Privacy Policy

1. Who we are

TessaLun ("we", "us") is a design, web and AI studio. The operator responsible for your personal data is TessaLun obrt, OIB 43045606650, Wickerhauserova ul. 12, 10000 Zagreb, Croatia. Contact: hello@tessalun.com.

2. What data we collect

• Contact form: your name, email, the services you are interested in and the text of your message.
• Account (scanner): your email address; if you sign in with Google — your name, Google account ID and profile picture; your language; the date of registration and last sign-in.
• Scans: the website addresses you submit and the results of the scan.
• Purchases: order details (product, amount, date, status). Card and payment details are processed by our payment provider Stripe; we never see or store your card number.
• Technical data: approximate country (from your IP address), a one-way hash of your IP address (for abuse protection and rate limits), browser user agent, referral source and campaign tags (UTM).
• Consents: whether you agreed to the Terms and to marketing emails, with the date and the version of the text.

3. Why we use it (and the legal basis)

• To reply to your request and prepare an estimate — steps at your request before a contract / legitimate interest.
• To create your account, sign you in and deliver scan results and reports — performance of a contract.
• To protect the service from spam and abuse (Cloudflare Turnstile, rate limits) — legitimate interest.
• To send you a personal follow-up about your own scan or request — legitimate interest; you can object at any time.
• To send tips and offers — only with your separate consent, which you can withdraw at any time.
• To keep accounting records of purchases — legal obligation.

4. How long we keep it

• Contact requests: up to 24 months after our last communication.
• Accounts and scan history: while your account exists; deleted within 30 days after you ask us to delete it.
• One-time sign-in codes: deleted after use or within 24 hours.
• Purchase records: as long as tax and accounting law requires.
• Consent records: as long as needed to prove consent, and up to 3 years after withdrawal.

5. Who processes data for us

We share data only with providers that help us run the service:

• Cloudflare (hosting, database, bot protection, privacy-friendly analytics without cookies);
• Google (sign-in with Google; PageSpeed Insights, which receives the website address you scan);
• Resend (sending emails such as sign-in codes and reports);
• Telegram (internal notifications to our team about new requests and sign-ups);
• AI providers Anthropic (Claude) and Perplexity AI (receive the website address and public page content to analyse visibility; not your account details);
• Stripe (payment processing).

Some providers are located outside your country, including the USA. Where required, transfers are protected by standard contractual clauses or equivalent safeguards. We do not sell your data.

6. Cookies

We use only necessary cookies: a session cookie to keep you signed in, a language cookie to remember your language, and cookies set by Cloudflare Turnstile for bot protection. Our analytics do not use cookies.

7. Your rights

You can ask us to access, correct, delete or export your data, to restrict or object to its processing, and to withdraw consent at any time. Write to hello@tessalun.com — we answer within 30 days. Every marketing email has an unsubscribe link. You can also complain to your data protection authority — in Croatia this is the Personal Data Protection Agency (AZOP, azop.hr), or the supervisory authority of the EU country where you live.

8. Children

The service is not intended for people under 16.

9. Changes

If we change this policy, we will update the date above and, for important changes, notify signed-in users by email.