Privacy Policy

The data controller responsible for the personal data processed through this website is:

Thinktier OÜ

Private limited company (Osaühing)

Registry

Estonian Business Register · code 17249293

VAT

EE102949399

Registered address

Lõõtsa tn 5, Lasnamäe linnaosa, Tallinn 11415, Harju maakond, Estonia

Contact

hello@thinktier.io

We process personal data under the EU General Data Protection Regulation (Regulation 2016/679, “GDPR”) and the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus, “IKS”).

We only collect what is necessary to operate this website and to respond to inquiries.

• Inquiry data. When you submit the contact form or email us, we receive the name, email address, type of inquiry, the company you mention and the message you send — and, only if you leave the box ticked, the Tier reading you got from the diagnostic.
• Tier diagnostic. Your answers are worked out in your browser and never sent to us. If you have accepted analytics, we record that a reading was completed and which tier it gave — not the answers.
• Newsletter data. If you subscribe to our Insights mailing list, we receive your email address.
• Consent data. When you choose your cookie preferences, your choice is stored in a first-party cookie on your device for accountability under GDPR Art. 7(1).
• Analytics data (only with your consent). If you opt in to analytics in the cookie banner, we use Google Analytics 4 and Microsoft Clarity to receive aggregated usage data — page views, navigation paths, time on page, country, device type, and anonymized interactions with the page. See section 5 below.
• Technical request data. Like any web server, our hosting provider may temporarily log IP addresses, user agent and timestamps for the purpose of operating the service and preventing abuse. We do not use this data for analytics or profiling.

We do not knowingly collect data from minors and we do not process special categories of personal data (Article 9 GDPR) through this website.

• To respond to your inquiry — performance of pre-contractual or contractual measures requested by you (GDPR Art. 6(1)(b)) or, where no contract is in scope, our legitimate interest in answering business correspondence (Art. 6(1)(f)).
• To send the Insights newsletter — your consent (Art. 6(1)(a)), which you can withdraw at any time using the unsubscribe link in every email.
• To measure how the site is used — your consent (Art. 6(1)(a)) given through the cookie banner. You can withdraw it at any time using the “Cookie settings” link in the footer.
• To operate and secure the website — our legitimate interest in keeping the service available and preventing abuse (Art. 6(1)(f)).
• To comply with legal obligations — for example, retaining business correspondence where required by Estonian accounting or tax law (Art. 6(1)(c)).

• Inquiries: kept for as long as needed to handle the request and any resulting business relationship, then archived according to applicable accounting and limitation periods (typically up to 7 years under Estonian law) before deletion.
• Newsletter subscribers: kept until you unsubscribe. When you unsubscribe, your email is removed from the active list and kept only in a minimal suppression record needed to honor your choice.
• Consent record: stored for 6 months on your device (then we re-prompt) and in our server logs as proof of consent for the period legally required.
• Analytics data: retained by Google Analytics for up to 14 months and by Microsoft Clarity for up to 12 months, after which it is aggregated or deleted by the processor.
• Server logs: kept by our hosting provider for the short period needed for security and reliability, then deleted or anonymized.

If you opt in to analytics, we use the following tools. They only load after you accept; if you decline or do nothing, no analytics scripts run and no analytics cookies are set. The Google Consent Mode v2 default-denied state applies until you choose otherwise.

Google Analytics 4 (Google Ireland Ltd. / Google LLC)

Aggregated audience and behavior measurement. We use it with IP anonymization enabled, Google Signals disabled and ad-personalization signals disabled. Cookies set: _ga, _ga_*. Provider data-processing terms: business.safety.google/adsprocessorterms.

Microsoft Clarity (Microsoft Ireland Operations Ltd. / Microsoft Corp.)

Heatmaps and session replay used to understand where users get stuck. Form inputs are masked at the source using data-clarity-mask attributes so passwords, emails, names and free-text content are never captured in the recording. Cookies set: _clck, _clsk, MUID, ANONCHK. Provider terms: Microsoft Clarity data collection.

Google Search Console (Google Ireland Ltd. / Google LLC)

Site-ownership verification (a meta tag in the page head) and search-performance reporting. No cookies are set on visitors’ devices by this tool. We see only aggregated search query data through the Search Console interface.

For the full list of cookies, their retention and how to opt out, see our Cookie Policy.

We do not sell personal data and we do not share it for advertising. We share data only with the service providers we need to operate this website, and only for that purpose. These act as data processors on our behalf under written agreements (GDPR Art. 28). Typical categories include:

• Website hosting and infrastructure providers
• Form-handling providers (such as Formspree, based in the United States), which receive what you send through the contact and subscription forms
• Email delivery and customer-support providers
• Newsletter delivery providers (if you subscribe)
• Analytics providers — Google (GA4, Search Console) and Microsoft (Clarity), only when you have consented
• Professional advisors (legal, accounting) where strictly necessary

We may also disclose data when required by a competent authority or to establish, exercise or defend legal claims.

Several of our processors — including Google and Microsoft — are part of US-based corporate groups. Personal data processed through these tools may be transferred to or accessed from the United States or other countries outside the European Economic Area.

These transfers rely on a transfer mechanism recognized under Chapter V of the GDPR. In practice:

• Google LLC and Microsoft Corp. are certified under the EU–US Data Privacy Framework, which the European Commission has recognized as providing an adequate level of protection (adequacy decision of 10 July 2023).
• Where the Data Privacy Framework does not cover a specific transfer, we rely on the EU Standard Contractual Clauses with supplementary measures where appropriate.

Under the GDPR and the IKS, you have the right to:

• access the personal data we hold about you (Art. 15);
• have inaccurate or incomplete data corrected (Art. 16);
• have your data erased in the cases set out in Art. 17;
• request restriction of processing (Art. 18);
• receive your data in a portable format (Art. 20);
• object to processing based on legitimate interests (Art. 21); and
• withdraw any consent you have given, without affecting the lawfulness of processing carried out before the withdrawal — you can withdraw cookie consent at any time via the “Cookie settings” link in the footer.

To exercise any of these rights, write to hello@thinktier.io. We may ask for information needed to confirm your identity. We aim to respond within one month, as required by Article 12 GDPR.

If you believe your data is being processed unlawfully, you may file a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon (AKI)) or with the supervisory authority of your country of residence.

We use one strictly necessary first-party cookie to remember your cookie choice, and — only with your consent — analytics cookies from Google and Microsoft. See our Cookie Policy for the full catalog.

We take technical and organizational measures appropriate to the risk (GDPR Art. 32) — including transport encryption (HTTPS), restricted access to systems containing personal data, processor agreements with our service providers, and masking of form inputs in session recording tools. No method of transmission or storage is ever fully secure, and we cannot guarantee absolute security.

We may update this policy to reflect changes in how the website works, in the services we use, or in the law. When we do, we will update the “Last updated” date at the top of the page. For significant changes affecting your rights, we will take additional steps to inform you where required.

For any question about this policy or your data, write to hello@thinktier.io or use the form on our contact page. General company contact: hello@thinktier.io.