Privacy Policy.

Who we are

Level UI is the trading name of DenverWorld S.R.L., a company registered in Romania (registration number J23/3477/10.05.2024, CUI 50060912), with its registered office in Bucharest (Str. Sfânta Agnes 306, Popești-Leordeni, 077160, Ilfov, Romania). We also operate an office in Berlin (Greifswalder Straße 215, 10405 Berlin, Germany).

For the purposes of data protection law, DenverWorld S.R.L. is the data controller for the personal data described in this policy. You can reach us about any privacy matter at privacy@levelui.com, or through our Support page.

What personal data we collect

We only collect what you actively give us through this website, plus a small amount of technical data needed to keep the site secure and working. Specifically:

• Enquiry, quote and cart forms — the email address, budget range, project description and selected services you type in when you contact us, request a quote or send a package request.
• Follow-ups on the thank-you page — anything you add to the short thread after sending a form: a phone number if you write one, how many monthly payments would suit you if we asked, a deadline, a link, further detail. It is sent to the same mailbox as the enquiry it belongs to and attached to it by the email address you already gave us. Every part of it is optional; sending nothing leaves the enquiry exactly as it was.
• Which price view you were reading — whether the price list was set to instalments, to another currency, or to include VAT when you wrote to us. It is a one-line note on the enquiry, not a profile: it tells us who to write the reply for. It is only ever read from your browser at the moment you submit a form, never in the background, and it changes nothing we charge.
• Support requests — your name (optional), email address, the type of request you select and your message.
• Client Portal — if you become a client, your email address and the access code we issue you, plus the project briefs, milestones, files and messages tied to your account, so we can deliver and track your project.
• Offers and their acceptance — when we quote you, we keep a record of the offer: your name, the company and email address where you give them to us, what was quoted, at what price and until when. If you accept it on the personal link we send with it, we also record the name you type, the date and time, your IP address and your browser, as evidence of what was agreed. If you propose a different price instead, we record that price, your message and the same technical details against the offer they concern.
• Instalment plans — if you pay a project in instalments, we keep the payment schedule agreed with you and whether each instalment has been paid, against your client record. This is ordinary invoicing and contract data: there is no credit application, no credit-check result, and nothing obtained about you from anyone else.
• Feedback votes — an anonymous "helpful / not helpful" vote on a resource guide, a portfolio project, or on the form you have just sent us, together with a cookie that remembers which ones you already voted on. This is not linked to your name or email.
• Technical data — your IP address, processed automatically and temporarily to prevent spam and abuse (see "Cookies & local storage" below). It is never linked to your identity or stored permanently by us, with one exception: accepting an offer, or proposing a price on one, stores your IP address and browser alongside that record as evidence of who acted.
• Hosting-level data — our hosting provider processes standard connection data (such as IP address, browser type and request timestamps) as part of ordinary web server operation, independently of us.

What we don’t collect

We deliberately keep this list short. This site does not use analytics, advertising or tracking cookies of any kind, does not run ad pixels, does not use social-login sign-in, and does not process online card payments — package prices are a starting point for a conversation, and any resulting engagement is invoiced separately.

That extends to paying in instalments. An instalment plan is our own invoice issued in parts, not credit: we do not run a credit check, we do not request or receive data about you from a credit reference agency or any other third party, we do not report anything to one, and there is no lender involved to share your data with. Whether a plan is offered is decided by a person, so no automated decision-making within the meaning of Article 22 GDPR takes place.

That stays true during periods when we advertise. Our advertising measurement runs entirely on our server, from a hashed email address after you submit a form (see "Who we share your data with"). Nothing is loaded into your browser, nothing is written to your device, and you are not tracked across other websites.

How we measure this website

We count page views ourselves, on our own server. No analytics company is involved, no cookie is set, and nothing about your visit is sent anywhere else — which is why this measurement needs no consent banner.

For each page view we record the page address, a rough device type (desktop, mobile or tablet) and the country our hosting reports. To tell one visitor from another within a single day, we store a one-way hash of your IP address and browser combined with a secret value that is replaced every midnight and then discarded. The hash cannot be reversed, and yesterday’s cannot be recalculated or matched against today’s — so your visits cannot be joined into a history, by us or by anyone else.

Within that single day, the pages seen under one hash stay in the order they were viewed, so we can see which route through the site someone took. That sequence ends at midnight together with the secret it depends on, and the individual entries it is built from are deleted after 35 days.

When you arrive on the site, and again when a page is fully reloaded or a new day begins, we also note where you came from, as one of six channels (an ad, a search engine, an AI assistant, a social network, another website, or none if you typed the address or used a bookmark), together with the name of the referring website, such as google.com. We record only that name: never the address of the page you came from, never what you searched for, and never the identifier an ad attaches to the link. That identifier is checked in your browser and never sent to us.

Your IP address itself is never written to disk. Individual entries are deleted after 35 days; only the daily totals are kept. Our legal basis is our legitimate interest in knowing which pages are actually read (Article 6(1)(f) GDPR).

Why we process your data, and our legal basis

We rely on the following legal bases under the EU General Data Protection Regulation (GDPR):

• Responding to your enquiry, quote request or support request — necessary steps prior to entering into a contract with you (Art. 6(1)(b) GDPR).
• Delivering and managing an active client project through the Client Portal — performance of a contract (Art. 6(1)(b) GDPR).
• Preventing spam, abuse and fraudulent submissions (honeypot fields, rate limiting) — our legitimate interest in keeping the site and our inbox usable (Art. 6(1)(f) GDPR).
• Recording that an offer was accepted, by whom and when — our legitimate interest in being able to prove what was agreed (Art. 6(1)(f) GDPR).
• Handling a price you propose in reply to an offer — steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
• Counting "helpful" votes on guides, portfolio projects and our forms to improve them — our legitimate interest in understanding what is useful to readers (Art. 6(1)(f) GDPR).
• Keeping business records (e.g. invoices) for as long as required by law — compliance with a legal obligation (Art. 6(1)(c) GDPR).
• Measuring which advertising campaigns produce genuine enquiries — your consent (Art. 6(1)(a) GDPR), given by ticking the optional box on the enquiry, quote or package form. It is never pre-ticked, your request is sent and answered exactly the same whether you tick it or not, and if you leave it unticked nothing is sent to Google at all. You can withdraw consent at any time by emailing us.

Who we share your data with

We do not sell your data, and we do not use analytics vendors or data brokers. We rely on a small number of service providers strictly to operate the site and deliver our services — and, when we are running advertising, to find out which campaigns produced a genuine enquiry:

• Google (Gmail SMTP) — used to deliver the emails generated by our forms to our inbox, and to reply to you.
• Hostinger — our hosting provider, which serves this website and stores Client Portal data on our behalf.
• Google Ads (conversion measurement) — only if you tick the optional consent box on the form. When you do, our server sends Google a one-way SHA-256 hash of your email address so Google can tell us that an ad led to a real enquiry rather than a click. We send no name, message, budget, phone number or IP address, and no advertising cookie or tracking pixel is ever placed on this site. If you leave the box unticked, we make no request to Google and your email address never leaves our server. To be clear about what hashing is: it is not anonymisation, because Google can match the hash against its own records — that is precisely what makes it work.

International data transfers

Where a service provider such as Google processes data outside the European Economic Area, that transfer relies on the safeguards available under GDPR (such as the EU–U.S. Data Privacy Framework or Standard Contractual Clauses), as maintained by that provider.

Cookies & local storage

We do not use a cookie consent banner, because every cookie and local storage value on this site is strictly necessary or purely functional — none are used for advertising, tracking or profiling. Here is exactly what we set:

• portal_session — set only when you log in to the Client Portal. HttpOnly, expires after 7 days. Needed to keep you logged in.
• guide_rated — set only if you vote on a resource guide. HttpOnly, expires after 1 year. Remembers which guides you already voted on so you can’t vote twice; contains no personal identifier.
• pf_rated — set only if you vote on a portfolio project. HttpOnly, expires after 1 year. Remembers which projects you already voted on so you can’t vote twice; contains no personal identifier.
• flow_rated — set only if you rate the form you have just sent on our thank-you page. HttpOnly, expires after 1 year. Remembers which of our forms you already rated so you can’t vote twice; contains no personal identifier.
• theme — stored in your browser’s local storage (not a cookie) to remember your light/dark mode preference. Never sent to our servers.
• levelui-cart — stored in your browser’s local storage (not a cookie) to remember the packages you’ve added to your cart across visits, until you send or clear it. Never sent to our servers except the item names/prices you choose to submit.
• price-display — stored in your browser’s local storage (not a cookie) to remember how you asked the price list to be shown: in instalments, in another currency, or with VAT included. It holds three words and no identifier of any kind. Never sent to our servers except as the one-line note attached to a form you choose to submit.
• Scroll position — stored in your browser’s session storage to restore your scroll position on this same visit; cleared automatically when you close the tab.

How long we keep your data

Enquiry and support emails are kept in our mailbox for as long as reasonably needed to handle your request and for legitimate business record-keeping, then deleted. Client Portal data is kept for the duration of our working relationship, plus any period required by applicable tax and accounting law. IP addresses used for spam and rate-limit protection are held in server memory only, typically for minutes, and are never written to disk or linked to a person.

Offers are the exception to that last sentence. What we quoted, to whom, and any acceptance or proposed price recorded against it — including the IP address and browser captured with it — are kept for as long as the resulting agreement stands and for any period required by tax and accounting law after it. Where no engagement follows, we keep the record while the quote is still commercially relevant, then delete it.

Your rights under GDPR

If you are located in the EU/EEA (or covered by GDPR), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request erasure of your data ("right to be forgotten").
• Restrict or object to certain processing.
• Receive your data in a portable format, where applicable.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with your national data protection authority — for our registered office, this is Romania’s Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP).

How to exercise your rights

To make any of the requests above — including asking us to delete your personal data — use our Support page and choose "Data privacy request (GDPR)" as the request type, or email us directly at privacy@levelui.com. We will respond within one month, as required by GDPR.

Children

This site is intended for businesses and professionals. It is not directed at children, and we do not knowingly collect personal data from anyone under 16.

Changes to this policy

We may update this policy from time to time, for example if we change a tool or service we rely on. The "last updated" date at the top of this page always reflects the current version.