Privacy Policy

1. Who we are

Malpie is a 90-day growth-planning service operated by Luka Tegeltija as a sole trader, based in Belgrade, Serbia ("Malpie", "we", "us", or "our"). This Privacy Policy explains how we collect, use, and protect personal information submitted through malpie.com (the "Site") and through any related communications.

Malpie does not currently offer user accounts. You interact with the Site by browsing it, submitting the apply form, exchanging email with us, and, where applicable, completing a payment for our service.

2. Information we collect

2.1 Information you provide

• Apply form: your email address and the website URL you submit. We use this to evaluate whether we can help and to send you our findings.
• Email correspondence: the content of any emails you send us, plus your email address and any other information you choose to include.
• Payment information: when you purchase our service, payment is processed by LemonSqueezy. We receive your name, email, billing country, and an order identifier from LemonSqueezy. We never see or store your full card number.

2.2 Information collected automatically

• Usage data: pages visited, clicks, time on page, approximate location (country), browser and device type, and IP address.
• Cookies and similar identifiers: set by us and by the third-party tools listed in Section 4. These include Meta's _fbp and _fbc cookies for ad attribution and PostHog identifiers for product analytics.
• Referrer information: if you arrive from a Facebook or Instagram ad, the click ID and ad metadata is captured so we can measure which ads work.

3. How we use your information

We use the information described above to:

• Review your application and prepare a personalized response
• Deliver the growth plan and any related communications you purchase from us
• Send transactional emails (application received, plan delivered, payment receipts) and limited follow-up emails if you start the apply form but don't finish it
• Process payments and keep records required for tax and accounting purposes
• Measure the performance of our advertising and our website (e.g. which pages lead to applications)
• Detect, prevent, and respond to fraud, abuse, or security incidents

4. Third-party services we use

We share information with a small set of service providers, strictly to operate the Site and deliver our service:

4.1 Convex (backend and database)

Stores the leads, application data, and email-delivery records submitted through the Site.

4.2 Vercel (hosting)

Hosts the Site and processes incoming HTTP requests, including your IP address and user agent in standard server logs.

4.3 Resend (email delivery)

Delivers transactional and follow-up emails. Your email address and the email content are shared with Resend for this purpose.

4.4 LemonSqueezy (payments)

Processes payments when you purchase our service. LemonSqueezy acts as the merchant of record and handles tax compliance. Their privacy practices are governed by their own privacy policy.

4.5 PostHog (product analytics)

Captures usage events on the Site so we can understand which pages and flows work. PostHog data is pseudonymous (tied to a random identifier, not your name).

4.6 Meta (Facebook / Instagram advertising)

We use the Meta Pixel and Meta Conversions API to measure the performance of our ads and to build audiences for retargeting. Information shared with Meta includes hashed email addresses, IP address, user agent, and event metadata. Meta may use this data in accordance with its own data policy.

4.7 Legal disclosures and business transfers

We may disclose information when required by law, to enforce our Terms, or to protect our rights, property, or safety. If Malpie is ever transferred or sold, your information may be transferred as part of that transaction. We do not sell your personal data.

5. International transfers

Several of our service providers (including Vercel, Convex, Resend, PostHog, LemonSqueezy, and Meta) are based outside of Serbia, primarily in the United States and the European Union. By using the Site you understand that your information may be transferred to, stored in, and processed in those countries. Where required, we rely on the providers' own contractual safeguards (such as Standard Contractual Clauses) for these transfers.

6. How long we keep your information

• Leads and applications: kept for up to 24 months after your last interaction, then deleted or anonymized, unless we are required to keep them longer for legal or tax reasons.
• Payment and invoice records: kept for as long as required by Serbian tax and accounting law (currently 10 years).
• Email logs: kept by Resend for a limited period as defined in their retention policy.
• Analytics data: kept by PostHog and Meta in line with their own retention settings.

7. Your rights

Under the Serbian Law on Personal Data Protection (and, where applicable, the EU General Data Protection Regulation), you have the right to:

• Access: request a copy of the personal data we hold about you
• Rectification: request correction of inaccurate or incomplete data
• Erasure: request that we delete your personal data
• Restriction: request that we limit how we use your data
• Portability: request your data in a machine-readable format
• Objection: object to processing based on our legitimate interests, including direct marketing
• Withdraw consent: where we rely on consent (e.g. for non-essential cookies), withdraw it at any time

To exercise any of these rights, email luka@malpie.com. You also have the right to lodge a complaint with the Serbian Commissioner for Information of Public Importance and Personal Data Protection.

8. Cookies and tracking

The Site uses essential cookies required for it to function (such as session and security cookies). With your consent, we also use analytics and advertising cookies set by PostHog and Meta, as described in Section 4.

You can withdraw your consent at any time by clearing cookies in your browser and revisiting the Site, which will display the consent banner again. Most browsers also let you block or delete cookies through their settings.

9. Security

We use HTTPS encryption for all traffic, authenticate sensitive endpoints, and validate webhook signatures from third parties. No system is perfectly secure, but we take reasonable steps to protect your information against unauthorized access, loss, or alteration.

10. Children

The Site and our service are not directed to children under 16. We do not knowingly collect personal data from children. If you believe we have, please contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected on this page, and we will update the "Last Updated" date above. Where required by law, we will notify you in advance.

12. Contact

Operator: Luka Tegeltija (sole trader)
Location: Belgrade, Serbia
Email: luka@malpie.com