Privacy Policy

Last updated: September 2026

1. Data Controller

The data controller for personal information collected through kon-tiki.dev is Kvik, a sole proprietorship (obrt) registered in Croatia, operating the Kon-Tiki brand and products. For any privacy question, GDPR request, or security concern, contact admin.kontiki@gmail.com.

2. What Data We Collect

• Purchase: email address, and payment details processed entirely by Stripe. Kon-Tiki does not store card information.
• Checkout gate (some pages): first name and email entered before checkout, used only to personalize the buying flow. This information is not stored on our servers and is not added to any mailing list automatically.
• Content delivery: email address needed to send you the link to your purchased guide or system.
• Technical data: IP address, browser type, device type, and session identifiers collected automatically when you visit the site.
• Session analytics: Microsoft Clarity records anonymized on-page behavior — clicks, scrolling, and general navigation patterns — to help us understand and improve the pages. We configure Clarity to mask sensitive form fields where technically possible.
• Page analytics: Vercel Analytics collects aggregate, cookieless visit counts and page views. No individual profile is built from this data.

3. Legal Basis for Processing

• Contract performance — processing needed to fulfil your purchase and deliver the product you bought.
• Legitimate interest — system security, fraud prevention, and improving the site based on aggregate usage patterns.
• Consent — where required for optional communication outside of transactional messages.

4. How We Use Data

• To process your purchase and deliver access to what you bought.
• To send transactional email — purchase confirmation and access links.
• To understand which pages and content work, using aggregate, largely anonymized analytics.
• To protect the site against abuse and misuse.

5. Storage and Security

Data is stored with providers operating industry-standard security controls. All traffic to and from kon-tiki.dev is encrypted via HTTPS/TLS. Payment data is handled exclusively by Stripe and never touches our own servers. Access to any data we do hold is limited to what is necessary to run the site.

6. Third-Party Processors

• Stripe — payment processing.
• Vercel — hosting, infrastructure, and privacy-friendly page analytics.
• Microsoft Clarity — anonymized session behavior analytics (heatmaps, session patterns) to improve page design.
• ManyChat / Meta — if you interact with our Instagram automation (commenting a keyword to receive a free guide), Meta and ManyChat process your Instagram interaction to deliver that message, under their own respective privacy policies.
• Google Drive — used to host and deliver purchased and free content via shareable links.

7. Your Rights

Depending on your location, you may have rights including:

• the right to access the personal data we hold about you,
• the right to correct inaccurate or incomplete data,
• the right to request deletion, where applicable,
• the right to data portability,
• the right to object to processing,
• the right to withdraw consent at any time.

To exercise any of these rights, email admin.kontiki@gmail.com.

8. Cookies and Tracking

Vercel Analytics is cookieless by design. Microsoft Clarity uses first-party cookies to distinguish sessions and may record on-page interaction for product-improvement purposes. No advertising or cross-site tracking cookies are set by Kon-Tiki itself.

9. Data Retention

Data tied to an active purchase is retained as long as reasonably needed to support that purchase, or until deletion is requested. Transaction records may be retained longer where required by tax or accounting law. Following a deletion request, data is removed within 30 days, except where retention is legally required.

10. Minors

Kon-Tiki is not directed at individuals under 18. If we learn that a minor has made a purchase or provided data, we will take reasonable steps to restrict or delete that data.

11. Changes to This Policy

This Privacy Policy may be updated from time to time. Material changes will be posted on this page and, where applicable, communicated by email at least 30 days before taking effect.

12. Supervisory Authority and Contact

EU residents have the right to lodge a complaint with the Croatian Data Protection Agency (AZOP), available at azop.hr. For any privacy question, email admin.kontiki@gmail.com.