Privacy Policy

1. Who collects the data

The data controller is Lilium Digital OÜ, a company registered in Estonia (European Union).

2. What data is collected

• Contact info: name, email, phone.
• Business info: business name, type, location.
• Payment info: processed by Stripe (we do not store card data).
• Usage data, events and campaign identifiers: first-party analytics, Google Analytics 4, Google Ads, Meta Pixel and Conversions API only with consent. We do not send form contents, access tokens or complete URLs with query parameters to analytics providers.

3. Purpose of processing

• Service delivery (legal basis: contract performance).
• Marketing follow-up on submitted leads (legal basis: legitimate interest).
• Analytics and advertising measurement through first-party analytics, Google Analytics 4, Google Ads, Meta Pixel and Conversions API (legal basis: consent).
• Legal compliance (legal basis: legal obligation).

4. Sharing of data

• Stripe: payment processing (EU/US, SCCs in place).
• Meta: advertising pixel and CAPI (with consent only).
• Google: Google Analytics 4 and Google Ads for usage and conversion measurement, only with consent.
• Go High Level: CRM (data processed under a data processing agreement).
• Vercel: hosting (EU data centers where possible).
• Supabase: database (EU region).

We do not sell personal data.

5. Data retention

• Active clients: for the duration of the contract + 2 years.
• Leads who did not convert: deleted after 12 months.
• Payment records: 7 years (legal requirement).

6. User rights (GDPR)

• Right to access, rectify, erase, restrict, portability, and object.
• Right to withdraw consent at any time.
• Right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

To exercise your rights, write to support@clematis.dev: response within 30 days.

7. Cookies

Necessary data: checkout session, order access, security, language choice and saved form answers support the requested service.

First-party analytics, Google Analytics 4, Google Ads and Meta Pixel/CAPI activate only with consent. Advertising identifiers are not collected before consent. With your consent, first-party measurement uses a random visitor identifier in localStorage, valid for 90 days, and a random session identifier in sessionStorage, renewed after 30 minutes of inactivity. These identifiers are not derived from your IP address or browser signature. Choosing necessary cookies only removes these identifiers from this browser.

Change your choice at any time using the cookie settings button. Withdrawing consent stops future measurement and does not affect your order.

8. Changes to the policy

We notify you of changes by email with 30 days notice.