Privacy policy.
Last updated: October 2026 · Questions: hello@viktorszabo.com
- This site has no analytics, no ads and no tracking cookies.
- Cloudflare hosts the site and processes basic request data (like your IP address) to deliver pages and keep the site secure.
- Purchases and free downloads happen on Gumroad, which handles your payment and email under its own privacy policy.
- If you email me or use the growth partner form, I use what you send only to reply and help.
- My weekly email runs on Beehiiv. It stores your email address and counts opens and clicks. You can unsubscribe in one click and ask me to delete your data at any time.
- I don’t sell your data. You can ask me to see, fix or delete it at any time: hello@viktorszabo.com.
Who is responsible
The controller for this website is me, Viktor Szabó, an individual creator based in Hungary (EU). For anything about your personal data, email hello@viktorszabo.com.
This policy covers viktorszabo.com and the services I use around it. Gumroad, Beehiiv, Instagram and X have their own policies for what happens on their sites.
When you visit this site
The site is a set of static pages hosted on Cloudflare. To deliver a page and protect the site from attacks and abuse, Cloudflare processes technical data about each request: your IP address, the page you asked for, the time, your browser and device type (user agent) and the page you came from (referrer). Cloudflare handles this as my service provider, under its privacy policy.
I don’t use Google Analytics or any other analytics or tracking tool on this site, and there are no ads or social media trackers. The fonts are hosted on this site, so loading a page doesn’t contact Google Fonts or any other font service.
Cookies and local storage
This site doesn’t set analytics, advertising or tracking cookies, so there’s no cookie banner.
- Theme choice. If you press the light/dark button, your browser remembers the choice in its local storage under the name “theme”. It stays on your device, is never sent to me, and you can clear it in your browser settings.
- Security cookies. Cloudflare may set a strictly necessary security cookie (such as
__cf_bm) if it needs to tell people and bots apart, for example during an attack. It isn’t used for tracking or advertising.
When you click through to Gumroad, Beehiiv (the weekly email sign-up page), Instagram, X or another site, that site’s own cookies and policies apply.
Links with UTM tags
Some of my links end in tags like ?utm_source=instagram&utm_medium=bio&utm_campaign=free_library. These describe the link, for example “the link in my Instagram bio”. They don’t identify you, and nothing on this site reads or stores them. When you follow a tagged link to Gumroad, Gumroad may record the tags so I can see which links people use, as overall counts. When you sign up for the weekly email through a tagged link, Beehiiv saves the tags with your subscription as where you signed up. You can remove the tags from the address before you open a link and everything still works.
Purchases and free downloads (Gumroad)
My paid products and free downloads are on Gumroad. When you get one, Gumroad collects your email address and, for paid products, your payment details, and handles payment, tax and delivery. Gumroad is its own controller for this data, so its privacy policy applies. I never see your full card details.
Gumroad shares some details with me as the seller: usually your email address, the product, the price you paid, the date and your country, and your name if you gave it. I use these to deliver what you got, help if something goes wrong, send updates about a product you got through Gumroad, and keep the records the law requires.
Buying or downloading something on Gumroad doesn’t sign you up for my weekly email, and I won’t add Gumroad buyers or downloaders to it. You’ll only get it if you sign up and confirm yourself.
When you email me
If you write to hello@viktorszabo.com, I get your email address, your name if it’s in the email, and whatever you write. I use it only to reply and to deal with what you asked. My email runs on Google Workspace, which processes it for me as a service provider (see Google’s privacy policy).
The growth partner form
The form on my homepage sends what you type (name, email, website, business type, the size ranges you choose, ad channels and your notes) to my inbox through FormSubmit, a form-forwarding service. FormSubmit may show a spam check before your message is sent.
I use the details to reply and decide whether an intro makes sense. If it’s a fit, I introduce you to my agency partner by email, which means they get your name, email and what you told me. I’ll tell you who they are before I do that, and from then on they handle your data under their own policy.
Weekly email (Beehiiv)
My weekly email runs on Beehiiv (beehiiv Inc., USA). Beehiiv stores the list and sends the emails for me as my service provider (processor), under its data protection addendum and privacy policy.
- How you join. There’s no sign-up form or Beehiiv code on this site. The sign-up buttons link to my page on Beehiiv’s site, where Beehiiv’s own cookies and policy apply. After you sign up, you get an email with a confirmation link (double opt-in). Nothing else is sent until you confirm.
- I never add people myself. I won’t import anyone from Gumroad or any other list. You join only by signing up and confirming yourself.
- What Beehiiv stores: your email address; when you signed up and confirmed; where you signed up (the page and any link tags); technical details from the sign-up, such as your IP address, browser and device; your subscription status; and the emails you were sent. I don’t ask for your name.
- Opens and clicks. Beehiiv measures whether you open each email (with a small invisible image) and which links you click (links pass through a Beehiiv address first, which records the click along with your IP address and device type). Beehiiv doesn’t let me switch this off. I look at it to see what’s useful, mostly as totals. If you’d rather opens weren’t counted, turn off automatic image loading in your email app.
- Where it’s processed. Beehiiv stores publication and subscriber data on Amazon Web Services servers in the United States (see transfers outside the EU).
- Unsubscribing. Every email has an unsubscribe link. One click stops the emails straight away. You can also reply “unsubscribe” or email hello@viktorszabo.com.
- Deleting your data. Unsubscribing stops the emails but doesn’t delete your record. Beehiiv keeps it marked as unsubscribed, so you aren’t emailed again. To have it deleted, email hello@viktorszabo.com and I’ll delete you from Beehiiv within one month. You can also use Beehiiv’s own request form.
Instagram DMs When it launches
I plan to use ManyChat to send automatic Instagram replies, for example sending you a link when you comment a keyword or message me. It isn’t live yet. When it is, ManyChat will receive what Instagram shares for that conversation (your username, name, profile picture and the messages or comment that started it) to send the reply, as my service provider (see ManyChat’s privacy policy). Instagram itself is run by Meta under its own privacy policy.
Legal bases
| What | Legal basis (GDPR Art. 6(1)) |
|---|---|
| Hosting the site and keeping it secure (Cloudflare) | Legitimate interest in running a safe, working website (f) |
| Delivering and supporting a purchase or free download | Contract, or steps you ask for before one (b) |
| Keeping invoices and accounting records that Hungarian law requires | Legal obligation under tax and accounting law (c) |
| Replying to emails and form messages | Legitimate interest in answering you (f), or steps you ask for before a contract (b) |
| Introducing you to my agency partner | Your request, which you can withdraw before the intro (b, or consent under a) |
| Weekly email, including the open and click measurement described above | Consent, given when you sign up and confirm through double opt-in (a). You can withdraw it at any time by unsubscribing. |
| Instagram auto-replies, when they launch | Legitimate interest in answering the comment or message you sent (f) |
Where I rely on legitimate interest, you can object at any time (see your rights).
How long I keep data
I keep personal data, such as your emails, form messages, weekly email data and, once it launches, Instagram DM data, until you ask me to delete it, or until I no longer need it for the reason I collected it, whichever comes first. For the weekly email, unsubscribing stops the emails, and asking me to delete your data removes it. To ask for deletion, email hello@viktorszabo.com. I’ll handle it within one month.
The one exception is invoices and accounting records that Hungarian law requires me to keep. I keep those for the period the law requires, even after a deletion request, and use them only for that. Gumroad handles the sale itself as its own controller and keeps its own records under its policy.
| Data | How long |
|---|---|
| Cloudflare request and security data | As set by Cloudflare’s policy. I don’t keep my own visitor logs. |
| Theme choice | On your device until you clear it |
| Emails and form messages | Until you ask me to delete them, or until I no longer need them to reply and deal with what you asked, whichever comes first |
| Purchase and download details Gumroad shares with me | Until you ask me to delete them, or until I no longer need them to deliver and support what you got, whichever comes first |
| Invoices and accounting records required by Hungarian law | For the period the law requires, even after a deletion request, and only for that purpose |
| Weekly email list (Beehiiv): your address, sign-up details, opens and clicks | Until you ask me to delete it. If you unsubscribe, your record stays marked as unsubscribed, so you aren’t emailed again, until you ask for deletion. |
| Instagram conversations, when automations launch | Until you ask me to delete them, or until I no longer need them to answer you, whichever comes first |
Who else receives data
- Service providers that process data for me: Cloudflare (hosting and security), Google Workspace (email), FormSubmit (the homepage form), Beehiiv (weekly email) and, when it launches, ManyChat (Instagram replies).
- Separate controllers: Gumroad (purchases and downloads), Meta (Instagram), and my agency partner, only if you ask for an intro.
- Authorities, only if the law requires it.
I don’t sell or rent your personal data, and I don’t use it for advertising.
Transfers outside the EU
Most of the services above are based in the United States or have staff and servers outside the EU, so your data may be processed there. Where that happens, the transfer relies on the EU-US Data Privacy Framework for providers certified under it, or on the European Commission’s Standard Contractual Clauses in the provider’s data processing terms. Beehiiv, for example, stores subscriber data in the United States and covers transfers with Standard Contractual Clauses in its data processing terms. You can ask me for more detail about a specific provider.
Your rights
Under the GDPR you can:
- Access the personal data I hold about you and get a copy.
- Rectification: have wrong or incomplete data corrected.
- Erasure: have your data deleted. The only exception is invoices and accounting records the law requires me to keep (see how long I keep data).
- Restriction: ask me to pause using your data while we sort out a question about it.
- Objection: object to anything I do based on legitimate interest.
- Portability: get data you gave me in a common, machine-readable format.
- Withdraw consent at any time, for example by unsubscribing. This doesn’t affect what happened before.
- Complain to a data protection authority. In Hungary that’s the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), naih.hu. You can also complain in the EU country where you live or work.
To use any of these, email hello@viktorszabo.com. I’ll reply within one month. I may ask you to confirm it’s you before I share or delete anything. For data Gumroad holds as its own controller, you can also contact Gumroad directly.
Other things you should know
- Do you have to give me data? No. You can read the whole site without giving me anything. To get a product, Gumroad needs your email address, and the growth partner form needs the fields marked as required so I can reply.
- Automated decisions. I don’t make decisions about you by automated means that have legal or similarly significant effects. Instagram auto-replies, when they launch, only send the link or message you asked for.
- Children. This site is for adults running their own work. It isn’t aimed at children under 16.
- Security. I use established providers for hosting, email and payments, and I keep only what I need.
- Changes. When something changes, for example when Instagram auto-replies launch, I’ll update this page and the date below.
Last updated: October 2026