Privacy Policy

This Privacy Policy explains how Mdivani Agency (operated by Giorgi Mdivani, “we”, “us”) collects, uses, and shares information when you visit https://mdivani.agency (including www.mdivani.agency), send an inquiry, or book a call.

The controller of personal data is Giorgi Mdivani, L.Kvachadze 19, Tbilisi, Georgia. Contact: giorgi@mdivani.agency.

This policy describes the website. A separate written agreement covers paid engineering work.

1. What we collect

Information you give us

Project inquiry form (/inquiry), submitted to our server at /api/contact:

• Name (required)
• Email (required)
• Company
• Project type
• Budget range
• Timeline
• Project description
• Link to a product or site

Valid submissions are stored in a private Supabase table (inquiries) and emailed to us through Resend. We use a hidden honeypot field to reject spam; those submissions are discarded and are not stored. Do not fill it.

Email. If you write to giorgi@mdivani.agency, we keep the contents of that correspondence.

Google Calendar appointments. “Schedule a call” opens an iframe of Google Calendar appointment scheduling. If you book a slot, Google collects the details you enter in that booking flow (typically name, email, and any notes). We receive the booking as a calendar event.

We do not run user accounts or logins on this site.

Information collected automatically

Google Analytics 4 (measurement ID G-GRS8QP3EG6), loaded from www.googletagmanager.com. It records page views (including client-side route changes), device and browser data, approximate location, referrer, and events such as opening the schedule-a-call modal (schedule_call_click) and a successful inquiry (ads_conversion_About_Us_1). Google sets cookies (commonly _ga, _ga_*). This runs without a cookie banner today.

Vercel Web Analytics (@vercel/analytics). Page views and session metrics for the hosted site. This is first-party to the Vercel deployment (/_vercel/insights / va.vercel-scripts.com). It is designed to be cookieless; it still processes IP-derived and usage data on Vercel’s infrastructure.

Error and performance monitoring (Sentry). We use Sentry to capture application errors and a sample of performance traces so we can diagnose failures. Sentry may receive technical data such as the page URL, browser or runtime details, and the stack trace for the error. We do not enable Sentry Session Replay (session recording) on this site.

Hosting logs (Vercel). Standard request logs: IP address, user agent, URL, timestamp, and error traces. Used to operate and secure the site.

Rate limiting (Upstash / Vercel KV). POST /api/contact is counted by client IP in Upstash Redis (via the Vercel KV REST aliases) so we can reject floods. The store receives the IP and a request counter for a short window. If those variables are unset, the same limit runs in memory on the server and is not shared across instances.

We do not load Google Ads, Meta, Hotjar, Mixpanel, or PostHog pixels, and we do not use session replay. A successful inquiry still sends the GA4 conversion event ads_conversion_About_Us_1. We do not sell personal data.

2. Why we use it

3. Who we share it with

Processors that see data only to provide their service:

• Vercel Inc. — hosting, logs, Web Analytics
• Google LLC — Google Analytics 4; Google Calendar appointment scheduling when you book
• Functional Software, Inc. (Sentry) — error and performance monitoring
• Resend — after a valid inquiry is stored, our /api/contact API on Vercel emails it to giorgi@mdivani.agency
• Supabase — valid inquiry fields are stored in the inquiries table so we still have the lead if email delivery fails. The table is not publicly readable.
• Upstash (Vercel KV) — IP-based rate limiting of /api/contact

We may disclose information if required by law, or to professional advisers under confidentiality.

Google, Vercel, Sentry, Resend, Supabase, and Upstash may process data in the United States. Where GDPR/UK GDPR applies, they rely on their published transfer mechanisms (including Standard Contractual Clauses).

4. Cookies and similar tech

You can refuse non-essential cookies in your browser. Blocking Analytics cookies does not stop the inquiry form or email. There is no in-site cookie banner or consent switch in the current codebase.

5. How long we keep it

• Inquiries stored in Supabase and related email: as long as needed to respond and for a reasonable follow-up period, then deleted or archived unless we have an ongoing engagement or a legal reason to keep them
• Analytics: according to the retention set in Google Analytics and Vercel (typically months, not indefinite identified profiles)
• Calendar bookings: according to Google Calendar and our calendar
• Error reports: according to Sentry’s retention for this project
• Contact rate-limit counters: the 60-second window in Upstash / Vercel KV (or in memory if that store is unset)
• Server logs: Vercel’s default log retention

6. Your rights

Depending on where you live (including the EEA, UK, and Georgia), you may have the right to access, correct, delete, restrict, or object to processing, and to data portability. You may also lodge a complaint with your local supervisory authority.

To exercise rights, email giorgi@mdivani.agency. We will need enough information to find your data (usually the email you used).

You can opt out of Google Analytics with Google’s opt-out browser add-on or by blocking third-party cookies.

7. Children

The site is for adult founders and businesses. We do not knowingly collect data from children under 16.

8. Changes

We will post updates on this page and change the “Last updated” date. Material changes to analytics or processors will be reflected here.

9. Contact