Privacy policy

This policy explains how I handle personal data on this site within the meaning of the General Data Protection Regulation (GDPR).

Provider and controller of personal data: Računalniško programiranje, Žan Meke s.p. (registration in progress), Glavni trg 41a, 8290 Sevnica, Slovenia, tax number 27636623, entry in the Slovenian Business Register (PRS) in progress (expected 1 November 2026) · info@zanmeke.com · +386 41 401 521

For any questions about personal data, write to info@zanmeke.com. I reply as soon as possible, and at the latest within one month.

What data I collect

Enquiry through the form

When you fill in the form on the Contact page, I store your name, phone number, optional email address and business name, what you are interested in and the text of your message. I receive a notification of the enquiry by email; if you have entered an email address, I send you a confirmation of receipt.

The IP address is not stored in the enquiry record. To protect the form against misuse (limiting the number of attempts), the IP address and email address are used temporarily as a counter, which is deleted within 24 hours at the latest.

• Purpose: to reply to you and prepare an offer.
• Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR), and for protection against misuse, legitimate interest (Article 6(1)(f) GDPR).
• Retention period: two years from the last contact. If the enquiry leads to an order, the periods in the section “Order, invoice and payment” apply. Older enquiries are deleted automatically.

When preparing a reply to an enquiry, I may use an AI tool (Anthropic). Before doing so, email addresses and phone numbers are automatically removed from the text; the tool sees your name, business and the content of the enquiry. I always read the reply and send it myself.

Right after you send it, a copy of the enquiry (name, business, email, phone, interest, message, where it came from) is also stored automatically in my business application Podjetje (podjetje.zanmeke.com), where I manage quotes and invoices. Only I have access to it; it runs with the same processors as this site (see below). Purpose, legal basis and retention are the same as above.

AI assistant on the site

In the corner of the page there is an AI assistant that answers questions about my services. Before the conversation starts, it is clearly marked that you are chatting with an AI assistant and not with a person. The answers are for information only; I confirm offers and prices personally.

Your questions and the latest part of the conversation are sent, to prepare an answer, to the language model provider Anthropic, which acts as my processor. On the site I store the text of the conversation, the pages on which you wrote, and a hashed (pseudonymised) value of the IP address, which serves to limit misuse. The assistant does not ask for your name or email address — please do not enter personal data you do not need for your question.

If in the conversation you submit an enquiry or a request for a short video call yourself (name, business, email address, optionally phone and message), the conversation is attached to the enquiry, so that I can see what you have already discussed. The rules for enquiries above then apply to it.

• Purpose: answering your questions, protection against misuse and improving the assistant's answers.
• Legal basis: my legitimate interest in answering visitors' questions (Article 6(1)(f) GDPR); for a submitted enquiry, steps prior to entering into a contract (Article 6(1)(b) GDPR).
• Retention period: the conversation is deleted automatically 30 days after the last question (daily deletion). A conversation attached to an enquiry is kept for as long as the enquiry.

Before the text goes to Anthropic, email addresses and phone numbers are automatically removed from your messages (replaced by the labels »[e-pošta]« and »[telefon]«). On the site the conversation is stored as you wrote it, so that I can also reply to you in person.

AI assistant trials on the Pricing page

Some AI assistant trials on the Pricing page (AI assistants section) are unlocked with an email address. When you enter it, I send you an email with a link and a code (both valid for 7 days). Until you confirm, I keep your email address, business name, line of business, language and your choice regarding messages as an unconfirmed request; it is deleted once you confirm access, otherwise automatically 7 days after the request. Only once you use the link or the code are the trials unlocked and an enquiry record created. A cookie confirming access is stored in your browser for 30 days. I also record which assistants you open and try out, and any indicative offer you put together — so that I can prepare a tailored offer for you. The legal basis is your request and my legitimate interest in responding to it; I only send you messages about AI assistants if you expressly tick this (consent, which you can withdraw at any time). Data about your interest is kept for 12 months and I do not pass it on to third parties. You can object or request erasure at any time at info@zanmeke.com.

The enquiry record stores your email address, business name, line of business, language and your choice regarding messages about AI assistants (with the date). Data about your interest is deleted automatically 12 months after it was first recorded. What you type into the assistant trials is sent to Anthropic to generate an answer, but is not stored on the site — the trials work with made-up data, so do not enter real personal data into them. If you submit the “I want this” form, the rules for enquiries above apply to it.

AI assistant demo and website drafts (pomocniki.zanmeke.com)

The AI assistant demo (/demo) and the free website drafts (/osnutek) are on pomocniki.zanmeke.com. The controller and the providers (Vercel, Supabase, Resend, Anthropic) are the same as for this site.

On /demo the same applies as for the trials on the Pricing page above: the link and the code are valid for 7 days, an unconfirmed request is deleted at the latest 7 days after it was made, the unlock cookie lasts 30 days, and I also record your interest in the assistants. A confirmed email address is stored as a confirmation record (email address, business name, line of business, language, your choice regarding messages and the assistant you unlocked it from), and the “I want this” form as a demo enquiry (name, business, phone, email address and message). I receive an email notification of both. The records and the data about your interest are deleted automatically 12 months after they were created. The cookies of that site are listed in the cookie policy.

A free website draft is a screenshot of a proposed page for a single business on a private link that is valid for 14 days. I keep the client's name, the language and the screenshots; the record is deleted automatically 30 days after the link expires, or earlier when I delete it myself. Viewing a draft sets no cookies.

Client testimonials

I may ask clients I have worked with for a testimonial. I send them a personal link (valid for 60 days) through which they enter their name, business, role, town and the text of the testimonial. I only publish the testimonial on the site if the client expressly confirms, when submitting it, that they agree to its publication; the time of this consent is stored. With the request, I also keep the email address of the client the link was intended for.

• Purpose: publishing testimonials on the site.
• Legal basis: your consent (Article 6(1)(a) GDPR).
• Retention period: for as long as the testimonial is published, or until you withdraw consent. Send the withdrawal to info@zanmeke.com — I remove and delete the testimonial.

Newsletter

You can sign up for the newsletter in the footer of the site or on the Contact page. I store your email address, the language of the site, the time of consent and of confirmation, and a hashed value of the IP address at sign-up (with a secret key; the full address is not stored). Sign-up is double opt-in: you first receive an email with a link, and you only become a subscriber once you confirm the sign-up on the site. I delete unconfirmed sign-ups after 30 days. If you ask me to sign you up some other way (e.g. in person), I add you only with a confirmation email or with a record of where and when you consented.

• Purpose: occasional news about new work, offers and AI assistants.
• Legal basis: your consent (Article 6(1)(a) GDPR).
• Retention period: until you unsubscribe. After you unsubscribe, I only keep the email address with the date of unsubscribing, so that I do not send you the newsletter again; on request I delete it.
• Processor: the newsletter is sent by the provider Resend (see below); each message goes out separately, and other recipients do not see your address.

Every message contains an unsubscribe link that works with one click and without signing in. You can also withdraw consent with a message to info@zanmeke.com. Unsubscribing does not affect the lawfulness of sending before it.

Order, invoice and payment

If you become a client, I process the data required by invoicing legislation: name or company name, address and tax number (where required by law), the email address for sending the invoice, and details of the service and amount.

• Purpose: performance of the contract and compliance with tax and accounting obligations.
• Legal basis: contract (Article 6(1)(b) GDPR) and legal obligation (Article 6(1)(c) GDPR).
• Retention period: invoices and accounting documents for ten years from the end of the year to which they relate, as required by tax legislation.

You receive the invoice by email with a link to view it online. The link contains a random key that cannot be guessed, and the invoice page is not in search engines. You pay with a UPN payment order (the QR code is generated on my server, without an external service). Once card payment is available on the site, you can also pay through the provider Stripe; I do not see your card details and they are never stored on this site.

Visit measurement

Visit statistics run only if you consent to them. If you decline or do not give consent, nothing is recorded.

With consent, the following are stored: a random identifier from a cookie (not linked to you as a person), a hashed value of the IP address (with a secret key; the full address is not stored), the device type, operating system, browser and language, the page you came from, the pages visited and clicks on the phone number. Of the location, I record only the country, not the city.

• Purpose: to know which content was useful to visitors.
• Legal basis: your consent (Article 6(1)(a) GDPR, Article 225 of the Slovenian Electronic Communications Act, ZEKom-2).
• Retention period: fourteen months. Older records are deleted automatically.

Details about cookies are on the Cookies page. You can withdraw consent at any time — click “Cookie settings” in the footer of the site.

AI assessment of enquiries

When I click »Oceni povpraševanje« (Assess enquiry) on a single enquiry in the administration, an AI tool (Anthropic) prepares a short summary: what the client wants, how urgent it is and what information is missing. Email addresses and phone numbers are removed from the text first. The assessment never runs automatically. It only helps me: I decide on the reply, the quote and the price myself, so this is not automated decision-making under Article 22 GDPR.

• Purpose: a faster and better reply to the enquiry.
• Legal basis: my legitimate interest (Article 6(1)(f) GDPR).
• Retention: the assessment is kept together with the enquiry.

Google Business Profile

The site is connected to my Google Business Profile through the Google Business Profile API. In the administration I read the profile's reviews (reviewer name as shown by Google, rating and text); reviews are not stored on the site, they are read live. For a draft reply, the review text, without email addresses and phone numbers, may be processed by an AI tool (Anthropic); I always read and publish the reply myself. When I publish an update on the profile, the site records when and by whom. Google is responsible for the data on its own platform.

• Purpose: replying to reviews and posting on my Google profile.
• Legal basis: my legitimate interest (Article 6(1)(f) GDPR).
• Retention: reviews are not stored; posts and replies are recorded in the administration security log (12 months) and in the list of profile posts.

Posts on Facebook and Instagram

I prepare posts for my Facebook and Instagram pages in the administration and publish them manually through the Meta Graph API. The site stores only an encrypted connection token and a log of posts (when, on which channel, link to the post). The site does not read comments or messages from these networks. Meta is responsible for the data on its own networks.

• Purpose: posts on my pages on the networks.
• Legal basis: my legitimate interest (Article 6(1)(f) GDPR).

Gift vouchers

When gift voucher sales are enabled on the site (they are not at the moment), I store the buyer's email address, who the voucher is for, who it is from and an optional message on the voucher, the value, the amount paid, the language and the validity (12 months). Card payment is processed by Stripe; I do not see card details. You receive the voucher and the receipt by email (Resend).

• Purpose: selling, delivering and redeeming the voucher.
• Legal basis: contract (Article 6(1)(b) GDPR) and the legal obligation regarding sales records (Article 6(1)(c) GDPR).
• Retention: until the voucher expires, then as part of the accounting records for ten years from the end of the year of sale.

Email

Emails sent by the site (confirmations, links for unlocking the trials and the demo, the newsletter, invoices) are sent by the provider Resend. A log is kept of every message sent (recipient, subject, time and whether sending succeeded), so that I can check whether a message arrived. The log is kept for 12 months, after which the records are deleted automatically.

Who I entrust data to

To run the site, I use external providers who process data solely on my instructions and under a data processing agreement concluded with them:

• Vercel — hosting of the website and server functions (run in Frankfurt, EU).
• Supabase — database (servers in Frankfurt, EU).
• Google (Business Profile) and Meta (Facebook, Instagram) — connections for reviews and posts; for the data on their own platforms they are independent controllers.
• Cloudflare R2 — storage of images and documents.
• Resend — sending email.
• Anthropic — language model for the AI assistant, the trials on the Pricing page, the demo on pomocniki.zanmeke.com and help with preparing replies (USA).
• Stripe — card payments and gift vouchers, once card payment is available (Stripe Payments Europe, Ireland; transfer to Stripe, Inc. in the USA).
• An external accounting service (contracted processor) — for invoices issued and received.

Vercel, Cloudflare, Resend, Anthropic and Stripe are companies based in the USA or with affiliates in the USA. Transfers to Anthropic are based on the standard contractual clauses in its data processing agreement; for the others on the EU–U.S. Data Privacy Framework where the provider is certified, otherwise on standard contractual clauses. I do not sell data or pass it on for advertising.

Retention periods at a glance

• Enquiry: two years from the last contact.
• Conversation with the AI assistant: 30 days from the last question (unless attached to an enquiry).
• Data about interest in AI assistants (Pricing page and pomocniki.zanmeke.com/demo): 12 months; unconfirmed access requests: 7 days.
• Website draft: 30 days after the link expires (the link is valid for 14 days).
• Testimonial: for as long as it is published, or until consent is withdrawn.
• Newsletter: until you unsubscribe; unconfirmed sign-ups 30 days.
• Invoices and accounting documents: ten years from the end of the year.
• Visit statistics: fourteen months.
• Log of emails sent: 12 months.
• Administration security log (sign-ins and changes, with IP address and device): 12 months.
• Gift voucher: until it expires, then ten years as an accounting record.
• Counters for protection against misuse: 24 hours at most.

Children

The site and the services are not intended for children. I do not knowingly collect data of persons under 15; a child under 15 may not sign up for the newsletter or use the chat without parental consent (Article 8 ZVOP-2). If I learn that I have received such data, I delete it.

Automated decision-making and profiling

I do not make decisions based solely on automated processing that would have legal or similarly significant effects on you (Article 22 GDPR). The AI assessment of enquiries (above) is only started manually and helps me reply; I decide on the quote myself.

Your rights

At any time you can request access to your data, its rectification or erasure, restriction of processing, portability of your data to another provider, or object to processing based on legitimate interest. You can withdraw consent (visit measurement, newsletter, messages about AI assistants, publication of a testimonial) without affecting the lawfulness of processing before the withdrawal.

Send your request to info@zanmeke.com.

If you believe I am handling your data wrongly, you can lodge a complaint with the supervisory authority: Informacijski pooblaščenec (Information Commissioner of the Republic of Slovenia), Dunajska cesta 22, 1000 Ljubljana, ip-rs.si.

Security

The connection to the site is encrypted (HTTPS). Passwords are stored as a cryptographic hash and cannot be read. Only I have access to the administration, with mandatory two-step login.

Changes

I may change this policy when the way the site works changes. The date of the last change is shown at the bottom.