Privacy

Data controller

The data controller for personal data collected through this website and the support portal is:

• Name: Antonios Kavidas (Αντώνιος Καβίδας)
• Legal form: sole proprietorship
• Trading name: Instatok
• Seat: Athens, Greece
• Tax ID (ΑΦΜ): 146129547
• Privacy email: hi@instatok.gr

Contact form

When you send the contact form, your name, email, optional phone, message and the service you are interested in are sent through Cloudflare to HubSpot and, via Resend, to the Instatok team’s email, so we can handle your enquiry and contact you about it. Your acceptance and the version of this policy are recorded with it. This does not automatically subscribe you to news or marketing emails.

Cloudflare Turnstile checks that a person, not an automated program, is sending the form. This check and the per-minute submission limit use your IP address, which is not stored with your enquiry. If you email or call us directly, we use your details only to reply to you.

Package and offer

Your enquiry includes the package or offer you came from, your final selection and the contact page. This helps us understand your request.

Live chat

HubSpot live chat loads only when you select Live chat and have accepted Analytics. Before the conversation starts, it asks separately for consent to process it, and after your first message it asks for your email so we can reply. Messages and details you provide are stored in HubSpot to handle your enquiry. This does not subscribe you to a newsletter. You can use the form, email or phone without optional cookies.

Online meetings and contact measurement

The embedded HubSpot calendar loads when you open it and have accepted Analytics. Booking details you enter are sent to HubSpot to manage your meeting. A separate link lets you open the calendar directly in HubSpot. With analytics consent, we record contact-button clicks, new conversations and completed bookings. We do not send message content, email addresses or phone numbers as parameters of these events to Google Analytics.

News and offers by email

Only if you select the separate, optional checkbox do we request your subscription to Instatok’s Marketing Information emails in HubSpot. We keep the consent wording and version, form source and receipt time. This choice is independent of cookies and is not required to contact us. You can withdraw through the unsubscribe link in each marketing email or by emailing hi@instatok.gr. An unchecked checkbox on a new enquiry does not change an existing subscription.

Cookies and measurement

No analytics or advertising tool loads without your consent. Analytics loads Google Tag Manager, which runs Google Analytics 4 and Microsoft Clarity, and allows HubSpot measurement. Advertising allows Google Ads and Meta Pixel, when enabled, and the retention of advertising click identifiers. Google’s tools receive your choice through Google Consent Mode. We do not send your name, email, phone or message to Google or Meta.

Only with consent to Analytics, Microsoft Clarity records how the page is used (clicks, scrolling and movement, as session recordings and heatmaps) so we can improve the website. What you type into the contact form and the booking calendar is hidden from these recordings.

With consent to Analytics, HubSpot’s tracking code also loads on every page and records the pages you visit and the source of your visit in our CRM; if you send the form or start a chat, this is linked to your contact record.

Cookies these tools may set on our domain:

• Analytics: _ga and _ga_* (Google Analytics), _clck and _clsk (Microsoft Clarity), hubspotutk, __hstc, __hssc and __hssrc (HubSpot), messagesUtk (live chat).
• Advertising: _gcl_* (Google Ads), _fbp and _fbc (Meta).

Each provider sets the lifetime of its cookies. If you withdraw consent, we delete those on our domain and the page reloads without these tools.

Your browser’s local storage keeps your cookie choice (instatok-consent-v2) for 180 days, after which we ask again. Only with consent, it also keeps your first and most recent source of visit, with permitted campaign parameters (instatok-attribution-v1), for up to 30 days; these accompany your enquiry.

You can change or withdraw your choice using Privacy settings at the bottom of every page. The website and the form also work without optional cookies.

Hosting and technical data

The website and its forms run on Cloudflare. As with any website, Cloudflare processes technical data of each visit, such as your IP address, browser and the page requested, to deliver the pages and protect them from abuse. Project and article images load from Sanity, our content management system, which also receives the technical data of the request; we store no visitor data in Sanity. The Google rating on the home page, when shown, comes from our own server: your browser does not connect to Google for it and we send Google none of your data.

Customer support portal

Instatok Support is for clients with active support. Access is enabled from our CRM (HubSpot) or by invitation, and you sign in with a one-time code sent to your email via Resend; the code is stored only in irreversible (hashed) form and expires after 10 minutes. Only necessary sign-in cookies are used, with a session of up to 14 days, renewed while you use the service. Access records, sessions (with IP address and browser, for security), requests and records of your confirmations are stored in Cloudflare D1. Requests and attachments are sent to HubSpot as tickets and private files. Permission to reply to a request is recorded separately from any marketing consent. The app (PWA) does not load analytics or advertising tools and does not store requests or attachments for offline use. To revoke access or manage your data, contact support@instatok.gr.

Projects and invoicing

When we work together, we keep the details needed for the project and for issuing invoices, such as business name, tax ID and address. We share invoicing data only with our accountant. The website does not take payments and we do not store payment card details.

Legal basis

We process data under Article 6(1) of the General Data Protection Regulation (GDPR):

• Performance of a contract or steps before one, at your request (point b): replying to enquiries, proposals, project delivery and support.
• Legal obligation (point c): issuing and keeping invoices.
• Legitimate interest (point f): security of the website and forms and protection against abuse.
• Consent (point a): optional cookies and measurement, live chat and the embedded booking calendar, marketing emails. You can withdraw it at any time, without affecting the lawfulness of processing before the withdrawal.

Recipients

Your data is seen only by the Instatok team and by the providers that help us operate, for the purposes each section describes:

• Cloudflare: hosting, Workers, Turnstile and support portal storage (D1).
• HubSpot: CRM, form enquiries, live chat, meetings, support tickets and attachments.
• Resend: delivery of form notifications, sign-in codes and portal invitations.
• Google: business email (Google Workspace) and, only with consent, Tag Manager, Analytics and Ads.
• Microsoft: Clarity, only with consent.
• Meta: Pixel, only with consent and when enabled.
• Sanity: website content and images.
• Our accountant: invoicing data only.

Some providers are based outside the European Economic Area, mainly in the United States. In those cases, transfers rely on GDPR safeguards such as the EU-U.S. Data Privacy Framework or standard contractual clauses. We do not sell or rent your data.

Retention

• The Worker’s temporary copy of an enquiry: personal details are deleted after 7 days and the receipt after 30 days.
• Enquiries and correspondence in HubSpot and email: as long as needed for our communication and collaboration. We delete them when they are no longer needed or when you ask, unless the law requires us to keep them.
• Support portal: sign-in codes and sessions are deleted when they expire. Requests, attachments and records of your confirmations are kept as long as needed to support your project and to show the confirmations you gave.
• Invoicing data: 10 years, as required by Greek tax law.
• In your browser: the cookie choice for 180 days and the source of your visit for up to 30 days.

Security

Communication with the website uses HTTPS, so your details travel encrypted. Provider keys stay on the server only, access to data is limited to those who need it, and support portal attachments are stored as private files. If a breach affects your data, we inform you and, where required, the Hellenic Data Protection Authority within 72 hours of becoming aware of it.

Your rights

Under Articles 15 to 22 of the GDPR, you have the right to:

• Access your data and receive a copy.
• Have inaccurate or incomplete data corrected.
• Have your data deleted.
• Restrict processing.
• Data portability: receive your data in a structured format.
• Object to processing based on legitimate interest.
• Withdraw your consent at any time.

To exercise any right, email hi@instatok.gr, ideally with the subject “GDPR request”. We reply free of charge within 30 days. You can also lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

Changes to this policy

When this policy changes, we update the date at the top of the page. We also inform our active clients of significant changes.