Privacy policy.

1. Data controller

The data controller is CREA NOVA OÜ (operating under the trade name “Inleven”), whose full contact details appear in the legal notice. For any question about your data: contact@inleven.studio.

2. Data collected

Inleven applies the principle of minimization: only the necessary data is collected.

• Contact form: first name, last name, email, activity, message, and technical metadata (date, originating page).
• Appointment booking: name, email, date and time of the chosen call and, if you fill them in, notes and guests, entered in the Cal.com booking window; Cal.com also receives the technical connection data (IP address, browser, device).
• Contractual data (in the event of a subscription): name, contact details, billing address; payment data is processed directly by the payment provider (Stripe); Inleven does not keep the details.
• Browsing data: traffic statistics, audience-measurement data and advertising data, collected as soon as you arrive on the site; you can refuse them at any time (see “Cookies and trackers”).

3. Purposes and legal bases

Each processing operation rests on a legal basis within the meaning of the GDPR:

• Responding to contact requests (legitimate interest).
• Organizing the appointment you book (pre-contractual steps taken at your request).
• Performing and managing the service contract (performance of the contract).
• Issuing invoices and keeping accounts (legal obligation).
• Measuring site audience and serving targeted advertising, via the cookies described below (you can object to this at any time).

4. Retention period

Data is kept only for the strictly necessary period:

• Contact and appointment data: 3 years from the last exchange (CNIL recommendations).
• Contractual and accounting data: 10 years after the end of the contract (legal obligation).
• Audience-measurement and advertising cookies: 13 months maximum.

5. Recipients and processors

Your data may be processed by technical providers acting on Inleven's behalf, under data-processing agreements compliant with the GDPR:

• Cloudflare, website hosting.
• Stripe, payment processing.
• Web3Forms, routing of contact-form messages.
• Cal.com (Cal.com, Inc., San Francisco, United States), appointment booking: booking window, appointments and confirmation emails. Cal.com processes this data on Inleven's behalf, in the United States, and relies on standard contractual clauses or an adequacy mechanism for its transfer outside the European Economic Area. Your browser connects to Cal.com's servers when you approach a booking button (hover, touch, keyboard) and, on a phone, 10 seconds after you arrive on a page that offers one; Cal.com then sets its own technical cookies (login, preferences, security), with no advertising cookies.
• Google, audience measurement and advertising via Google Analytics 4 and Google Ads, active as soon as you arrive on the site; you can refuse them at any time.
• Meta (Facebook / Instagram), advertising measurement and delivery via the Meta Pixel, which starts at your first interaction with the page (scrolling, tapping or clicking), or four seconds after it is displayed; you can refuse it at any time. If you book the 15-minute call in the Cal.com booking window without having refused the “Marketing and advertising” cookies, our server also sends Meta an “appointment booked” event: your email address, your first and last name and, if you provided it, your phone number, each replaced before sending by its fingerprint (SHA-256 hash), the identifiers set by the Meta Pixel (_fbp and _fbc cookies), the technical description of your browser (user agent) and the address of the page where you opened the window; these identifiers pass through Cal.com with your booking. Purpose: to measure the effectiveness of our advertising on Meta and improve its delivery.
• LinkedIn, advertising measurement via the LinkedIn Insight Tag, which starts at your first interaction with the page (scrolling, tapping or clicking), or four seconds after it is displayed; you can refuse it at any time.
• A professional email service.

Some of these providers are located outside the European Union; transfers are then governed by appropriate safeguards (the European Commission's standard contractual clauses).

6. Cookies and trackers

Strictly necessary cookies. The site uses technical cookies essential to its operation (security, display preferences). They do not require your consent.

Audience-measurement and advertising cookies. The site uses Google Analytics 4 (audience measurement), Google Ads and the other advertising tags loaded by Google Tag Manager, currently the Meta Pixel (Facebook / Instagram) and the LinkedIn Insight Tag, to analyze traffic and serve relevant advertising. Google Analytics 4 and Google Ads are active as soon as you arrive on the site, without waiting for a click on the banner; the Meta Pixel and the LinkedIn Insight Tag start at your first interaction with the page (scrolling, tapping or clicking), or four seconds after it is displayed. You can refuse them all at any time: “Customize” in the banner, or “Manage cookies” in the footer, then “Continue without accepting”. Refusing stops them for the rest of your browsing.

After a refusal, the Meta Pixel and the LinkedIn Insight Tag are no longer loaded: if they already were, the page reloads without them. Google Analytics 4 and Google Ads stop reading and setting cookies and only send cookieless signals. Cookies already set remain in your browser until they expire or until you delete them. Your choice is stored in your browser for your next visits; you can change it at any time.

7. Your rights

In accordance with the GDPR, you have the rights of access, rectification, erasure, restriction, objection, portability, and the right to withdraw your consent at any time. To exercise them: contact@inleven.studio ; a reply is provided within one month.

You may also lodge a complaint with the competent supervisory authority: the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) for the data controller, or, if you reside in France, the CNIL.

8. Security

Inleven implements appropriate technical and organizational measures: encryption of communications (HTTPS), secure hosting, restricted access to data, and regular backups. In the event of a data breach likely to create a risk to your rights, the affected individuals and the competent authority are informed in accordance with the GDPR.

9. Changes

This policy may be updated to reflect changes in processing operations or in regulations. The date of the last update appears at the top of the page. In the event of a substantial change, you are informed by appropriate means.