Privacy Policy

1. Who we are

Meraki Studio — Web Design Crete ("we", "us") is the data controller for personal data processed through this website. You can reach us at gehucka@gmail.com for any privacy question or request.

2. What data we collect and why

We only collect the data you give us and, with your consent, basic usage statistics:

• Enquiry / quote forms: name, email, phone (optional), business type, your message and the page you sent it from. We use this solely to reply to your enquiry and prepare your quote (legal basis: your consent and pre-contractual steps, GDPR art. 6(1)(a) and (b)).
• Analytics (only if you accept cookies): anonymous usage statistics via Google Firebase Analytics — pages visited, device type, approximate region. Legal basis: your consent (GDPR art. 6(1)(a)); you can decline with no effect on the site.
• WhatsApp / phone / email: if you contact us directly, we process what you send us to answer you.

3. Cookies

We do not use marketing or cross-site tracking cookies. On your first visit a banner asks for your choice, which we remember in your browser (localStorage — strictly necessary, no consent needed). Analytics cookies (Google Firebase Analytics identifiers) are set only after you click “Accept”, as required by Greek law 4727/2020 (art. 45–46) and the Hellenic DPA's guidance. You can withdraw consent at any time by clearing this site's cookies and site data in your browser, or by emailing us.

4. Where your data is stored

Form submissions are stored in Google Firebase (Firestore) under Google Cloud's security and data-processing terms. Our database is located in the United States, so submitting a form transfers your details outside the EEA; Google is certified under the EU–US Data Privacy Framework, which is the safeguard this transfer relies on. We keep enquiry data only as long as needed to handle your request and for up to 24 months, unless a project contract requires longer.

When you send a form, a copy of your details is delivered to us by email through Resend (Resend, Inc., USA) and as a message through Telegram (Telegram Messenger Inc.), so we can reply quickly. Both act only to deliver that notification to us.

To keep automated spam out of our forms, they are protected by Google reCAPTCHA Enterprise through Firebase App Check. It loads only when you start filling in a form and sends Google technical signals about your browser and interaction to tell people from bots; its use is governed by Google's Privacy Policy and Terms of Service. Legal basis: our legitimate interest in protecting the site from abuse (GDPR art. 6(1)(f)).

We never sell your data and we never share it with third parties for their marketing.

5. Your rights

Under the GDPR you may request access, correction, deletion, restriction, portability, or object to processing, and withdraw consent at any time — email gehucka@gmail.com and we respond within 30 days. You may also lodge a complaint with the Hellenic Data Protection Authority (ΑΠΔΠΧ, www.dpa.gr).

6. Updates to this policy

We may update this policy as the site evolves; the latest version always lives on this page. Last updated: September 2026.