Privacy policy
Last updated 2 October 2026
This policy explains what personal data Hostacks collects, why, who it is shared with, how long it is kept and what your rights are. It applies to hostacks.co, the application form and any email we exchange with you.
1. Who we are
Hostacks is a service of Milan Ćirić PR Bykreator Studio, registration number (MB) 68269709, tax ID (PIB) 115315616, Rumenački put 57U, 21000 Novi Sad, Serbia (“Bykreator Studio”, “we”, “us”).
Bykreator Studio is the controller of your personal data. For anything about this policy or your data, email contact@bykreator.com.
2. What we collect
When you apply. The answers you give in the application form: your PMS, number of listings, booking site address, country, goals, the modules you are interested in, launch timing, budget range, any notes, your name, company and work email.
When you email us. Your email address, name, and whatever you choose to write.
When you visit the site. Our hosting provider processes technical data needed to deliver the site and keep it secure: IP address, browser and device type, pages requested and the time of the request. Your approximate country is read from your IP address to show prices in your currency and to pre-select your country in the form. We do not store it.
With your consent only. Analytics and marketing cookies, described in section 7.
If we contacted you first. We collect business contact details from public sources, such as your company website and your public booking site: company name, business email address, the platform your booking site runs on and its address. We use them only to contact you about our services.
We do not collect special categories of data, and the site is not directed at children.
3. Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Reviewing your application, replying, arranging a call and preparing a proposal | Steps taken at your request before entering into a contract (GDPR Art. 6(1)(b)) |
| Sending you a confirmation that your application arrived | Steps taken at your request before entering into a contract (Art. 6(1)(b)) |
| Delivering the site, preventing abuse and keeping it secure | Our legitimate interest in running a secure website (Art. 6(1)(f)) |
| Measuring how the site is used (analytics) | Your consent (Art. 6(1)(a)) |
| Measuring and improving our advertising campaigns (marketing) | Your consent (Art. 6(1)(a)) |
| Contacting businesses about our services | Our legitimate interest in offering relevant services to businesses (Art. 6(1)(f)). You can object at any time |
| Keeping invoices and business records | Legal obligation under Serbian accounting and tax law (Art. 6(1)(c)) |
The same bases apply under the UK GDPR and the corresponding provisions of the Serbian Law on Personal Data Protection. We do not make decisions about you based solely on automated processing.
4. Who we share it with
We do not sell your data. We share it only with providers that process it on our behalf, under data processing terms:
- Vercel Inc. (USA): website hosting and delivery.
- Resend (USA): sending the application and confirmation emails.
- Google (Google Workspace): our email inbox, where applications are received.
- Google (Google Analytics and Google Ads): analytics and campaign measurement, only if you consent.
We may also disclose data where the law requires it, or to establish or defend legal claims.
5. Transfers outside Europe
Some of these providers are based in, or process data in, the United States. Where this happens, the transfer is covered by the EU-U.S. Data Privacy Framework and its UK extension where the provider is certified, or by the European Commission’s Standard Contractual Clauses.
6. How long we keep it
- Applications and related emails: 12 months after our last contact, if no project goes ahead.
- Clients: for as long as we work together, and afterwards for as long as Serbian accounting and tax law requires for business records.
- Outreach contact details: until you object, or 12 months after our last contact.
- Analytics data: 14 months.
- Your cookie choice: 6 months in your browser, after which we ask again.
- Technical logs: the short periods set by our hosting provider.
7. Cookies
We use no analytics or marketing cookies until you choose to allow them in the cookie banner. You can change your choice at any time with , also at the bottom of every page.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| hostacks-consent | Necessary (browser storage) | Remembers your cookie choice | 6 months |
| _ga, _ga_* | Analytics (Google) | Distinguishes visitors and sessions to measure site use | Up to 2 years |
| _gcl_* | Marketing (Google) | Measures which campaigns lead to applications | Up to 90 days |
If you withdraw consent, we stop setting these cookies and remove the ones already set on hostacks.co.
8. Your rights
You have the right to access your data, have it corrected or deleted, restrict its use, receive it in a portable format, object to processing based on legitimate interest, and withdraw consent at any time without affecting earlier processing. You can always object to being contacted about our services, and we will stop.
To use any of these rights, email contact@bykreator.com. We reply within one month.
You can also complain to a data protection authority: in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs); in the UK, the Information Commissioner’s Office (ico.org.uk); in the EU, the authority in the country where you live or work.
9. Security
The site is served over an encrypted connection. Access to applications is limited to the people who handle them, and accounts with our providers are protected with strong authentication.
10. Changes
We update this policy when what we do changes. The date at the top shows the latest version.