Privacy statement

Last updated · October 2026

1. Who is responsible

KORYTKO EOODVitosha Boulevard 78, 1463 Sofia, BulgariaCompany number (UIC / ЕИК): 207852659 · VAT ID: BG207852659E-mail: letters@houseofkorytko.com

No data protection officer has been appointed. This statement covers three things: this website, the application at /app/, and the measurement service that runs on our clients' websites.

2. This website

This website uses no cookies, no advertising or third-party tracking and no social media plugins. Fonts are loaded from Google Fonts (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland); when a page loads, your browser requests the font files from Google's servers, which involves transmitting your IP address. The legal basis is our legitimate interest in a consistent, fast presentation (Art. 6(1)(f) GDPR). The demo at /demo/ shows invented figures for an invented site and writes nothing.

3. Hosting and server logs

This website and the service are hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, with server functions executed in Frankfurt (Germany). When you open a page, the server automatically records technical access data: your IP address, the date and time, the page requested, the referring page, and your browser and operating system. We use this data only to deliver the website and to keep it secure and stable (Art. 6(1)(f) GDPR). Vercel processes it on our behalf under a data processing agreement and is certified under the EU-U.S. Data Privacy Framework, so transfers to the USA are covered by the European Commission's adequacy decision (Art. 45 GDPR). Log data is kept only as long as these purposes require.

4. The application (signed-in use)

Access to the application is granted by House of KORYTKO to its clients; there is no self-service sign-up. To sign in you enter your e-mail address and receive a one-time link (valid 15 minutes). We store the e-mail addresses of people with access, the time a link was requested and used, and set one cookie for the signed-in session (30 days) and one for the chosen language (one year). Both are strictly necessary for the service you asked for and require no consent (Art. 6(1)(b) GDPR). A share link opens one site's figures read-only for up to 14 days and sets a cookie limited to that site. If you log changes to your site in the application, the entry is stored with your e-mail address as its author. If you connect an AI assistant to your site (an MCP connection), we store the connection's label, the e-mail address of the person who created it and the times it was created, last used and revoked; the connection's secret is stored only as a hash. Through such a connection the assistant can read the same sums the application shows and the structure of your public pages, and can log a change — nothing else. Sign-in links, the weekly letter and alerts are sent through Resend Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, from servers in the European Union, under a data processing agreement. The counts are stored with Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992, on servers in the European Union (Frankfurt), under a data processing agreement including the EU standard contractual clauses.

5. The measurement service on our clients' websites

Our clients place the Gaze script on their own websites. For those websites the client is the controller; this section describes what the service does on their behalf (Art. 28 GDPR), and the client's own privacy policy applies to visitors of their site. A ready-made paragraph for that policy is provided inside the application.

What is counted. When a page is opened, the script sends to the service: the page; the sections that were visible on the screen for at least a second and for how long; the section at which the page was left; where in a section was clicked (as a position relative to the section); whether a contact link or a link to another website was used (recorded as the name of the destination, never the address); whether a form was started or submitted (never what was typed); whether and how far a film was watched; the device class (phone or desktop); the type of source (search engine, link from another website, advertising, direct and the like — never the address itself); and campaign labels contained in the link the visitor arrived by, if any. The hosting platform derives country, region and city from the IP address at the moment of the request; only those three are stored. Cities are shown only from five visits on.

What is never done. No cookies or other identifiers are set or read, nothing is stored in the browser (the one exception: a site owner can set a flag on their own browser to exclude their own visits), and neither the IP address nor the browser signature is stored. No text, no input, nothing from forms, fields or dialogs. No session recordings, no third-party scripts. The data cannot be related to a person, and nobody tries; it is used only as sums (for example "62 of 100 visitors read the second section").

Where it runs. The service runs with Vercel (section 3), stores its counts with Supabase on servers in the European Union (Frankfurt), and sends e-mail through Resend — each under a data processing agreement. Counts are kept as long as the client uses the service; a client can have everything counted before a date deleted at any time.

6. Contact by e-mail

If you write to us, we process what you send — for example your name, e-mail address and message — in order to answer you (Art. 6(1)(b) GDPR where your message concerns an engagement, otherwise Art. 6(1)(f) GDPR). Our e-mail is hosted by Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland; the European Commission recognises Switzerland as providing an adequate level of data protection. We delete messages once they are no longer needed, unless statutory retention periods apply.

7. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), and the right to object to processing based on legitimate interests (Art. 21). Where processing is based on consent, you can withdraw it at any time with effect for the future (Art. 7(3)). A short e-mail to letters@houseofkorytko.com is enough. For data counted on a client's website, please contact that website's operator; we assist them as their processor.

8. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work. The authority responsible for us is the Commission for Personal Data Protection of Bulgaria (КЗЛД), www.cpdp.bg.

9. Automated decisions

We do not use automated decision-making or profiling.