What happens to what you send

Who is responsible

Aleksey Botalov, the person who runs this workshop from Belgrade — the same person named on the about page and on every invoice. There is no company in between and no department to be forwarded to.

The fastest way to reach him about your data is privacy@prizma.now. Replies come from him directly.

What is collected, and why each thing exists

From the enquiry form: your contact — Telegram, WhatsApp, Viber, phone or email — and whatever you write. This exists to answer you: steps taken at your request before any contract.

From the builder: the name of your business, a few lines about it, and the set you picked. Same reason — it is what the first screen is built from.

If you have an account: your email address, and a password you can set. This exists to give you the signed-in service you asked for.

For invoices, and only if you fill them in: the name, address, country and tax or personal number that must appear on a payment document. Nothing here is asked for until there is an invoice to put it on.

When you accept the terms of work: the edition you accepted, the moment, and your IP address. This is the proof that an agreement exists and what it said — for both of us, and it is the one record that cannot simply be deleted on request.

Where it lives and who else sees it

The database lives on a rented server physically located in Helsinki, Finland. Mail you receive is sent through Resend, sending from their Ireland region; Resend is a United States company and their own documentation says logs and message metadata stay in the United States, so that part has not moved. Mail written to us arrives at Migadu — a Swiss company whose servers are in France. One more thing leaves the server: when someone writes to me, Telegram receives a notice that a message arrived and a link to open it — the text of your message stays here and is not sent on. Telegram processes that notice under its own terms. Serbian law treats storage abroad as a transfer. Finland and France are both on the Serbian list of countries with an adequate level of protection. The United Arab Emirates, where Telegram is based, is not. The United States is on that list only as far as the Privacy Shield framework goes, and that framework was annulled by the EU Court in 2020 — so for the Resend metadata there is nothing there to rely on. You are told this plainly because the law requires it and because you deserve to know where your things are. Nothing else goes anywhere else.

A copy of each enquiry is delivered through Telegram so it can be answered quickly, which means Telegram processes that copy under its own terms. If you connect Telegram to your account, updates about your order go the same way.

Email — sign-in codes and notices about your order — goes out through a mail service over an encrypted connection. Passwords are never sent by email.

Beyond that: no analytics service, no advertising pixel, no external tracker, no data broker. Nothing is sold and nothing is shared.

Cookies

One cookie, and only after you sign in. Its only job is to keep you signed in; it holds a random value and nothing about you. There is no cookie banner here because there is nothing to consent to.

The site keeps its own counters — which page was opened, which button was pressed — without cookies and without anything that identifies you. These counters are kept for fourteen months and then deleted; what survives is a daily tally with no identifiers in it, so I can still see whether the site is getting better without keeping anything about you. An enquiry that never became an order is kept the same fourteen months, in case you write again about it.

Your IP address

Processed briefly so the forms cannot be used for flooding: the service allows a few submissions a minute per address. It is not attached to your enquiry and is not used to measure anything.

Two exceptions where it is stored on purpose: standard server logs, which roll off within fourteen days, and the record of your accepting the terms, which is kept as part of the agreement.

How long each thing is kept

An enquiry that goes nowhere: while we are talking, and then it is removed on request at any time.

Your account and orders: while the account exists. You can end it yourself.

Invoices that were actually paid, and the record of the agreement behind them: as long as Serbian tax law requires such records to be kept. This is the honest limit of erasure — a paid invoice is not mine to delete, and any site that promises otherwise is either not paying tax or not telling the truth.

Taking your data with you, and taking it away

Inside your account there are two buttons. One hands you everything stored about you as a single file — orders, messages, documents, consents. The other asks for erasure.

If nothing was ever paid, erasure is complete and immediate: account, orders, messages, all of it. If an invoice was paid, everything personal goes — messages, what you wrote about your business, your contact and profile — and what stays is the number, the date and the amount, because that part is a tax record. You are told exactly which of the two happened.

Backups that still hold the data roll off within fourteen days.

Your rights

At any time you can ask what is stored about you, have it corrected, restricted or erased, object to its processing, and receive it in a portable form. The two buttons cover the common cases; for anything else one message is enough.

If you believe something is handled wrongly, you can complain to the Serbian supervisory authority — Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti (poverenik.rs). If you are in the EU, you may also complain to your own national authority.

No newsletter, no calls

Your contact is used to answer you and to tell you things about your own order. There are no mailing lists, no sequences, and no calls unless you ask for one.