// privacy & cookies
Privacy & cookie policy
Effective 7 October 2026. This policy explains what personal data makeflows.pro collects, why, where it goes and what you can do about it. Plain language on purpose; the legal basis is named where it applies.
Who is responsible
The data controller is Oleksandr Shylo, sole proprietor, Kharkiv, Ukraine, trading as MakeFlows. Contact for anything in this policy: [email protected].
What is collected and why
| Where | Data | Purpose & legal basis | Where it goes |
|---|---|---|---|
| Contact form | Name, email, preferred messenger and handle, project description, budget range, optional attachments (images, PDF, Word). | To answer your inquiry and prepare a quote — steps prior to a contract (GDPR art. 6(1)(b)) and legitimate interest in replying to people who write to me (art. 6(1)(f)). | A self-hosted n8n instance on a DigitalOcean server in Amsterdam (EU) routes the submission to a private Telegram channel, a Google Sheet and Gmail — all read only by Alex. |
| Chat assistant (“Max”) | The text you type into the chat and any files you attach to it (images, PDF, Word, Excel, CSV). | To generate an answer (legitimate interest, art. 6(1)(f)). Please do not paste passwords, card numbers or health data into the chat. | A Cloudflare Worker forwards the conversation to Anthropic’s API to generate the reply. makeflows.pro does not keep a database of chat messages; the conversation lives in your browser tab. |
| Analytics & ads | Pseudonymous usage data: pages viewed, device, approximate location, referrer; ad-click identifiers if you arrived from a Google Ads campaign. | To understand what works on the site and measure advertising — only with your consent (art. 6(1)(a)), asked for in the cookie bar. | Google Analytics 4 and Google Ads (Google Ireland Ltd.). Before you choose, Google Consent Mode keeps all advertising and analytics storage denied; a cookieless ping may still be sent so Google can model aggregate conversions. |
| Hosting | IP address, user agent, requested URL — standard server logs. | Security and delivery of the site (legitimate interest). | Cloudflare Pages (Cloudflare, Inc.) serves the site; logs are retained under Cloudflare’s own policy. |
Cookies and local storage
| Name | Set by | Purpose | Lifetime |
|---|---|---|---|
_ga, _ga_* | Google Analytics 4 | Distinguishes visitors and sessions. Only after you click “Accept”. | Up to 2 years |
_gcl_au, IDE, test_cookie | Google Ads / DoubleClick | Conversion attribution for Google Ads campaigns. Only after you click “Accept”. | 90 days – 13 months |
cookieConsent | makeflows.pro (localStorage) | Remembers your Accept / Decline choice. | Until you clear site data |
lang, theme | makeflows.pro (localStorage) | Remembers the language and light/dark theme you picked. | Until you clear site data |
Declining in the cookie bar keeps analytics and advertising cookies off. To change your choice later, clear this site’s data in your browser and the bar will ask again.
How long data is kept
- Inquiries (form submissions) — up to 24 months after the last contact, so I can pick up a conversation where it left off; deleted earlier on request.
- Project files and credentials shared for a paid project — for the duration of the project plus the 30-day support period, unless we agree otherwise in the written scope.
- Analytics event data — per the Google Analytics retention setting (2–14 months); aggregated reports are kept longer and contain no personal data.
International transfers
Form data is processed in the EU (Amsterdam). Google and Cloudflare may process data in the United States under the EU–US Data Privacy Framework and standard contractual clauses. Anthropic processes chat text under its API data-processing terms and does not use API inputs to train models.
Your rights
Under the GDPR (and equivalent laws such as the UK GDPR and California’s CCPA) you can ask for access to your data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. Write to [email protected]; I answer within 30 days. You can also complain to your local data-protection authority.
Children
The site is a business-to-business service and is not directed at anyone under 16.
Changes
If this policy changes, the effective date at the top changes with it. Material changes are announced on this page.