Privacy Policy

1. Who we are

This site is operated by Alexander Vinokurov, a private entrepreneur, trading as 99 Francs (“99 Francs”, “we”, “us”). 99 Francs is a remote studio — the team works from different locations, and client meetings are held online. For anything related to this policy or your personal data, contact us at sales@99francs.agency.

2. Information collected through the contact form

The contact form asks for your name, email address, a project message, the service(s) you're interested in and an optional budget range. You can also attach one file, such as a brief; it is emailed to us with your message and is not stored on the website. When you submit it, the site also attaches:

• Attribution data — the page you landed on, an external referrer (if any), utm_source/utm_medium/utm_campaign, a Google Ads click id (gclid) if present, and the page the form was actually submitted from. This is captured client-side into your browser's sessionStorage (key 99f:attribution) for the duration of your visit, and is only ever sent to us as part of a form submission you choose to make.

Enquiries are delivered by email, not stored in a database. Submitting the form sends an email (via Resend, see section 5) directly to our inbox. We do not keep a CRM, spreadsheet or database of contact-form submissions — the enquiry lives in our email as long as we need it to respond to you and, if a project follows, as part of our ordinary business correspondence with you.

A hidden field on the form (labelled “website”) is a spam trap: it is never shown to real visitors, so if it's filled in the submission is treated as automated spam and quietly discarded rather than emailed.

To limit abuse, submissions are rate-limited to 5 per hour per IP address. The IP address is only ever held in server memory for this counting, is not written to disk or any database, and is cleared whenever the server process restarts (which happens on every deploy).

3. Cookies and similar technologies

On your first visit, a small cookie notice offers you a choice about analytics and advertising cookies. We estimate whether you're in the EEA, the UK or Switzerland from your browser's time zone (never from your IP address or any lookup) — if we can't tell, we treat you as if you were, which is the stricter setting. In that case, none of the third-party analytics or advertising scripts listed below loads — so none of these providers receives a request from your browser, or your IP address — until you actively choose “Accept”; everywhere else, they're on by default and you can choose “Opt out” instead. Your choice (and the region we detected) is saved in your browser's local storage, and you can change it at any time from “Cookie settings” in the footer of this page.

Prices in your currency. To show our prices in US dollars, euros, Norwegian kroner or New Zealand dollars, your browser asks our server which country your visit comes from. We read it from the country code that our network provider, Cloudflare, adds to every request (based on your IP address). It is used only to pick the currency: it is not logged, stored or linked to you on our side, it sets no cookie, and the chosen currency is kept in your browser's session storage until you close the tab.

The providers we use, and how each one is affected by that choice:

• Google Analytics 4 & Google Ads (via Google's gtag.js) — measures site usage and ad performance. In the EEA/UK/Switzerland these scripts do not load at all until you accept. Elsewhere they load for every visitor, and we tell Google (via Google's Consent Mode) whether to set analytics/advertising cookies based on your choice; if you opt out, Google receives only limited, cookieless signals. See Google's Privacy Policy.
• Meta Pixel — measures ad performance for Meta (Facebook/Instagram) campaigns. This script does not load at all unless your choice allows it (denied by default in the EEA/UK/Switzerland until you accept; on by default elsewhere unless you opt out). Sets cookies once it loads. See Meta's Privacy Policy.
• LinkedIn Insight Tag — measures ad performance for LinkedIn campaigns. Same rule as Meta Pixel: it only loads once your choice allows it. Sets cookies once it loads. See LinkedIn's Privacy Policy.
• OpenAI Measurement Pixel — measures ad performance for our ads in ChatGPT: it tells OpenAI when a visitor who came from one of those ads sends us an enquiry or books a call. Same rule as Meta Pixel: it only loads once your choice allows it. Once loaded it may store an identifier in your browser, and it can pick up contact details you enter on the page (such as your email address), which it hashes in your browser before sending, so OpenAI never receives them in readable form. See OpenAI's Privacy Policy.
• Microsoft Clarity — records how visitors move through pages (scrolling, clicks, mouse movement) as anonymised session replays and heatmaps, so we can see where a page confuses people. Text you type into the contact form is masked and never recorded. Same rule as Meta Pixel: it only loads once your choice allows it. Sets cookies once it loads. See Microsoft's Privacy Statement.
• Ahrefs Analytics — cookieless website analytics that does not set cookies or use any persistent identifier. In the EEA/UK/Switzerland it does not load until you accept; elsewhere it loads for every visitor. See Ahrefs' Analytics privacy notice.

Website analytics (datafirst). Separately from the providers above, we count visits and submitted enquiries with datafirst, our own analytics service. It runs from this site's own address, sets no cookies and stores nothing in your browser, so it runs for every visitor regardless of the cookie choice above. For each page view your browser sends the page path (without query strings, apart from campaign tags such as utm_source), the referring website's domain, the page title, how long the page was in view and how far you scrolled, the domain of any other website you follow a link to, and, as with any request, your IP address and browser user agent. On our server the IP address is used only to look up your country and, together with a random value that changes every day and is then deleted, to make a daily visitor code; the IP address itself is not stored. We keep the page path, referring domain, country, device type, browser and operating system, the time the page was in view, how far you scrolled, the domains of websites you followed links to, the daily code and the time, for up to 25 months. Because the daily value is deleted, the code can't be linked back to you or across days. Data is processed on our hosting provider Railway's servers. We use it only to understand how the site is used (legitimate interest, Art. 6(1)(f) GDPR); it is not used for advertising or profiling and not shared.

The third-party scripts above load a few seconds after the page is otherwise ready, and none of them run on the client portal (/portal), which is intentionally built without tracking scripts.

Your choices. Besides the cookie notice and the “Cookie settings” control in the footer, you can block or delete cookies at any time in your browser settings, and Google, Meta and LinkedIn each offer their own ad-personalisation opt-outs (linked above).

4. Client portal accounts

Signed-in clients of the client portal are a separate category of data subject. For each client account we hold a company name, a contact name, an email address, and whether the account is currently active. Against that account we hold project records: a project title, its status and progress, a short description of current work, and hours/rate or fixed-price figures used to show you the value of work done. This data is entered and maintained by hand by us and is only ever shown to the client account it belongs to.

Signing in sets a session cookie (payload-token) that identifies your portal session; it expires automatically after a period of inactivity and is cleared when you sign out.

5. Service providers we use

• Resend — delivers contact-form enquiry emails to us. Your name, email, message and the attribution details above pass through Resend's systems to reach our inbox.
• Railway — hosts this website and its database (client portal accounts and project records), and our own datafirst analytics service described above.
• Cal.com — the intro-call calendar on /intro-call, the contact page and some service pages is Cal.com's booking widget, embedded in our page. It loads from Cal.com only when you scroll to it, and a booking you make there is handled on Cal.com's platform under its own privacy policy — we don't control what it collects. When a booking succeeds, the page records it as a lead in Google Analytics and Google Ads (the same event as a sent contact form, without your details), subject to the consent choices described above.
• AgentFit (ui-design.co) — our own product, which runs the AI Visibility Check. The address of the site you check, your IP address (for rate limits), and — if you give them — your email, name and notes go to it through our server. It reads the site's public pages, asks ChatGPT and Perplexity questions about it through OpenRouter, and keeps the report so its link keeps working. Payments for the full report or the done-for-you fix are processed by WayForPay; we never see card details. Tokens that open a report you paid for or unlocked with your email are kept in a cookie on this site.

6. External links and the “/go” page

Links to other websites (social profiles, partner tools, provider policies) on this site pass through a short interstitial page (/go) that confirms you're leaving 99francs.agency before redirecting you. It only accepts HTTPS destinations and does not itself collect any personal data. Once you follow the link, that other site's own privacy policy applies.

7. Legal bases for processing

For visitors in the EU, UK or other jurisdictions with similar requirements, we rely on the following legal bases:

• Contact-form enquiries — our legitimate interest in responding to enquiries, and the steps you ask us to take before entering into a contract with you.
• Client portal accounts and project data — performance of our contract with you as a client.
• Analytics and advertising cookies — your consent, where the law requires it (see section 3).

8. Data retention

We keep contact-form enquiry emails for as long as we need them to respond to you and, if we go on to work together, for the duration of that business relationship and a reasonable period afterwards. Client portal accounts and project records are kept for the duration of the engagement: an account is deactivated rather than deleted when access should end, and a finished project is marked archived rather than removed, so the historical record of work delivered remains available if needed. Analytics and advertising data is retained according to each provider's own settings and default retention periods, which we don't independently override.

9. International transfers

Our service providers operate in the United States and the European Union, among other locations, so your data may be processed outside the country you're in. Each provider listed in section 5 and section 3 maintains its own safeguards for international transfers under its privacy policy, linked above.

10. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, ask us to delete it, object to or restrict certain processing, and withdraw any consent you've given (without affecting processing carried out before the withdrawal). You can exercise any of these by emailing sales@99francs.agency.

If you're not satisfied with our response, you can lodge a complaint with your local data protection authority. In New Zealand, that's the Office of the Privacy Commissioner, under the Privacy Act 2020, which gives you similar rights of access and correction.

11. Children's privacy

This site is a business-to-business marketing and client-services site and is not directed at children. We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this policy as the site or how we handle data changes. The “Last updated” date at the top of this page reflects the most recent revision.

13. Contact

Questions about this policy or your data can go to sales@99francs.agency.