Legal
Privacy Policy
1. Who's behind this site
filipsardi.com is operated by Filip Sardi, trading through Lansiraj d.o.o., based in Croatia. For all privacy questions, contact filip@filipsardi.com.
2. What data we collect on filipsardi.com
This is the marketing and writing surface of Client Flow. The data flows here are intentionally minimal:
- Newsletter signup: first name (optional) and email address, plus the page you signed up from. Used to send you the weekly Client Flow letter and add you to our newsletter platform.
- Contact form (letter pages): name, email address, your message, and the page you wrote from. Sent to Filip's inbox via Web3Forms.
- Flow Collective application: name, email, what you sell, where momentum is breaking, track preference, optional start-date and notes. Sent to Filip's inbox via Web3Forms.
- Lab Skills result: if you choose to send Filip the result of a skill you ran, the result you paste, your name, and the email or Instagram handle you give. Used only to reply to you. It is added to no list.
- VIP Day enquiry: name, email, team size, what you'd want built, optional date and notes. Sent to Filip's inbox via Web3Forms.
- Analytics: aggregate page views, traffic sources and the actions above (a signup, an application, a message; never their content) via Vercel Web Analytics (cookieless, no personal identifiers).
If you use FlowOS at lab.filipsardi.com, that's a separate product with its own data flows. See the FlowOS privacy policy.
3. How we use your data
- Send you the weekly Client Flow letter (newsletter signups only)
- Reply to your message (contact and application forms)
- Understand which letters and pages resonate (aggregate analytics only)
- Measure and improve our ads on Facebook and Instagram (in Europe only with your yes; see §5)
We don't sell or rent your data. The only sharing for marketing is with Meta, for ad measurement, as described in §5.
4. Where your data is stored
- Newsletter list: MailerLite (EU-based provider, GDPR-compliant)
- Newsletter mirror queue: Cloudflare KV (used internally to track which subscribers still need to be added to Substack - see §5)
- Substack subscriber list: Substack Inc. (US-based; we add new MailerLite subscribers to Substack manually so you receive both the newsletter and the public archive)
- Form submissions: Web3Forms (relays to Filip's inbox; Web3Forms does not retain submissions long-term)
- Lab Skills results: delivered to Filip as a private Telegram message (Telegram Messenger Inc.) and kept there; not stored on this site
- Email inbox: Google Workspace
- Analytics: Vercel Web Analytics (Vercel Inc., cookieless)
- Ad measurement: Meta Platforms Ireland Ltd, only with your consent
5. Cookies and tracking
For every visitor, without cookies: Vercel Web Analytics counts page views and the actions above. It sets no cookies and keeps no personal identifiers: a visitor is recognised for one day only, by a code that resets every 24 hours.
The Meta Pixel and the Meta Conversions API. In the EU, the EEA, the UK and Switzerland they run only if you click Accept in the cookie bar. Everywhere else they run from your first page view unless you switch them off with Cookie settings, or your browser sends a Global Privacy Control signal, which we treat as a no. To know which applies, we look up the country your connection comes from (from your IP address, which we do not store). When they run, Meta Platforms Ireland Ltd receives the pages you visit and the actions above, with your IP address, your browser's user agent, Meta's cookies (_fbp, _fbc) and, when you sign up or send a form, your email address turned into a one-way code (SHA-256) on our server before it is sent. We use this to measure and improve our ads on Facebook and Instagram. How Meta uses data is in Meta's privacy policy. In Europe the legal basis is your consent (GDPR Art. 6(1)(a)).
Your choice is kept in a cookie called fs_consent for 180 days, and the country answer in fs_consent_region for 7 days. Change it any time with Cookie settings (also at the bottom of every page). Saying no stops the pixel and deletes Meta's cookies. After a no, nothing is sent to Meta.
Other cookies: only essential ones set by Cloudflare for security (DDoS protection, bot mitigation).
6. Your rights (GDPR)
If you're in the EU/EEA you have the right to:
- Access: request a copy of any data we hold about you
- Rectification: correct inaccurate data
- Deletion: request permanent removal of your email and any associated data from MailerLite, Cloudflare KV, Substack, and Filip's inbox archive
- Export: receive your data in a portable format
- Object: object to specific processing
- Unsubscribe: every letter has an unsubscribe link, instant and one-click
To exercise any of these, email filip@filipsardi.com. We respond within 30 days, usually within 48 hours.
7. Data retention
We keep your data for as long as you're subscribed or actively in conversation with us. After unsubscribe or deletion request, your data is permanently removed within 30 days. Aggregate, anonymised analytics may be retained beyond that period.
8. Children
filipsardi.com is intended for business owners and professionals. We do not knowingly collect data from anyone under 18.
9. Changes to this policy
If we materially change how data is collected or used, we'll update this page and the "Last updated" date at the top. Significant changes are also communicated via the newsletter.
10. Contact
For any privacy-related question, email filip@filipsardi.com.