Privacy policy

Last updated: 13 October 2026

This policy explains what personal data the CyberArchitects website (cyber-architects.com) collects, why, who receives it, how long it is kept, and what rights you have. It covers this website, the emails it sends and the intro call you can book through it. Anything after that, such as a project we do together, is covered by our agreement with you.

Who is responsible

The controller of your personal data is:

Oleksandr Kolesnikov, individual entrepreneur (FOP) registered in Lviv, Ukraine

Email: alex@cyber-architects.com (read by Oleksandr Kolesnikov personally)

For anything in this policy, including exercising your rights, write to that address.

The short version

  • No advertising, no tracking cookies, no selling or sharing of your data for marketing.
  • No cookie is set until you open the chat.
  • Visitor statistics are counted without cookies and without identifying you.
  • What you type into the contact form, the booking form or the chat is used to reply to you and to hold the meeting you asked for, nothing else.
  • We make no decisions about you by automated means.

What we collect, and why

Contact form

When you send the contact form we receive your name, your email address and your message. We use them to reply to you.

  • Legal basis: steps you asked us to take before a possible contract (GDPR Art. 6(1)(b)), and our legitimate interest in answering enquiries (Art. 6(1)(f)).
  • The message is sent by our email provider, Resend, and lands in our mailbox, which is hosted by Microsoft (see "Who receives your data").

Booking a call

When you book an intro call we receive your name, email address, company (optional), your note about the project (optional), the time you picked and your time zone.

We use them to:

  • put the meeting in our calendar and create its Google Meet link;
  • send you a confirmation, and emails when the meeting is moved or cancelled;
  • send ourselves a copy of the booking;
  • prepare for the call.

Legal basis: steps you asked us to take before a possible contract (Art. 6(1)(b)).

Your booking is stored as an event in our Google Calendar. Your name, email address, company, note and time zone are written into that event. You are not added as a guest of the event, so Google does not contact you about it. Our calendar is a personal Google account: Google does not process its contents on our behalf but under its own privacy policy, which applies to the booking details stored there and to the Meet call.

Your confirmation email contains personal links to reschedule or cancel. Anyone who has those links can change the booking, so do not forward them. These pages are excluded from search engines, from our statistics and from the chat.

The call itself takes place on Google Meet. When you join, Google processes the name you give and the audio and video of the call under Google's own privacy policy.

Live chat

The chat window is provided by Crisp. If you write to us there, your messages and the details you give are stored by Crisp so we can answer, including when you come back later. From the moment you open the chat, Crisp also records technical data such as your IP address and browser.

  • Legal basis: our legitimate interest in answering questions on the site (Art. 6(1)(f)).
  • The chat is set to Crisp's "Total Privacy Mode": no chat session is created and no cookie is set until you open the chat window. The chat script itself is loaded from Crisp's servers on every page, so, like any file loaded from a third party, Crisp's servers see your IP address in that request.
  • Once you open the chat, Crisp sets functional cookies with the prefix crisp-client/ so the conversation survives moving between pages. They are not used for tracking or advertising and expire after 6 months, renewed each time you come back.

Abuse prevention

To limit how many messages or bookings can be made in a short time, the server keeps the IP address of each request in memory for the duration of the limit (one minute for the contact form, up to one hour for bookings), together with the email address of each booking made in the last ten minutes, so the same slot cannot be booked twice. This data is held in memory only, is never written to disk and is gone when the server restarts. Legal basis: our legitimate interest in keeping the site working (Art. 6(1)(f)).

Visitor statistics

We count visits with Umami, an open-source analytics tool that we run on our own server. It records the page you visited, the page you came from, your browser, operating system, device type and country, and a few actions such as clicking "Book a call" or completing a booking. It does not use cookies and does not build a profile of you. Your IP address is used only to derive the country and an anonymous identifier that changes every day, and is not stored.

  • Legal basis: our legitimate interest in understanding how the site is used and improving it (Art. 6(1)(f)).
  • The statistics stay on our server; no third party receives them.

Server logs

Like every web server, ours records technical data for each request: IP address, date and time, the page requested, the referring page and the browser. We use these logs to keep the site running and secure (legitimate interest, Art. 6(1)(f)).

Fonts and images are served from our own server, so viewing the site loads nothing from anyone else except the chat script described above.

Who receives your data

These providers hold or carry your data, for the purposes above and nothing else:

  • Redcluster Ltd (evps.net), servers in Bulgaria (EU): hosts the website and keeps the server logs and the statistics. Our processor, under its terms.
  • Microsoft (Microsoft 365), data kept in Europe: our mailbox, where contact-form messages and booking copies arrive. Our processor, under Microsoft's terms (privacy statement).
  • Resend (Plus Five Five, Inc.), United States: sends the contact-form and booking emails and keeps copies of them. Our processor, under Resend's Data Processing Addendum.
  • Crisp (Crisp IM SAS), data kept in the Netherlands (EU): the live chat, with your messages, the details you give, your IP address and browser. Our processor, under Crisp's privacy statement.
  • Google (Google Calendar, Google Meet), data centres worldwide: the booking calendar and the video call, with your booking details and, during the call, your name, audio and video. Our calendar is a personal Google account, so Google holds this under its own privacy policy rather than on our behalf.

We do not sell your data and do not share it with anyone else unless the law requires us to.

Where your data is processed

We are based in Ukraine, and the website runs on a server in Bulgaria, in the EU. What you send us goes directly from you to us and to the providers listed above; we do not pass it on to anyone else.

Ukraine and the United States are not covered by an EU adequacy decision. If you are in the EU or the UK, this is what protects your data on the way:

  • Our own processing is governed by Ukraine's Law on Personal Data Protection and, where it applies to you, by the GDPR, and this policy is written to meet both.
  • Resend, United States: EU Standard Contractual Clauses with the UK Addendum, and Resend's certification under the EU-US Data Privacy Framework.
  • Google: our calendar is a personal Google account, so Google holds the booking details under its own privacy policy rather than on our behalf, as explained under "Booking a call".
  • Microsoft, Crisp and our hosting provider keep the data in Europe.

How long we keep it

  • Booking details in our calendar: removed automatically once the meeting is 12 months in the past (a weekly job, so within about a week of that date). The calendar entry then keeps only the time and the words "Intro call".
  • Emails from the contact form and the booking copies in our mailbox: as long as our conversation is ongoing, and at most 24 months after the last contact.
  • Copies held by Resend: as described in Resend's privacy policy.
  • Chat conversations: 12 months after the last message. Crisp keeps the IP address of anyone who started a chat, and its connection logs for up to one year, as French law requires.
  • Server logs: 15 days.
  • Statistics: kept as aggregated, anonymous figures.

Your rights

Under Ukraine's Law on Personal Data Protection and, where it applies to you, the GDPR, you have the right to:

  • know whether we hold personal data about you, and access it;
  • have it corrected or deleted;
  • restrict or object to its use, including where we rely on legitimate interest;
  • receive it in a portable format;
  • complain to a supervisory authority: in Ukraine, the Ukrainian Parliament Commissioner for Human Rights; or the data protection authority where you live or work.

To use any of these rights, email alex@cyber-architects.com. We answer within one month. If a request is complex we may need up to two more months, and we tell you within the first month if so.

You do not have to give us any personal data to read the website. Without your name and email we cannot reply to a message or book a call.

We make no decisions about you by automated means.

Cookies

The website itself sets no cookies. The only cookies are the chat's functional crisp-client/ cookies, set only after you open the chat (see "Live chat"). There are no analytics, advertising or tracking cookies.

Children

The website is meant for businesses and is not directed at children.

Changes

If we change this policy, we update the date at the top of this page. For a change that affects what we collect or who receives it, we also add a short note here saying what changed.

Schedule a call