Legal

Privacy Policy

Last updated: 4 August 2026

Who we are

EM2 d.o.o., Križevačka 11, Osijek, Croatia ([email protected]) is the data controller for personal data processed through this website.

What we collect and why

• Contact / brief form: name, company, e-mail and your project description — used solely to respond to your enquiry and prepare a proposal (legal basis: pre-contractual measures, Art. 6(1)(b) GDPR).
• Project estimator (em2.hr/studio/estimator/): your answers to seven questions, the free-text description of your idea, any document you choose to attach, plus the e-mail address you give us so we can send you the link to your result (Art. 6(1)(b) GDPR). See the section below for where that content is processed.
• Server logs: our hosting provider records IP addresses and requests for security and operations (legitimate interest, Art. 6(1)(f) GDPR).

We do not run advertising trackers, analytics or profiling on this site.

The estimator and what happens to what you type into it

This matters more than anything else on this page, so it is spelled out rather than summarised.

• Your description and any attached document are sent to Anthropic (Anthropic PBC, United States) to generate the estimate. This includes the full text of any PDF you upload. Anthropic acts as our processor for that request.
• Do not upload anything you are not free to share. If your specification is under someone else's NDA, describe the project in your own words instead, or ask us for an NDA first and send the document to us directly.
• The result is stored on our server as a page at an unguessable address, carrying a noindex instruction so search engines leave it alone. It is private, but it is a URL — anyone you forward the link to can open it.
• You can have it deleted at any time by e-mailing us the link. We will also delete the underlying record.

You can use the estimator without giving us any personal data at all beyond the e-mail address for delivery. There is no account and nobody calls you unless you ask.

Cookies and local storage

We set analytics cookies only if you agree. The first time you open the site we ask whether we may use Google Analytics. Until you click “Accept”, nothing is loaded from Google and no cookie is set. “Reject” is just as prominent and the site works exactly the same without consent.

If you accept, Google Analytics 4 sets the _ga and _ga_<ID> cookies (lasting up to 2 years) so we can see which pages are read, where visitors come from and how many start and finish the estimator or send a brief. Google signals and ad personalisation are switched off and we do not use the data for advertising. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time through Cookie settings or the “Cookies” link in the footer; we then delete the Google Analytics cookies.

We remember your choice in browser storage under the name em2consent (just “yes” or “no” and the date) so we do not ask on every page. We ask again after 12 months.

Private estimate pages (/offer/…) never load analytics, whatever you chose.

Beyond that there is one piece of browser storage: a single sessionStorage entry named em2pre, set to 1 once the intro animation has played, so it does not replay on every page you open. It contains no identifier and nothing personal, it is never sent to us and your browser discards it when you close the tab. Under the ePrivacy rules this is strictly necessary functional storage, which does not require consent — but you should know it is there.

You can clear it at any time through your browser's site-data controls and blocking it entirely only means the intro animation plays again.

Processors and third parties

• Anthropic PBC (United States) — generates estimates from what you enter in the estimator, as described above.
• Resend — delivers the notification e-mail when you submit the brief form, so your message reaches us.
• Google Ireland Ltd. — Google Analytics 4, only if you consented (see Cookies above). Google may transfer the data to the United States under the EU–US Data Privacy Framework.
• Cloudflare, Inc. — the network in front of our site that delivers it and protects it from attacks, plus the Turnstile check the estimator uses to tell people from bots. Turnstile sets no tracking cookies.
• Our hosting provider — operates the server and keeps the access logs.

Transfers outside the EEA are covered by the transfer mechanism in our agreement with the processor concerned; write to us if you would like the specifics for your case.

Nothing else loads from a third party. The Montserrat typeface is served from our own server, so opening a page here does not announce your visit to Google or anyone else. Links to Calendly, Clutch, the App Store, Google Play and our clients' own sites are ordinary links — nothing is requested from those services until you click and once you do, their privacy policies apply on their sites.

Retention

Enquiry and brief data is kept for as long as needed to handle your request and any follow-up engagement, then deleted. Estimator results stay available at their private link so you can come back to them and are deleted on request. Accounting records are retained as required by Croatian law.

Your rights

Under the GDPR you may request access, rectification, erasure, restriction, portability, or object to processing — write to [email protected]. You may also lodge a complaint with the Croatian Personal Data Protection Agency (AZOP).

Questions about any of this, or want something deleted? One e-mail to [email protected] is enough — you do not need to fill in a form to ask us to delete a form.