Privacy
Controller: CodeMango OÜ
Registered address: Sepapaja 6, 15551 Tallinn, Estonia
Privacy contact: the contact form only. We do not publish personal staff contacts.
Policy version: 1.0 · Effective: 2026-08-10
1. Who we are
CodeMango is operated by CodeMango OÜ ("we," "us"), a company registered in Estonia. This policy covers the marketing site at https://codemango.dev and the inquiry form on it. It explains what we collect, why, on what legal basis, and what you can ask us to do about it.
2. What we collect
| Source | Data | Purpose |
|---|---|---|
| Contact inquiry | Work email; your company website if you choose to provide it; the transcript of your spoken message; a consent timestamp; the policy version you agreed to; security metadata (IP-derived signals, bot flags, and voice-session proofs as implemented) | Reviewing inquiries; preventing abuse |
| Speech processing | Microphone access in your browser; a transcript produced by on-device or operating-system / browser speech-to-text where available | Filling the inquiry message body |
| Security / bots | Honeypot and related signals; suspected-bot inquiries may be retained with a flag | Protecting the form and analyzing abuse |
| Infrastructure | Our hosting provider and Cloudflare process request metadata for delivery and security, and — where cookie-less Web Analytics is enabled — aggregate traffic statistics | Delivery, security, aggregate traffic understanding |
We do not collect a name, company name, or role on the inquiry form. Your company website is optional and may be left blank. We do not retain audio files in this version — the transcript is all that is stored.
3. Legal bases (GDPR)
We rely on consent for submitting an inquiry and for speech processing (the checkbox plus the recording action), and on legitimate interests for security, abuse prevention, and keeping the site available — balanced against your rights and freedoms. You may withdraw consent at any time by requesting deletion through the contact form; withdrawal does not affect processing already carried out.
4. Cookies and similar technologies
Marketing pages are built to work without advertising or analytics cookies by default. We do not run Google Analytics, advertising pixels, or heatmaps in this version. Cloudflare may set strictly necessary cookies for security — for example bot management or the Turnstile challenge — as that service requires. Optional Cloudflare Web Analytics, where enabled, is cookie-less. Because we set no consent-requiring cookies, there is no cookie wall.
5. Speech and third parties
Recording uses your device microphone. Speech-to-text may be handled by your operating system or browser vendor under their own terms. After you consent, we store the resulting transcript and the associated security metadata. We do not store the audio file in this version.
6. Retention
| Data | Retention |
|---|---|
| Inquiries, including bot-flagged submissions (work email, company website, transcript, consent record, security metadata) | Kept until deletion is requested. We act on a deletion request without undue delay and in any case within one month, unless a specific record must be preserved for an active security or legal dispute |
| Web-server access and error logs | Rotated by our hosting infrastructure and deleted after 14 days, unless a specific entry is preserved for an ongoing security investigation |
| Cloudflare edge and security data | Retained for the limited periods set by Cloudflare's own service defaults — security event data for a short window measured in days, and, where cookie-less Web Analytics is enabled, unsampled page-view data for 7 days with aggregated statistics available for up to 6 months. We cannot extend these periods and do not export this data into any other system |
7. Sharing and processors
We use only the processors needed to run the site and to read inquiries:
- Site and application hosting — a virtual private server located in the European Union, provisioned and managed through our deployment toolchain. Inquiry records are stored here.
- Content delivery, security, and bot protection — Cloudflare, Inc., including the Turnstile challenge and, where enabled, cookie-less Web Analytics.
- Transactional email — an email delivery provider, used only when inquiry notification mail is enabled. It processes the notification message, which contains the work email and the transcript.
Each processor is engaged under a written data processing agreement and may use the data only to provide its service to us. We do not sell personal data, and we do not share it with advertising networks, data brokers, or social platforms. We will identify our current processors on request through the contact form.
8. International transfers
Inquiry data is stored on infrastructure located in the European Union. Some processors — Cloudflare in particular — are established outside the EEA and operate globally. Where personal data is transferred outside the EEA, we rely on an adequacy decision issued by the European Commission or, where none applies, on the EU Standard Contractual Clauses together with the supplementary measures assessed for that transfer. Cloudflare processing is covered by its data processing addendum incorporating the Standard Contractual Clauses. We do not transfer personal data to a country without one of these bases in place.
9. Your rights
Under the GDPR you may request access, correction, deletion, restriction of processing, portability, or object to processing based on legitimate interests. Submit requests through the contact form; we may need to verify a request before acting on it, and we answer within one month.
If you believe we have handled your data unlawfully, you may lodge a complaint with our supervisory authority, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), at aki.ee. You may also complain to the data protection authority of the EU or EEA country where you live or work.
10. Children
The site is directed at business professionals. We do not knowingly collect data from children.
11. Changes
We update this page and its version number when a material change occurs. Consent is captured per submission, so the version you agreed to is recorded with your inquiry.
12. Contact
Privacy requests go through the contact form only.