only shared with the service providers that help run this business, and never sold or given to advertisers. These are Vercel (hosting, analytics, and bot protection), Neon (database), Resend (sending emails, and hosting the optional mailing list mentioned above if you opt in), Upstash (keeping the site secure against abuse), and OpenAI, accessed through Vercel's AI Gateway, for the AI-assisted reply drafting mentioned above.

Each of these providers acts strictly as a data processor for me and is bound by its own GDPR-compliant data processing terms as part of its standard business agreement, which is what Article 28 GDPR requires of anyone processing data on my behalf.

If I ever bring on staff or translators to help run the business, they may get limited dashboard access to the order and message details needed to help you, never full database or payment access, and they're bound to keep it confidential.

Some of these providers may process data outside the European Economic Area. Where that happens, it's covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

How long I keep your data

Once a project is delivered and confirmed, free-text details like the project description, notes, and contract text, along with the chat history, are automatically deleted about 24 hours later.

Basic order records needed for accounting and tax purposes, such as your name, the price, and payment status, are kept for as long as Czech tax law requires.

If you've opted in to occasional updates, your name and email stay on that mailing list until you unsubscribe or ask me to remove them.

Requests that never go ahead are cleared the same way after 12 months, and any push notification subscription tied to an order is deleted together with it.

Direct email conversations are kept while they're relevant and deleted when you ask me to or when I clear out old conversations. Published reviews stay on the site until you ask me to remove them.

You can ask me to delete other data sooner, and I will, unless I'm legally required to keep it.

Your rights

Under GDPR you can ask to see the data I hold about you, have it corrected, have it deleted, ask me to restrict or stop processing it, object to processing based on legitimate interest, and receive a copy in a portable format. I don't make decisions about you using automated processing or profiling. Any AI-drafted reply is always reviewed by a person before it's sent.

You can also withdraw consent at any time where processing is based on consent, without affecting anything done before that.

If you think your data hasn't been handled properly, you can complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), or your own country's data protection authority if you're elsewhere in the EU.

Cookies and analytics

This site uses Vercel Analytics and Speed Insights to understand traffic and performance. Both are cookieless and don't identify you personally, so no cookie consent banner is currently needed. If that ever changes, this policy will be updated first.

This site also sets a basic functional cookie to remember your language preference, and voting in a poll sets a single functional cookie so the same poll can't be voted on twice. Neither identifies you personally or is used for tracking or advertising.

The owner/staff sign-in page (dashboard) sets one security cookie that keeps you signed in. It's strictly necessary for logging into the admin area, an ordinary site visitor never receives it, and it isn't used for tracking or advertising.

You can also install this site as an app on your device. That uses a small amount of local browser storage, a service worker cache, to let your order status load faster and work offline, not to track you across other sites.

Your browser's local storage is also used to remember your theme choice, whether you've dismissed the language and install-app prompts, and, after you submit a request, the private link to your order so the site can take you back to it. This stays on your device and isn't sent anywhere else.

Changes to this policy

I may update this policy as the site or the way I handle data changes. Meaningful changes will be reflected here with an updated date at the top.