Privacy notice

Who we are

This notice covers karu.host and the one form on it — the form where you ask us for a call about building your booking site. If you are a guest booking a stay with a business that runs its site on Karu, this is not the notice you want: that business holds your booking and publishes its own notice on its own site.

Awesome Enterprise OÜ is the data controller for everything described on this page — the one responsible for it, and the one you hold to account.

Awesome Enterprise OÜ
Registry code 14062648 · VAT number EE101954149
[REGISTERED ADDRESS NOT YET CONFIRMED — placeholder, see the comment on KARU_IDENTITY]
info@karu.host

What this notice covers — and what it does not

It covers this website, karu.host, and one thing on it: the form where you ask us for a call about building your booking site. That is the only place karu.host asks you for anything.

If you are a guest booking a stay, and you arrived here because the business you are booking with runs its site on Karu — that business holds your booking, decides what happens to it, and publishes its own privacy notice on its own site. Where we are involved at all, we act on that business’s instructions and not on our own. Ask them, and they can ask us.

What we collect when you book a call

Three things, because three is what the form asks for:

• Your name — so we know who we are writing back to.
• Your email address — so we can write back.
• A short note about your business, if you choose to write one. It is optional and capped at 500 characters.

Please keep that note to your business. It is there for “six cabins, currently on Booking.com, want my own site” — not for health information, personal circumstances, or anyone else’s details. We do not ask for that, we have no use for it, and the form is deliberately built without the kind of open-ended box that invites it.

We do not sell your details, we do not add you to a mailing list, and we do not pass them to anyone beyond the companies listed further down, all of which are working for us rather than for themselves.

Why we are allowed to hold it

GDPR wants a specific reason for each purpose, and does not let one reason be smuggled in under another. We have two, and they stay separate:

• Answering your enquiry — steps taken at your request before a possible contract (Art. 6(1)(b)). There is no tickbox for this, and there should not be: asking us for a call is the request. If you would rather we had never had your details, say so and we will delete them.
• Keeping the form from being abused — our legitimate interest (Art. 6(1)(f)) in not having our inbox flooded by bots. Detail below.

There is no marketing consent here, because there is no marketing list. We reply to your enquiry and that is all. If we ever start a newsletter it will be a separate, unticked box, asked for on its own, withdrawable at any time, and with no effect either way on an enquiry you have already sent.

How we keep the form from being flooded

The form carries a hidden field that a person never sees and a bot usually fills in, and it checks how long the page was open before submission — a form completed in under a second was not completed by a human. Neither of these collects anything about you.

Where the form is deployed with a bot-check configured, it also runs Cloudflare Turnstile — the same company that hosts this site, listed below — before the submission reaches us. Turnstile is invisible in the normal case; it never shows you a puzzle unless your traffic looks automated.

Your IP address reaches us the way it reaches every website you visit: it is part of how the request gets to the server. We use it to rate-limit the form so the same source cannot hammer it. Where the system keeps any record of it for that purpose, it keeps a salted one-way hash rather than the address itself — which is enough to recognise a repeat flood and not enough to reconstruct where you were.

Where it goes

Your enquiry is stored in the EU, and three companies touch it. All three are working on our instructions:

• Cloudflare — hosts this site and the database your enquiry is written to (Cloudflare D1), created in the EU region.
• Resend — sends the single notification email that tells us an enquiry has arrived.
• The provider that hosts our info@karu.host mailbox — because that notification email has to land somewhere, and our reply to you leaves from there.

Nobody else receives it.

How long we keep it

If we do not end up working together: we do not keep your enquiry beyond 12 months after we last heard from you. Not twelve months after you first wrote — twelve months after the last contact either way, so a conversation that goes quiet and picks up again later starts the clock over.

How that deletion actually happens, today. It is done by hand. This site has no scheduled job that sweeps old enquiries out on the twelve-month mark — the code that performs the deletion exists, but nothing calls it on a timer yet, so the twelve months is a commitment we keep rather than a clock a machine keeps for us. We would rather say that than let the sentence above imply a machine you cannot see. If you would rather not wait for us to get to it, write to info@karu.host and we will delete your enquiry straight away.

If we do end up working together: we keep what the work requires for as long as the engagement runs. Invoices and the accounting records attached to them are kept for seven years, because Estonian accounting law requires it. Those are amounts and dates.

One honest note on deletion. Cloudflare D1’s point-in-time-restore feature (“Time Travel”) keeps a rolling window of database snapshots for roughly 30 days, so that a database can be recovered after a mistake. When we delete your record from the live database it stops appearing anywhere the site can reach — but it can still sit in one of those backup snapshots for up to about a month afterwards, until the window rolls past it. We would rather tell you that than pretend deletion is instant at every layer.

No analytics, no trackers, no cookie banner

This site runs no analytics, no advertising pixels, no heatmaps and no third-party tracking of any kind. That is why you were not asked to dismiss a consent banner on the way in — there is nothing here that follows you. The one third-party script on the site is the Cloudflare Turnstile bot check described above. It loads only on the enquiry form, and it may set a cookie of its own for the single purpose of telling a person from a script. It does not profile you and it does not track you across other sites. That is the whole list, and if it ever changes this notice changes with it — before the change ships, not after.

The one thing the site stores in your browser is which colour scheme you last chose to read it in, and which language you last chose to read it in. Both sit in your browser’s local storage, never leave your device, and we never see them.

Your rights

You can ask us to:

• Show you what we hold about you (access).
• Correct anything that is wrong (rectification).
• Delete it (erasure).
• Send you a copy in a portable format (portability).
• Stop or limit what we do with it (restriction, or objection).

Write to info@karu.host and say which one you want. There is no form to find and no account to log into — a plain email is enough, and we will get to it within the month GDPR allows, usually a good deal sooner. You do not have to give a reason for asking us to delete an enquiry.

If you think we have handled something badly, you can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), which supervises us. We would rather you told us first and gave us the chance to fix it, but that is your call, not ours.

Questions

Anything at all about this notice or about what we hold — info@karu.host. A real person reads it.