UA | RU |
EN
Phone +38 (097) 350 57 42

Privacy policy

Last updated October 9, 2026

1. Introduction

We are Amidcode, a web development company. This Privacy Policy explains how we collect, use, and protect information about you when you visit our website https://amidcode.com (all language versions).

2. Information we collect

We collect information in the following ways:

  • Information you provide: in our contact form you give us your name, phone number and email, your message and your preferred way to get in touch. In the quote form you also answer a few questions about the job: site type, platform, budget, timeline. You can attach up to three files to a request: a brief, a mockup or a screenshot.
  • Automated information: when you visit our site, we automatically collect certain data using cookies and similar technologies. This includes your IP address, browser type, operating system, and interaction with the site. When you submit a request, your approximate location (city, region) and internet service provider are derived from your IP address.

3. Tools and third-party services

We use third-party services to improve our website and analyze traffic. These services may collect and process data according to their own privacy policies:

  • Google Analytics 4: Used for analyzing website traffic and user behavior. We use Google signals, so for visitors signed in to a Google account with personalized ads turned on, we see aggregated reports on age, gender, interests and activity across devices.
  • Microsoft Clarity: We use Clarity to understand how users interact with our website (heatmaps, session recordings). It helps us make the site easier to use. Sensitive data in input fields is masked automatically.
  • Google Ads: If you arrive at our site from an ad, we store technical ad-click identifiers (such as gclid) and campaign tags (UTM) so we can tell which source your request came from. When you submit a form, the email address and/or phone number you provide are sent to Google in hashed form (SHA-256) to measure advertising effectiveness (Enhanced Conversions); this data is never shared with Google in plain text. If you accept cookies, or the banner is not shown to you, Google may use cookies and data about your visit to show you our ads on other websites (remarketing). You can turn off personalized ads in Google’s ad settings. Processing respects your consent choices. Learn more in the Google Privacy Policy.
  • GeoJS: A service that determines an approximate location from an IP address. When we need to decide whether to show you the cookie banner, your browser asks GeoJS only for your country at the start of your visit. Your browser makes this request before you make any cookie choice. When you submit a form, our server sends your IP address to GeoJS and receives your city, region, country, time zone and internet service provider. We attach this data, together with your IP address, to your request to protect our forms from spam and fraudulent submissions and to analyze advertising traffic quality. The country code is kept in your browser until you close the tab, and a note of whether the banner applies to you is saved in the cookie_region cookie for one year.

Your data is also processed by the hosting provider Hetzner Online GmbH (Germany), whose servers run the site with its submissions database and our mailbox, and by Google Tag Manager (Google LLC), which loads our analytics and advertising tools. If you choose Telegram, Viber or WhatsApp as your contact method, we will message you there, and the conversation will be handled under that service’s own rules.

4. How we use your data

We use your data to:

  • get in touch and discuss your project;
  • see how the site performs and make it easier to use;
  • keep the site and our forms safe from spam and fraud;
  • measure how our advertising performs and show our ads to people who have already visited the site.

Every submission is automatically checked for signs of spam: the IP address provider, repeats, empty fields, the language of the text, typical mass-mailing phrases and links. Submissions with a high spam score go to a separate folder and do not reach our inbox. If you accept cookies, or the banner is not shown to you, the site also checks for signs of an automated browser, such as whether a program is controlling it and how the cursor moves in the first seconds. When two or more such signs are found, the site passes them to Google Tag Manager and attaches them to your request.

5. Legal basis for processing

We process your data only where one of the grounds set out in Article 6 of the GDPR applies:

  • Performance of a contract and steps taken before entering into one (Art. 6(1)(b)): the data from our contact forms is needed to answer your request, estimate the cost and agree on the terms of work. Without it we cannot handle your inquiry.
  • Your consent (Art. 6(1)(a)): visitors from the European Economic Area (the EU, Norway, Iceland and Liechtenstein), the UK and Switzerland, as well as visitors whose country cannot be determined, see a cookie banner. Until you choose, no analytics or advertising cookies are set and no analytics or advertising data about your visit is sent to Google. Your browser only loads the Google Tag Manager code from Google’s servers, and Google receives your IP address and browser details in the process. Once you accept, Google Analytics, Google Ads and Microsoft Clarity are switched on, and the hashed email and phone number from your form are sent to Google Analytics and Google Ads. If you decline, no analytics or advertising cookies are set and Clarity does not run, but Google tags in Consent Mode still send Google cookieless signals: the time, browser type, page address, your consent state and whether you arrived from an ad. While there is no consent, Google tags carry the ad click tag between pages of the site in link addresses, without cookies. What the site stores in your browser before you choose is described in the Cookies section. Visitors from the United States do not see the banner, because US law works on an opt-out basis, so these tools are active right away. Both where the banner is shown and in the United States, you can withdraw consent at any time using the “Cookie settings” button at the bottom of any page. Visitors from other countries, including Ukraine, see neither the banner nor the button. For these visitors, analytics and advertising tools are active right away on the basis of our legitimate interest, and after a form is submitted the hashed email and phone number are sent to Google Analytics and Google Ads. You can object to this by writing to info@amidcode.com, and if you do not want your contact details from a form to reach Google, contact us by phone, email or messaging app instead of using the form.
  • Our legitimate interest (Art. 6(1)(f)): protecting our forms from spam and fraudulent submissions, keeping the website technically secure, assessing the quality of advertising traffic and, for visitors from countries where we do not show the banner, analytics and advertising. We balance this interest against your rights and limit ourselves to the minimum data required.

We process data from visitors in Ukraine in line with Ukrainian personal data protection law.

6. How long we keep your data

We do not keep data longer than is necessary for the purpose it was collected for:

  • Form submissions (name, contact details, your message, project details, IP address, browser type, approximate location and traffic source) in the site database, and the emails with submissions and attached files in our mailbox: 3 years from our last contact with you. This period matches the general statute of limitations and lets us pick up the conversation if you get in touch again.
  • Submissions flagged as spam by the automatic check, and the check log (the date, IP address and provider of every submission, plus the name, contact and the start of the message for blocked ones): 12 months, after which they are deleted automatically.
  • Analytics data (Google Analytics 4, at the user and event level): 14 months (if a visitor comes back, the period for their user-level data runs from the last visit), after which the service deletes it automatically. This period does not apply to aggregated reports that are not tied to an individual visitor.
  • Advertising click identifiers stored in cookies: 90 days from your last visit, as stated in the cookies section.
  • Microsoft Clarity session recordings: 30 days; Microsoft keeps recordings we mark as favorites and a random sample of recordings for up to 9 months.

You can ask us to delete your data sooner. See “Data protection and your rights” below.

7. Transfers outside Ukraine and the EU

The analytics and advertising services we use belong to companies based in the United States, so technical data (IP address, cookie identifiers, information about how you interact with the site) may be processed outside Ukraine and the European Union, along with your email address and phone number in hashed form, which we send to Google Analytics and Google Ads to measure advertising performance:

  • Google LLC: Google Tag Manager, Google Analytics 4 and Google Ads.
  • Microsoft Corporation: Microsoft Clarity.

Both companies state that they participate in the EU-U.S. Data Privacy Framework and apply the European Commission’s standard contractual clauses. GeoJS, which determines an approximate location from an IP address, runs on infrastructure outside Ukraine; it receives your IP address and the technical details of the browser request (browser type, our site address), and no data you enter in a form is shared with it.

8. Cookies

We use cookies and browser storage to remember your cookie choice and for analytics, measuring and showing ads, and spam protection. What is stored on your device:

  • cookie_status, cookie_status_date, cookie_region and cookie_region_date: your cookie choice, the region used for the banner and the dates they were saved, 12 months. After that we ask for your consent again if the banner is shown to you.
  • amidcode_geo_country and amidcode_geo_rechecked: your country for the banner and a note that it has been checked, until you close the tab.
  • pll_language: the language version of the site you last viewed, 12 months.
  • amid_gclid, amid_gbraid, amid_wbraid, amid_fbclid, amid_msclkid, amid_utm_*: ad click tags, if you came from an ad. Before you consent, they are kept only in the browser tab until you close it; after you consent, in a cookie for 90 days from your last visit.
  • amid_first_referrer and amid_first_landing: the site you came from and the first page of your visit, kept for the same periods as the ad click tags.
  • amid_ic_signals: signs of an automated browser, used to protect our ads from bots, 1 hour. Stored only after you consent and only if such signs are found.
  • Google Analytics (_ga, _ga_*), Google Ads (_gcl_*) and Microsoft Clarity (_clck, _clsk) cookies, plus the cookies Google and Microsoft set on their own domains: only after you consent, for the periods these companies set.

For visitors from countries where the banner is not shown, all of the above is stored right away. If you have not declined cookies and you submit a request, the ad click tags, the site you came from and the first page of your visit are attached to it. Every request also includes the address of the page you sent it from and your approximate location. This helps us understand where the request came from and protect against spam. If you decline cookies in the banner or later withdraw consent with the “Cookie settings” button, the site deletes the ad click tags, the data on where your visit came from and its first page, and the Google Analytics, Google Ads and Microsoft Clarity cookies on our domain, and these tags are no longer attached to your requests. Microsoft Clarity then stops recording. The site cannot delete the cookies that Google and Microsoft set on their own domains. You can delete or block them, like any cookies, in your browser settings, but this may affect how some site features work.

9. Data protection and your rights

The site runs over a secure connection, and access to submissions is limited to the people who need it for their work. If your data is ever exposed, we will notify you and the supervisory authority. If you are a resident of the European Union, your data is processed in accordance with the GDPR (General Data Protection Regulation). You have the right to: request access to the data we hold about you; request rectification of inaccurate data; request erasure of your data (“the right to be forgotten”); restrict processing; receive your data in a machine-readable format (the right to data portability); object to processing; withdraw consent at any time; lodge a complaint with a national supervisory authority. Visitors from Ukraine have the rights set out in Article 8 of the Law of Ukraine “On Personal Data Protection”, including the right to know about the processing of their data, to access it, to object to processing, to have the data changed or destroyed if it is inaccurate or processed unlawfully, and to withdraw consent. They may also lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights or with a court. To exercise these rights, please contact us at the email address listed below. We respond to requests within 30 days.

You can object at any time to processing based on our legitimate interest (spam protection, assessing advertising traffic and, for visitors from countries without the banner, analytics and advertising) by writing to info@amidcode.com.

10. Contact us

If you have any questions about this Privacy Policy, please contact us:

Email: info@amidcode.com