Nothing on this site is sold, shared for advertising or used to build a profile of you. There are no cookies, no advertising pixels and no third-party trackers. Each section below covers one thing the site does with personal data.
Who is responsible
The controller of your data is Dmytro Lobodiuk, who works as Dmytro Lobod, self-employed (autónomo) in Spain, Av. d'Eduard Maristany, 7, 08019 Barcelona, Spain. For anything about your data write to Dima@lobods.com. There is no data protection officer: Dmytro answers questions about your data himself.
Only Dmytro reads the briefs and messages that reach the site. The companies listed under "Who processes the data, and where" store or carry them for him, under contract, and do nothing else with them.
When you send a brief
What is kept. Your name, your email address and your company, which every full brief asks for; every answer you gave; and the details you chose to add where a brief asks for them: a phone or WhatsApp number, a website, a budget, your role in the decision; in the AI visibility brief the website is required. The short form on the home page counts as a brief on this page: instead of a company it asks for your website or one line about the business, and it keeps your answer to "What do you need?", the task, your budget if you give one, and how you want the reply (email, WhatsApp or a call), with a phone number only if you pick WhatsApp or a call. With them, the language of the page, the page address and the time it arrived.
Why, and on what basis. To answer you with a quote or the questions that stand before one, and, if you go ahead, to do the work. You asked for that answer, so the basis is taking steps at your request before a contract (GDPR art. 6(1)(b)).
Where it goes. The brief is stored in the site's data store at Netlify, then emailed to Dmytro's mailbox through Resend, and a copy goes through Resend to the address you typed in, so you have it too. If the site cannot confirm that the brief was stored, or the email to Dmytro is late, your browser also sends the same brief through Netlify Forms as a backup; Netlify checks every form submission for spam with Akismet. If you ask for a reply on WhatsApp or by a call, your number is used only for that reply; on WhatsApp, WhatsApp handles the conversation under its own policy (see below).
Nothing you type leaves your device until you press Send. Until then the draft stays in your browser only; the cookies page says how long. The short form keeps nothing in your browser: what you type stays in the fields until you send it or close the page.
When you subscribe to the letters
What is kept. Your email address, the language you subscribed in, the page you subscribed from, your name if you gave it, where you stand (waiting for confirmation, subscribed, left) with the dates, and a record of consent: the time, IP address and browser of the sign-up, of the click that confirmed it and of the unsubscribe.
Why, and on what basis. To send you the letters you asked for. The basis is your consent (GDPR art. 6(1)(a)), given twice: once in the form and once by clicking the link in the confirmation email. No letter goes out before that click, apart from the email that asks for it. The record of consent is kept so it can be shown that you gave it (GDPR art. 7(1)).
Leaving. Every letter has an unsubscribe link at the bottom that works in one click, and mail apps that offer their own unsubscribe button use the same link. You can also write to the address above. Withdrawing consent does not affect what was sent before.
The visit counter
The site counts its own visits, without cookies and without any analytics company. When a page opens, and when you use a WhatsApp button, open or send a brief, subscribe or jump to the Stadami app, your browser sends the site: the page address, the event, the site you came from (its name only, not the full address), the page language, whether the screen is a phone, tablet or desktop size, for a button which one it was, and for a sent brief which brief it was (for the short form on the home page, your answer to "What do you need?").
The visitor hash. To count visitors and not only page views, the site turns your IP address and browser into a hash with a random value that changes every day and is deleted when the day ends (UTC). The record keeps only that hash, never the address or the browser. Once the day's value is deleted, nobody, Dmytro included, can work out from an IP address which hash it produced, so one day's records cannot be linked to another day's or to a person.
Why, and on what basis. To know which pages are read and which buttons are used, so the site can be improved. The basis is legitimate interest (GDPR art. 6(1)(f)): the counter keeps the least that answers those questions. If your browser sends Do Not Track, nothing is sent. Automated visitors are not counted.
Protection against abuse
So that a script cannot use the forms to send email on demand or flood the data store, the site counts how many requests one address makes in an hour. The counter key is a hash of the IP address with the same daily random value, and the counter is deleted within two days. The basis is legitimate interest (GDPR art. 6(1)(f)) in keeping the site and its mail working.
When an address unsubscribes, bounces or reports a letter as spam, a one-way hash of it stays on a suppression list so that no letter reaches it again, even after everything else about it is deleted. The basis is the same legitimate interest, and it is how a "stop" is honoured.
Hosting, logs and links you follow
The site is hosted by Netlify, which serves the pages and runs the small programs behind the forms. To deliver any page it handles your IP address, your browser and the address you asked for, as every web host does (GDPR art. 6(1)(f)). The logs of those programs are kept by Netlify for up to seven days, depending on the plan; the site's own code writes error messages and counts there, not the text of a brief.
Everything a page loads comes from lobod.rocks itself, so no other site sees your visit.
WhatsApp, email, LinkedIn, Instagram, lobods.com, stadami.com and the app stores are plain links. Nothing reaches them until you click. If you write on WhatsApp, WhatsApp (WhatsApp Ireland Limited, part of Meta) handles that conversation as a controller in its own right, under its own policy; Dmytro sees the messages you send.
The pages at /pecado and /luxuryandco are separate projects hosted by Vercel, with their own scripts; this policy does not cover them, and questions about them go to the same email address.
How long each thing is kept
| What | Kept for | Then |
|---|---|---|
| A brief, as stored by the site | 2 years from the day it arrives | deleted automatically |
| A brief in Dmytro's mailbox or files | 2 years | deleted |
| The backup copy of a brief in Netlify Forms | up to 30 days | deleted by Dmytro, by hand |
| Messages and delivery logs at Resend | 30 days | deleted by Resend |
| A subscriber's address, name, language and record of consent | until you unsubscribe, mark a letter as spam, the address stops accepting mail, or you ask for erasure | deleted within a day; only the hash on the suppression list stays |
| A sign-up that was never confirmed | 30 days, as long as the confirmation link works | deleted automatically |
| The address on the record of a letter sent | 30 days after the sending ended, or less if the subscriber's record is deleted first | removed automatically; the hash stays |
| Counter records | 13 months | deleted automatically |
| The day's random value behind the hashes | until the end of that day (UTC) | deleted automatically |
| Abuse counters | up to 2 days | deleted automatically |
| Netlify's logs of the site's programs | up to 7 days | deleted by Netlify |
| The draft of a brief in your browser | until the brief is confirmed as sent, or 30 days from your last change | deleted by the site the next time you open one of its pages |
Who processes the data, and where
These companies process data for the site under data processing agreements, only to provide their service:
| Who | What for | Where | Safeguard for the transfer |
|---|---|---|---|
| Netlify, Inc. | hosting, the programs behind the forms, the data store, Netlify Forms | United States (the data store is in the us-east-2 region); pages are served from Netlify's worldwide network | EU-US Data Privacy Framework; standard contractual clauses in Netlify's data processing agreement |
| Akismet, by Automattic Inc. | spam check of Netlify Forms submissions, used by Netlify | United States | EU-US Data Privacy Framework; standard contractual clauses |
| Resend | sending the letters and the brief emails | United States | standard contractual clauses in Resend's data processing agreement; EU-US Data Privacy Framework |
| Google (Google Workspace) | the mailbox of Dima@lobods.com, where briefs and replies arrive | Google's data centres, including the United States | EU-US Data Privacy Framework; standard contractual clauses in Google's data processing terms |
The United States is outside the European Economic Area. The European Commission's adequacy decision for the EU-US Data Privacy Framework covers certified companies, and the standard contractual clauses are the European Commission's own model contract. Write to the address above for a copy of the safeguards.
Your rights
You can ask to see the data held about you, to have it corrected or deleted, to have its use restricted, to receive what you gave in a reusable format, and you can object to any use based on legitimate interest, including the counter. Where the basis is consent, you can withdraw it at any time.
Write to Dima@lobods.com, ideally from the address the data is about, and say what you want. You get an answer within one month, free of charge. If it is not clear the request comes from you, you may be asked to confirm it from that address.
The counter records hold no IP address and no name, and the value that made their hashes is deleted every day, so once the day is over they cannot be matched to you and a request cannot reach them (GDPR art. 11). To stay out of them, turn on Do Not Track in your browser.
If you think your data is mishandled, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (C/ Jorge Juan, 6, 28001 Madrid, aepd.es), or to the authority of the EU country where you live. Writing to the address above first is often faster.
What is required, and what is not
No law and no contract requires you to give any data. Of your own details, a full brief needs only your name, email and company, because without them there is nobody to answer, and the AI visibility brief also needs your website; a phone number, a budget and your role are optional. The short form needs your name, your email, your website or one line about the business, what you need and the task; a phone number only if you want the reply on WhatsApp or by a call; the budget is optional. Some questions about the project itself must be answered before a brief can be sent, and the brief marks them with an asterisk. The letters need an email address. The counter needs nothing from you.
No decision about you is made automatically, and nothing here is used to profile you.
Changes to this page
When what the site does with data changes, this page changes first, and the date at the top moves with it.
