Privacy Policy

1. Who is responsible (controller)

• MB Kava Plius — small partnership (mažoji bendrija) registered in Lithuania
• Company code: 304240490
• Registered address: Liepų g. 17, LT-41125 Biržai, Lithuania
• VAT number: LT100018052115
• Email: info@costacreativelab.com
• Phone: +370 643 27828
• Represented by: Grantas Petrulis
• Registered in the Register of Legal Entities of the Republic of Lithuania (State Enterprise Centre of Registers)

For any privacy question, write to info@costacreativelab.com.

2. What we process, why, and on what legal basis

• Contact form and quote requests (name, email, phone, message; for a beauty salon also the salon’s name, field and team size): to reply to you and follow up. We keep the enquiry in our own system (Cloudflare) together with the source that brought you to the site that day (e.g. “Meta ads” or “Google”); it does not identify you in the statistics. Basis: steps taken at your request before a contract, and our legitimate interest in answering enquiries (GDPR Art. 6(1)(b) and (f)).
• Sign-up at /start (property details, contact details, billing details, chosen domain, the result of the VAT-number check against the EU VIES service and of a scan of an existing domain’s public DNS records): to conclude and perform the contract, invoice you and register your domain in your name (Art. 6(1)(b) and (c)).
• Record of your consents (which boxes you ticked, wording and version, date, time and IP address): so we can prove acceptance of the terms and your request for immediate performance (Art. 6(1)(c) and (f)).
• Payment: handled by Stripe; we never see or store your card number. We receive the payment and subscription status (Art. 6(1)(b)).
• Photos and logo you upload after payment: to build your website (Art. 6(1)(b)).
• Withdrawal from the contract (name, email, the contract details you give, date and time): to process your withdrawal and send you the acknowledgement of receipt the law requires (Art. 6(1)(b) and (c)).
• Cancellation without logging in (name, email, the contract details, the type of cancellation and reason you give, date and time): to process your cancellation and confirm it to you (Art. 6(1)(b) and (c)).
• Chat: your messages are processed by Cloudflare Workers AI to generate the AI assistant’s reply and are not stored by us. If you choose “talk to a person”, we store your email, message and the conversation as a support request and notify ourselves by email (Art. 6(1)(b) and (f)).
• Security and operation: Cloudflare processes your IP address to deliver the site, protect it from abuse and rate-limit requests (legitimate interest, Art. 6(1)(f)).
• Visit statistics (no cookies and nothing stored on your device): we count visits with our own system. To recognise the same visit within one day we derive an anonymous identifier from your IP address and browser with a random key that changes every day; the IP address is not stored. We keep the page viewed, the referring website or ad (the link’s utm tags), country, device type, browser, language, how long the page was open, how far you scrolled and which sign-up or contact buttons you pressed (including the steps of the Costa Studio sign-up on studio.costacreativelab.com), only to know how many people visit and what interests them (legitimate interest, Art. 6(1)(f)). It is not shared with anyone.

We make no automated decisions with legal effects about you. The AI assistant only provides information.

3. Processors and recipients

• Cloudflare, Inc. — hosting, CDN, database (D1), file storage (R2), Workers AI (chat) and Cloudflare Registrar (domain registration).
• Stripe Payments Europe, Ltd. (Ireland) — payments and subscription. Stripe also processes data as an independent controller for fraud prevention and its own legal obligations.
• Brevo (Sendinblue SAS, France) — transactional emails and internal notifications.
• Web3Forms — forwards the contact form, quote requests and the new-sign-up notice to us by email.
• Openprovider — registration of domain endings Cloudflare doesn’t sell (e.g. .es, .lt); for a .es domain in a person’s name it also receives their ID number (DNI / NIE or passport), which the .es registry requires.
• Domain registries — as the domain’s registrant, your contact details are passed to the relevant registry; whether they appear in WHOIS depends on that registry’s policy.
• European Commission (VIES) — checks the VAT number you enter.
• Our accountant and the tax authorities — where the law requires it.

Our fonts are hosted on our own server: your browser does not contact Google Fonts.

4. International transfers

Some providers (Cloudflare, Stripe, Web3Forms) may process data outside the European Economic Area, in particular in the USA. Those transfers rely on the EU–US Data Privacy Framework where the recipient is certified and/or on the European Commission’s Standard Contractual Clauses (GDPR Art. 46).

5. How long we keep data

• Enquiries that don’t lead to a contract: up to 12 months.
• Client data: for the duration of the contract. After cancellation, your site content and photos are deleted 30 days after the end of the paid period (you can ask for a copy before then).
• Invoices and accounting records: as long as Lithuanian accounting law requires (up to 10 years).
• Consent records: as long as we may need to prove them (statutory limitation period).
• Withdrawal statements and acknowledgements: as long as we may need to prove them (statutory limitation period).
• Cancellation statements and their confirmations: as long as we may need to prove them (statutory limitation period).
• Support requests from the chat: up to 24 months. Messages to the AI assistant are not stored.
• Visit statistics: 400 days; the daily identifier key is deleted after 2 days.

6. Your rights

You can ask for access, rectification, erasure, restriction, portability, object to processing, and withdraw consent at any time by writing to info@costacreativelab.com. We reply within one month.

If you are unhappy, you can complain to the Lithuanian State Data Protection Inspectorate (VDAI, vdai.lrv.lt) or to the authority in your own country — in Spain, the Agencia Española de Protección de Datos (AEPD, aepd.es).

7. Cookies and local storage

We use no analytics, advertising or tracking cookies, and this website’s own code sets no cookies. The only things kept in your browser are needed for something you asked for (ePrivacy Directive art. 5(3); Spanish LSSI art. 22.2), which is why there is no cookie banner.

• On the payment step of /start, Stripe.js is loaded and sets cookies that are strictly necessary for fraud prevention.
• The /start form keeps a draft in your browser’s local storage so you don’t lose what you typed; the form itself is sent to us only when you press “Continue to payment” (or ask for a quote), and the draft is deleted once payment is confirmed (or when you click “Start over”). While you type, the live checks send only the value being checked — the domain name or VAT number — and we don’t store it.
• The site remembers, in your browser, the language you chose (or that you closed the language suggestion), so it doesn’t ask again.
• The demo remembers the language you picked, in your browser.
• If you are a client, the owner dashboard (admin.costacreativelab.com) uses a strictly necessary session cookie to keep you signed in, and remembers your language and last open tab in your browser.

8. Changes

If we change this policy in a meaningful way, we will say so on this page and, if you are a client, tell you by email.