Privacy Policy

Last updated: 22 October 2026

This page explains which personal data is processed when you visit lishchuk.com, for what purpose, on which legal basis, who receives it, how long it is kept and what rights you have (Art. 13 GDPR, § 165 (3) Austrian TKG 2021).

1. Controller

Aleksandr Lishchuk
Sole proprietor (FOP) under Ukrainian law
Starokyivska Street 25, 04116 Kyiv, Ukraine
Email: lischuk.a@gmail.com

An email to this address is enough for any data protection request. No data protection officer has been appointed.

The controller has no establishment in the EU. The GDPR applies under Art. 3 (2) because the website addresses clients in Austria and the DACH region. No representative under Art. 27 GDPR has been designated, because processing is only occasional, does not include special categories of data and is unlikely to result in a risk to your rights (Art. 27 (2) (a) GDPR).

2. Summary

  • Every page view is processed by the hosting provider Netlify (technical access data, including your IP address).
  • Fonts, preview images and code libraries are hosted on our own server. Simply opening a page sends no data to Google, Meta or other third parties.
  • Google Tag Manager, Google Analytics 4, Google Ads and the Meta Pixel are only loaded after you agree in the cookie banner.
  • If you send a form or use the chat, we process your details to answer your request.

3. Hosting and server log files (Netlify)

The website is hosted by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. For every page view Netlify processes technically necessary data: IP address, date and time, requested address, referrer, browser and operating system.

  • Purpose: delivering the website, stability, security, troubleshooting.
  • Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a secure, working website).
  • Netlify acts as a processor. Netlify, Inc. is certified under the EU-U.S. Data Privacy Framework.
  • Retention: we do not analyse these logs. Netlify keeps them only as long as needed for operation and security.

4. Contact forms (Netlify Forms)

The home page, service pages and the SaaS page have contact forms. We process name and email (required) and, optionally, phone number, company or product, website and your message, plus the form name and the page language.

The data is stored at Netlify and we receive a notification at lischuk.a@gmail.com (Google, see section 11). Netlify checks incoming forms with the Akismet spam filter (Automattic Inc., USA).

  • Purpose: answering your request, preparing an offer or contract.
  • Legal basis: Art. 6 (1) (b) GDPR (pre-contractual steps at your request); for requests without a contract context Art. 6 (1) (f) GDPR.
  • Providing the data is voluntary. Without name and email we cannot reply.
  • Retention: requests that do not lead to an assignment are deleted no later than 3 years after the last contact. If we work together, statutory retention periods apply.

After a successful submission, email and phone are passed to Google Tag Manager (Enhanced Conversions). This only happens if you agreed to marketing cookies, because the Tag Manager is not loaded at all without consent (see section 8).

5. Chat with the AI assistant

The website has a chat window ("Aleksandr's AI Assistant").

  • A random visitor ID is created only when you send a message. Your messages (max. 1,000 characters) are sent with this ID to our chat server lishchuk-chat.onrender.com, run by Render Services, Inc. (USA), certified under the EU-U.S. Data Privacy Framework.
  • The server keeps the conversation in memory only and deletes it after 24 hours of inactivity. Your IP address is used briefly to limit the number of messages (spam protection).
  • Each message is forwarded to the operator's Telegram account so he can read along and answer himself (Telegram Messenger Inc.; according to Telegram, data of EEA users is stored in the Netherlands). We delete these chats no later than 12 months, unless an assignment follows (section 4).
  • For automatic answers, up to the last 10 messages are sent to the OpenAI API (model gpt-4o-mini). According to OpenAI, API data is not used for training and is kept in abuse logs for at most 30 days.
  • AI answers can be wrong. Please do not enter sensitive data (e.g. health data or passwords) in the chat.
  • Your browser (localStorage) stores lc_visitor_id, lc_history and lc_last_time, only after you sent a message. They stay until you clear the site data in your browser.
  • Purpose: answering your questions about services and prices. Legal basis: Art. 6 (1) (b) and (f) GDPR. Browser storage is strictly necessary for the chat you requested (§ 165 (3) TKG 2021).

6. Chess widget

The chess game runs entirely in your browser; all files are on our server. After the 4th move you can optionally enter your first name and email. This data and the game state stay in your browser only (localStorage lcw-state-v1, a game older than 7 days is discarded; lcw-muted for the sound setting) and are not sent to us unless you copy them into the contact form and submit it.

7. Cookie consent

We store your choice from the cookie banner in your browser (localStorage lsh_consent: statistics yes/no, marketing yes/no, time). No external service is used. We ask again after 12 months.

  • Legal basis: Art. 6 (1) (c) with Art. 7 (1) GDPR; this storage is strictly necessary under § 165 (3) TKG 2021.
  • Withdrawal: via "Cookie settings" at the bottom of every page you can change or withdraw your consent at any time with effect for the future. When you withdraw, we delete the analytics and advertising cookies. Processing before the withdrawal remains lawful (Art. 7 (3) GDPR).

8. Google Tag Manager, Google Analytics 4 and Google Ads

Provider for users in the EEA: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework.

Google Tag Manager (GTM-PQHW85QH) is loaded only after you agree. Without consent nothing is sent to Google.

  • Statistics (Google Analytics 4, G-TNLFYJB4LP): reach and usage analysis (page views, clicks, events such as chat opened or form sent). Cookies: _ga and _ga_<ID>, 2 years each. Data in Google Analytics is deleted after at most 14 months.
  • Marketing (Google Ads, AW-18419323285): conversion tracking and remarketing. Cookie: _gcl_au, 90 days. Enhanced Conversions: after a request, email and phone are hashed (SHA-256) and sent to Google to match the request to an ad click.
  • Purpose: analysing and improving the website, measuring advertising.
  • Legal basis: your consent, Art. 6 (1) (a) GDPR and § 165 (3) TKG 2021.

9. Meta Pixel

Only with your consent to marketing we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Data may be transferred to Meta Platforms, Inc. in the USA, which is certified under the EU-U.S. Data Privacy Framework.

  • Purpose: measuring advertising on Facebook and Instagram, remarketing.
  • Cookie: _fbp, 90 days.
  • Legal basis: Art. 6 (1) (a) GDPR and § 165 (3) TKG 2021.
  • We are joint controllers with Meta for collecting and transmitting the data to Meta (Art. 26 GDPR, agreement in Meta's business terms); Meta alone is responsible for further processing.

10. YouTube videos

Video preview images are hosted on our server. Only when you click a video, the player is loaded in privacy-enhanced mode from www.youtube-nocookie.com (Google Ireland Limited). Your IP address and usage data are then sent to YouTube. Legal basis: Art. 6 (1) (f) GDPR (you request the video yourself by clicking).

11. Contact by email, WhatsApp and phone

If you contact us by email, WhatsApp or phone, we process your contact details and message to reply (Art. 6 (1) (b) or (f) GDPR). The mailbox lischuk.a@gmail.com is operated by Google, WhatsApp by Meta (WhatsApp Ireland Limited). Links to Instagram, LinkedIn, Facebook and other services are ordinary links: data only goes to the provider after you click.

12. Storage in your browser

  • Without consent, because strictly necessary: lsh_consent (your cookie choice).
  • Only if you use the feature: lc_visitor_id, lc_history, lc_last_time (chat), lcw-state-v1, lcw-muted (chess).
  • Only after consent: _ga, _ga_<ID> (statistics), _gcl_au, _fbp (marketing).

You can delete cookies and localStorage in your browser at any time.

13. Recipients and transfers to third countries

Your data only goes to the providers named above, to the extent described: Netlify (USA, hosting and forms), Automattic (USA, spam check), Google (Ireland/USA), Meta (Ireland/USA), Render (USA, chat server), OpenAI (Ireland/USA, AI answers), Telegram (Netherlands for EEA data). Transfers to the USA are based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) or, where a provider is not certified, on the EU Standard Contractual Clauses (Art. 46 GDPR) included in the provider's terms.

The controller is based in Ukraine and handles your requests himself.

14. Retention (overview)

  • Form and email requests without an assignment: up to 3 years after the last contact; with an assignment, statutory retention periods.
  • Chat: server up to 24 hours after the last activity, Telegram up to 12 months, OpenAI up to 30 days.
  • Cookies: _ga and _ga_<ID> 2 years, _gcl_au 90 days, _fbp 90 days; Google Analytics at most 14 months.
  • Cookie choice: 12 months.
  • Other data in your browser: until you delete it.

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6 (1) (f) (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7 (3)), for cookies via "Cookie settings". An informal email to lischuk.a@gmail.com is enough.

16. Right to lodge a complaint

You can complain to a supervisory authority (Art. 77 GDPR). In Austria this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.

17. No automated decision-making

We do not make automated decisions within the meaning of Art. 22 GDPR. The AI assistant only answers questions and makes no decisions with legal effect for you.

18. Changes

We update this policy when the website or the services used change. The version published here applies.

Cookie settings