Privacy policy

ui-design.co is operated by Alexander Vinokurov, sole proprietor (FOP, Ukraine), trading as 99 Francs Agency, Truskavetska St. 4B, 0408, Kyiv 02132, Ukraine (the controller under the GDPR). For any question about your data, or to exercise the rights listed below, write to sales@99francs.agency.

• Every visit: our server logs your IP address, browser and requested page to deliver the site and keep it secure (legitimate interest, Art. 6(1)(f) GDPR). Fonts, images and our own visit counter (datafirst, below) are served from our own domain — a visit does not contact Google or any other third party unless you allow analytics.
• Account: email, name, profile photo (Google sign-in) or a salted password hash (email sign-up), credit balance and purchase history (contract, Art. 6(1)(b)).
• Abuse prevention: the IP address at sign-up and last sign-in, and a fingerprint of uploaded screenshots, used to stop repeated free-credit sign-ups (legitimate interest, Art. 6(1)(f)). This never blocks an account automatically.
• What you upload: screenshots, briefs and the generated results, processed by the AI providers below to produce your result (contract).
• Purchases: email, phone (if you enter it) and order details; payment itself is handled by WayForPay (contract, legal obligations for accounting).
• AgentFit enquiries: when you ask for an AgentFit report, request a review call or order a done-for-you fix, we store your email, the domain, your name and message if you give them, and the campaign parameters of your visit (utm_* tags, gclid, referrer). We use them to send the report you asked for and reply to your enquiry (contract or steps before a contract, Art. 6(1)(b)). We send marketing emails only if you tick the marketing checkbox (consent, Art. 6(1)(a)); you can withdraw it any time via the unsubscribe link in any email or by writing to sales@99francs.agency.
• Traffic source: the page that referred you on your first visit and UTM tags. Saved in your browser only when analytics is on (otherwise kept for the current page only), and sent to us only if you create an account.
• Website analytics: we count visits with datafirst, our own analytics service. It runs from this site's own address, sets no cookies and stores nothing in your browser. For each page view your browser sends the page path (without query strings, apart from campaign tags such as utm_source), the referring website's domain, the page title, how long the page was in view and how far you scrolled, the domain of any other website you follow a link to, and, as with any request, your IP address and browser user agent. On our server the IP address is used only to look up your country and, together with a random value that changes every day and is then deleted, to make a daily visitor code; the IP address itself is not stored. We keep the page path, referring domain, country, device type, browser and operating system, the time the page was in view, how far you scrolled, the domains of websites you followed links to, the daily code and the time, for up to 25 months. Because the daily value is deleted, the code can't be linked back to you or across days. Data is processed on our hosting provider Railway's servers. We use it only to understand how the site is used (legitimate interest, Art. 6(1)(f) GDPR); it is not used for advertising or profiling and not shared.
• Analytics and ad measurement: Google Analytics 4, Google Ads conversion tracking and Microsoft Clarity. If you are in the EEA, the UK or Switzerland they run only with your consent (Art. 6(1)(a)); elsewhere they run unless you opt out. We work out which applies from your browser's time zone. You can change your choice at any time below or with the cookie button in the corner.

Transfers outside the EU/EEA rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.

• connect.sid — keeps you signed in, 30 days. Strictly necessary.
• Local storage — theme, your cookie choice, checkout and purchase-claim tokens (strictly necessary); first-visit referrer, only when analytics is on (see below). Never sent to third parties.
• _ga, _ga_* — Google Analytics, up to 2 years.
• _gcl_* — Google Ads click ID, up to 90 days.
• _clck, _clsk — Microsoft Clarity, up to 1 year.
• These three are set only with consent in the EEA, UK and Switzerland, and unless you opt out elsewhere.

Your current choice: analytics and ad measurement on. Change cookie settings

• Uploads and generated results: deleted automatically 30 days after creation.
• Account data: until you ask us to delete your account.
• Orders and payment records: as long as accounting law requires.
• AgentFit enquiries: up to 24 months after our last contact, unless you become a client (then as for account and order data).
• Server logs: kept by our hosting provider for a limited period for security.

Under the GDPR you can request access to, correction, deletion or export of your data, object to or restrict processing based on legitimate interest, and withdraw consent at any time without affecting earlier processing. Write to sales@99francs.agency. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live.

We update this page when the list of providers or what we collect changes; the date at the top shows the latest revision.