Privacy policy

Informacijske storitve, Žiga Flis s.p. (hereinafter “Flisko”) protects personal data in accordance with Regulation (EU) 2016/679 (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2). This policy describes which data we collect, how we process and protect it, and which rights you have as an individual.

• ✦Contact details: first name, surname, company name, email, phone and address (if you give it to us for a quote or contract).
• ✦Inquiry details: team size, a description of your processes and the content of your message from the contact form.
• ✦Technical data: IP address, browser and device data, time of access.
• ✦Cookie data: settings stored in your browser (e.g. cookie consent, chosen theme).
• ✦Site address from the free test: the web address you enter into the test on the GEO optimization page, and the score the test returns. If you ask for a detailed write-up, we attach both to your inquiry.
• ✦Text from the Claude demo: the task you type into the demo on the blog; if you ask for the workshop program after the demo, we attach it to your inquiry.
• ✦Visit source data: campaign parameters (UTM) and the gclid and fbclid tags, if you arrive through an ad. We store them in your browser and attach them to your inquiry, so we know which campaign it came from.

• ✦Directly: through the contact form, email, a call or a meeting.
• ✦Automatically: through cookies and visit tracking technologies, where you have given consent.
• ✦While providing services: in workshops, integrations or automations we work with documents and data the client provides.

• ✦Performance of a contract or pre-contractual steps: preparing a quote, running a workshop, an integration.
• ✦Communication: replying to your inquiry, sending information about dates and preparation.
• ✦Waiting list for consulting at the AUREA incubator: we keep your email address, your name (if you enter it) and your questionnaire answers on our own server (Redis) for at most 13 months, and use them only to send the questionnaire and agree on a time for the free 30-minute consultation.
• ✦Legal obligations: issuing invoices and keeping records.
• ✦Legitimate interests: website security, improving our services, anonymous analytics.
• ✦Consent: sending occasional news about our services, only if you have explicitly signed up.

• ✦Article 6(1)(a) GDPR: your explicit consent (e.g. analytics, newsletter).
• ✦Article 6(1)(b) GDPR: performance of a contract or pre-contractual steps.
• ✦Article 6(1)(c) GDPR: legal obligations (accounting, taxes).
• ✦Article 6(1)(f) GDPR: our legitimate interests (security, service quality).

• ✦Inquiries and contact details: until you withdraw, or at most 2 years from the last contact.
• ✦Contract and accounting data: 10 years, in line with the Tax Procedure Act and accounting regulations.
• ✦Technical data (logs, IP): 30–90 days.
• ✦Cookies: for the duration set in each cookie (usually up to 12 months), or until you withdraw consent.

We do not sell your data. We pass it only to processors and partners who help us provide our services:

• ✦Vercel Inc.: website hosting (EU regions available) and anonymous visit analytics.
• ✦Microsoft Clarity: anonymous analytics of visitor behavior (heatmaps, session recordings). It loads only with your consent to analytics cookies.
• ✦Google Analytics 4 and Google Ads: Google Ireland Ltd. Visit statistics, traffic sources and events (e.g. a form submission). We use Google Consent Mode v2: the script loads on every visit, but until you consent all analytics and advertising signals are set to “denied”. In this state no cookies are set and no identifiers are sent. Google receives only an anonymous signal without cookies, from which it estimates visits statistically. When you consent, the signals switch to “granted”.
• ✦Meta Pixel: Meta Platforms Ireland Ltd. Measuring the performance of ad campaigns on Facebook and Instagram, and measuring conversions. It loads only with your consent to analytics/advertising cookies.
• ✦Anthropic, PBC (USA, standard contractual clauses): through the Claude API we prepare the first three fixes in the free test, on your explicit confirmation two short tips by email, and an internal summary and draft reply to your inquiry. Anthropic receives the test results for your site, the names ChatGPT returned, your business activity and location, and the text of your inquiry with your name, company and selected team size (without your email address). Through the Claude demo on the blog Anthropic also receives the task you type into the demo (up to 500 characters), without your name, email or IP address (instead of the IP address it receives only a daily-salted hash used to limit abuse); an automatic filter checks the answer before it is shown. The same applies to the three tools on the Process automation, Workshop and Private AI pages (automation blueprint, custom workshop agenda, private AI fit check): Anthropic receives the options you select and the process description or note you type (up to 700 characters), without your name, email or IP address. Anthropic does not use the data to train models and keeps it for at most 30 days.
• ✦DataForSEO: the free test on the GEO optimization page uses the DataForSEO service to ask ChatGPT one question about your business activity and location. If we cannot identify the activity ourselves, DataForSEO also receives the title and description of your home page. Our server sends the request, so DataForSEO does not receive your email, name or IP address.
• ✦is-agentic.com (Vercel Labs): for the second score in the free test it receives only the domain name you enter, and our server sends it.
• ✦Resend: sending transactional emails from the contact form and messages you opted in to receive or explicitly requested.
• ✦PHP2Shell check: our server visits the submitted domain's public homepage and inspects HTTP headers and a limited part of its content. We do not save results to a database. Hashed IP and domain identifiers are used for rate limits. Manual PHP version comparison runs only in your browser.
• ✦Permission-based business email: for agreed communications we retain the contact, organisation, contact source, permission evidence and sending record. Every campaign message has an unsubscribe link. To honour opt-outs, we retain a hashed email identifier and protected unsubscribe linkage in Redis without expiry; the email address itself is not in the unsubscribe URL. Using the checker or submitting an enquiry does not automatically subscribe you to promotional messages.
• ✦Own server (Redis): a usage counter for AI services, rate limits per IP address, evidence from the test for preparing tips (30 days) and a record of your consent to tips by email (until you withdraw, at most 13 months). Every message includes an unsubscribe link. For the Claude demo we keep replay protection for the signed session token (40 minutes) and daily demo usage counters (2 days), all without your personal data (the IP address is replaced by a hash salted daily).
• ✦Public AI visibility card (only if you tick the box with the test): the site address, the score, the status of the 9 checks and whether ChatGPT named you are available at the card's public address for 90 days, without your name or email. We store them on our own server (Redis).
• ✦AI Act check: your answers are not sent to a server; they live only in the result link (the ?r= parameter). If you request the checklist, the contact form sends us your name, email and yes/no answers.
• ✦Savings calculator: the calculation runs only in your browser and we store none of the numbers. If you request the calculation by email, the contact form sends us your name, email and the numbers you entered.
• ✦Google reCAPTCHA: protection against form abuse (spam).
• ✦Email provider: for sending and receiving business communication.
• ✦Accounting service: for preparing invoices and tax returns.

Where the law requires it, we may disclose data to the competent public authorities.

As an individual, under the GDPR you have the right to:

• ✦access your personal data,
• ✦rectification of inaccurate data,
• ✦erasure (“the right to be forgotten”),
• ✦restriction of processing,
• ✦data portability,
• ✦object to processing,
• ✦withdraw consent at any time (withdrawal does not affect the lawfulness of processing before it).

To exercise your rights, email ziga@flisko.si. We reply within 30 days.

The flisko.si website uses only a minimal set of cookies:

• ✦Necessary cookies: e.g. cookie consent (cookieConsent) and the theme setting (flisko-theme). Without them the site does not work properly; they do not need consent.
• ✦Functional cookies: language settings and similar preferences. We set them with your consent.
• ✦Analytics and advertising cookies: we use them only if you consent in the cookie banner. We currently use:
  • Vercel Analytics: anonymous, without cookies.
  • Microsoft Clarity: heatmaps and session recordings. Cookies: _clck, _clsk, CLID.
  • Google Analytics 4: visit statistics and events. Cookies: _ga, _ga_*.
  • Home page variant comparison (A/B test): after you consent, the flisko_hero_v1 cookie keeps the assigned variant for at most 60 days and prevents the same visit or inquiry from being counted more than once. It contains the test label, the variant, the time of assignment and data on recorded events, without a name or email address. We link the variant to a submitted inquiry and a call booking. If you decline, we remove it. A record of an already recorded submission may also be kept in session storage until you close the tab.
  • Meta Pixel: measuring ad campaign conversions. Cookies: _fbp, _fbc.

For Google services we use Google Consent Mode v2. Google’s script loads on every visit, but until you consent all analytics and advertising signals are set to “denied”: no cookies are set and no identifiers are sent. In this state Google receives only an anonymous signal without cookies, which lets it estimate visits statistically. If you decline consent, this state stays and we set no cookies. Microsoft Clarity and Meta Pixel do not load at all without consent.

You can delete cookies at any time in your browser settings.

If you explicitly open a variant preview link, the flisko_hero_preview setting is stored for that session. Such a preview is excluded from A/B measurement; remove the setting with the “Exit” link in the preview.

Technical and organizational measures include:

• ✦HTTPS/TLS encrypted transfer of all data,
• ✦restricted access to personal data (authorized persons only),
• ✦regular updates and security reviews,
• ✦the data minimization principle.

Where data is processed outside the European Economic Area (EEA), we ensure appropriate safeguards, such as standard contractual clauses (SCC) or adequacy decisions of the EU Commission.

Data controller:

If you believe we are violating the protection of your personal data, you have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia.

We update this policy from time to time. The date of the last update is shown at the top of the page. If there are material changes, we will inform you in an appropriate way.