Privacy Policy

1. Who we are

Pageree is operated by Aleksandr Shelestov PR JustOneDev, Jurija Gagarina 231, Novi Beograd, 11070 Belgrade, Serbia, PIB (tax identification number) 113504102. In this policy, “Pageree,” “we,” and “us” refer to that operator.

This policy covers our marketing website, account console, Model Context Protocol (MCP) service, support, and landing-page hosting and lead-collection features. Our Terms of Use describe the service agreement. Payment features apply only when made available under a separately accepted order.

For account administration, billing where enabled, proportionate platform security, and our own business communications, we determine how and why information is used. When a customer uses Pageree to collect inquiries or measure visits to its landing pages, the customer determines the purpose and Pageree processes information on its behalf under our Data Processing Agreement. A customer acting for another business must have authority from that business.

The business’s own privacy notice explains its use of your inquiry and subsequent communications. This policy does not replace that notice. Contact the business shown on the landing page, or ask [email protected] for help routing a request.

2. Information we handle

The information involved depends on which features you use:

Website visits

Network and security information needed to deliver the website, such as your IP address, requested URL, browser information, time, and security events. Our marketing site serves its fonts and illustrations locally.

Accounts and sign-in

Email address, username, password hash where password login is used, account and role identifiers, and authentication records. Optional Google sign-in uses basic profile information such as your identifier, name, email, and profile picture; it does not request access to Gmail messages, contacts, or Drive files.

Connected agents and page creation

Client and authorization details, tool requests and results, page instructions, content and versions, uploaded and generated assets, image prompts and generation metadata, domains, and publishing configuration.

Lead submissions and form choices

Fields a visitor submits, such as name, email, phone number, company, or message; page and form identifiers, submission time, delivery status, IP address, user agent, referrer, and approximate country where available. Configured consent records can include checkbox choices, the wording and policy version presented, timestamps, and request metadata.

Customer landing-page analytics

Page and session identifiers, URLs and query parameters, referrers, browser and device information, screen dimensions, approximate country, visits, section engagement, clicks, and form-submission events. Click records may include the clicked element’s text and attributes. These records are not necessarily anonymous.

Support and diagnostics

Messages, contact details, privacy-request verification records, relevant account or page information, and errors and performance data with technical context. Console session replay is excluded from our configuration; error and performance monitoring is separate.

Trials and billing

When payment features become available, these can involve trial status, billing contact and tax information, customer and subscription identifiers, orders, payment status, amounts, currency, invoices, cancellation, refund, and dispute records. Dodo Payments is the selected merchant of record for that future workflow. No payment data is collected merely by reading these pages or agreeing to the service documents.

Do not put passwords, authentication tokens, card details, or unnecessary personal information in page URLs, public content, image prompts, or lead forms.

3. Why we use information

We use information to provide requested features, authenticate users, administer accounts and subscriptions, deliver service communications, respond to requests, troubleshoot problems, detect abuse, protect the service, and meet legal obligations.

For customer-controlled information, we carry out the customer’s instructions, including publishing a page, delivering submissions to configured destinations, and producing page analytics. A submitted inquiry does not authorize us to use that person’s details for unrelated marketing.

Pageree does not send promotional emails. Account verification, security notices, support replies, receipts, and required billing notices are operational communications. A customer’s follow-up messages and an independent provider’s communications are governed by their own notices and applicable law.

Where a legal basis is required, we use contract necessity for services requested by an individual customer; legitimate interests for business-contact administration, support and proportionate fraud/security prevention; legal obligations for required records and responses; and consent where a particular activity requires it. Our interests are balanced against the person’s rights and reasonable expectations. You may object to processing based on legitimate interests.

The customer determines the lawful basis for its leads and analytics. Accepting this policy or checking that you have read a notice is not blanket consent, and a customer’s contract with Pageree is not automatically a lawful basis for every visitor’s information. Refusing optional marketing must not prevent an ordinary inquiry.

4. AI agents and generation

A connected agent sends Pageree the information needed for authorized tool requests and receives tool results. Connecting does not give Pageree your entire conversation; we receive what your client sends. Information returned to the client is also handled under that client provider’s terms and privacy settings.

Image generation can send prompts to an external AI provider. We store generated assets and associated prompts, model information, and creation times. Automated content checks can send extracted page text, metadata, links, and image references to an AI provider.

Requested generation and content checks use the applicable AI provider identified in the Subprocessor Register. Do not include unnecessary personal information in prompts or public page content. Private lead payloads are not sent to the content-moderation or image-generation tools. The provider’s applicable terms and account settings govern its processing; this policy does not promise universal zero retention or describe your independent AI client’s practices.

Automated moderation can flag content or restrict publication. Contact [email protected] to request review of a restriction.

5. Providers and other recipients

Information can be received by providers needed to operate the service, your authorized users and connected agents, and the business receiving a lead and its chosen email, webhook, or CRM destination. Public page content is accessible to visitors and may be copied by search engines or others.

The service’s provider inventory includes:

• Cloudflare: global delivery and storage of pages and assets, routing, security, and Cloudflare Email Service when configured for operational and lead emails. Turnstile protects account and privacy-request initiation forms; customer landing-page forms remain CAPTCHA-free.
• DigitalOcean, LLC: application servers and database hosting in the EU.
• OpenAI: requested image generation and content checks. A different compatible provider must be identified and reviewed before it handles customer information.
• Sentry: error and performance monitoring, with console session replay disabled in the configuration.
• Google: optional account sign-in.
• Dodo Payments: merchant of record for purchases; it receives purchaser and transaction details when you subscribe or manage a subscription. It does not receive page content or leads.

Dodo acts as an independent controller for its own merchant-of-record purposes; not all its activities are performed solely on our instructions. Its Privacy Policy and Data Processing Agreement explain those roles. The applicable Dodo entity is identified in the checkout and transaction documents. Deletion of Pageree records does not necessarily require Dodo to erase records it must retain independently.

Cloudflare’s Turnstile Privacy Addendum describes both bot-protection processing and its own use of signals to improve detection.

We may also disclose information to advisers or authorities for lawful requests, legal obligations, security, or the protection of rights, or in connection with a business transfer subject to applicable safeguards.

The Subprocessor Register identifies each role, data scope, location information and provider reference. Providers used for Pageree accounts are not automatically recipients of every customer form submission. Changes to subprocessors handling customer-directed data follow the notice and objection process in the DPA.

6. Cookies and browser storage

Our website, console, and customer pages have different storage and tracking behavior. The console stores an authentication token and appearance preference in browser local storage. These have no fixed browser expiry; server-side token validity is separate. Clearing browser storage removes local items and may sign you out or reset preferences.

The console also sets a 365-day cookie intended to exclude an account owner’s own visits from page tracking. This is not a general visitor privacy opt-out. Customer-page analytics uses session events and browser information; bot-protection services also process browser and network signals.

The current analytics implementation does not automatically honor Do Not Track or Global Privacy Control signals. Blocking cookies or clearing storage does not necessarily stop analytics network requests. We do not sell personal data or use it for cross-context behavioral advertising. Contact [email protected], or the page-owning business, about an objection or restriction request.

Where applicable law requires prior consent or an opt-out mechanism for analytics, collection must remain disabled until an appropriate control is available. A cookie-free design does not establish an exemption. Customer page owners must disclose and lawfully configure any additional scripts and practices.

7. Data retention

The schedule below limits ordinary retention. Lead submissions, privacy-request records, MCP authorization records and authentication records are expired automatically by the database once their period ends. The remaining periods — analytics aggregates, operational logs and backups, and support correspondence — are operating commitments we apply rather than automatic deletions. Database expiry is asynchronous rather than guaranteed at an exact second.

Lead submissions: 30 days after capture

Lead payloads, delivery metadata, and attached consent evidence are scheduled to expire after 30 days, including successfully delivered leads. A valid earlier deletion request can shorten this period.

Privacy-request records: 365 days after creation

Verification links expire after 24 hours. Link expiry does not itself delete the request record.

MCP authorization records

Authorization codes expire after 10 minutes, access tokens after one hour, and refresh tokens after 30 days from issue. Token records are scheduled for deletion at the later token expiry. Refreshing may create a new record with a new expiry.

Account profiles and authentication

While needed for the account. Access is revoked promptly on confirmed closure, and ordinary profile and session records are deleted from active systems within 30 days. Valid legal-record exceptions are handled separately.

Pages, versions, assets and image prompts

While the page/account is active; unpublish promptly on confirmed deletion or closure and delete associated active-system content within 30 days. An asset still used by another active page is retained for that use.

Raw analytics sessions, events and form-event facts

No more than 7 days from the event, with earlier deletion once necessary aggregation is complete and individual records are no longer needed.

Aggregate analytics

Up to 13 months from the measured period, or deletion within 30 days of page/account deletion if sooner. Customer-linked aggregates remain protected; “aggregate” does not automatically mean anonymous.

Routine logs and diagnostics

30 days from the event. Unnecessary identifiers, credentials and content are excluded; a limited subset relevant to a documented incident may be retained separately with a review date.

Ordinary support correspondence

12 months after resolution, with unnecessary attachments deleted sooner.

Backup copies

A maximum snapshot lifetime of 30 days. Restores must reapply deletion instructions before data returns to ordinary use. Deletion from active systems within 30 days followed by backup expiry can take up to 60 days in total.

Records specifically needed for a legal obligation, an unresolved dispute, or evidence of an agreement are restricted to that purpose and retained only for the applicable statutory or justified period. They do not justify retaining entire pages or lead payloads. Financial-record periods will be specified for the payment workflow before it is enabled. We review holds and delete records when the reason ends.

Copies delivered to an inbox, CRM, webhook, or AI agent follow that recipient’s retention practices. Removing a Pageree lead does not delete those copies. Public content may remain in third-party caches after removal.

8. International processing

Our operator is based in Serbia. Listed application infrastructure is in Germany and database infrastructure is in the EU, while Cloudflare operates a global edge network. Providers, operator access, connected agents, and customer-selected destinations can involve processing outside your country. An EU database location does not mean all processing stays in the EU or EEA.

Before a restricted transfer, the relevant parties must establish an applicable safeguard, such as a recognized adequacy decision or executed standard contractual terms with necessary assessments and supplementary measures. Our DPA requires this; publishing a provider link does not execute transfer terms or establish adequacy. Contact [email protected] to request information about the safeguards for a particular arrangement.

9. Your choices and rights

Depending on applicable law, you may have rights to access, correct, delete, or receive a portable copy of information; restrict or object to processing; withdraw consent for future processing; and complain to a regulator. Withdrawing consent does not change the lawfulness of earlier consent-based processing. We will not unlawfully discriminate against you for exercising your rights.

Send requests to [email protected] with enough context to identify the relevant account or page. We may need proportionate identity or representative verification. We will explain applicable limitations and respond within the legal deadline. Do not send identification documents unless we explain why they are needed and how to send them safely.

For a lead submitted to a customer’s page, use that page’s privacy-request link where supplied, contact the business, or ask us to route your request. Our public form sends a verification email; opening its link only previews the request. Access or erasure requires a further action, and erasure requires an explicit confirmation. The search covers matching email-address leads across that customer’s account, not other customers. A form without an email field requires assistance through the business or our privacy contact.

This flow handles retained leads. It does not close your Pageree account, erase all analytics records, or delete copies already delivered to a mailbox or CRM. Requests outside its scope receive individual handling. You may request a review of a privacy decision at [email protected]; this does not prevent a regulator complaint or pause an applicable legal deadline.

You can complain to Serbia’s Commissioner for Information of Public Importance and Personal Data Protection; contact details are on the Commissioner’s website. Where applicable, you can also contact the competent regulator in your country. You do not have to contact us first.

10. Security and age limits

No online system can guarantee absolute security. Protect account credentials, review connected-agent permissions, and limit the personal information included in public content and prompts. This policy does not claim any security certification or compliance approval for regulated information.

You must be at least 18 to create or use a Pageree account. Pageree is not designed as a children’s service. Customer forms must not knowingly collect children’s information or sensitive regulated information without a separately approved, legally compliant arrangement. If you believe a child has provided information, contact [email protected].

11. Policy changes

We identify the applicable policy version and effective date when it is published for service use. Material changes receive additional notice or consent where required by law. A revised policy does not retroactively authorize incompatible uses of previously collected information.

12. Contact us

• General: [email protected]
• Support and billing: [email protected]
• Privacy requests: [email protected]
• Legal notices: [email protected]
• Content reports: [email protected]