Privacy policy

1. Who is responsible

The controller of your personal data is:

For anything related to privacy, write to hello@g99labs.com. We do not have a designated data protection officer because we are not required to appoint one.

2. Which laws apply

We process personal data under the Law on Personal Data Protection of Bosnia and Herzegovina, in force since October 2025. Where you are in the European Union, the European Economic Area or the United Kingdom, we also respect your rights under the EU General Data Protection Regulation (GDPR) and the UK GDPR.

3. What we collect and why

3.1 Visiting the website

When you open any page, our hosting provider automatically processes technical data so the page can be delivered and protected against abuse: your IP address, the date and time of the request, the page requested, your browser and operating system, and the referring page.

• Purpose: delivering the website, keeping it secure and fixing errors.
• Legal basis: our legitimate interest in running a secure, working website.
• Retention: server logs are kept by the hosting provider only for the short period its logging plan allows, and are then deleted automatically.

3.2 Contacting us

When you email us, including through the “describe your project” box at the bottom of the page, we receive your name, email address and whatever you choose to write. The box itself sends nothing to us: it only opens your own email app with your text filled in, and nothing leaves your device until you press send there.

• Purpose: answering your message and, if you want, preparing an offer.
• Legal basis: steps taken at your request before entering into a contract, and our legitimate interest in replying to enquiries.
• Retention: up to 24 months after our last exchange if no project follows. If we work together, project correspondence is kept for as long as the contract and the accounting rules that apply to us require.

3.3 Analytics (only with your consent)

If analytics is switched on for this website and you accept it in the cookie banner, we use Google Analytics 4 to count visits and see which pages are useful. IP addresses are not stored by Google Analytics 4, and we turn off Google signals and advertising features. Without your consent, the analytics script is never loaded.

• Legal basis: your consent, which you can withdraw at any time through “Cookie settings” in the footer.
• Retention: analytics cookies expire after 13 months; event-level data in Google Analytics is kept for 2 months, the Google Analytics default.

Details on every cookie and storage item are in our cookie policy.

3.4 Client projects

Personal data we handle while building software for a client (for example, test accounts or production data in a client’s system) is processed on the client’s behalf under a separate written agreement. This policy does not cover that processing.

4. Who receives your data

We do not sell personal data and do not share it for advertising. We use a small number of service providers:

We may also disclose data when the law requires it, for example to a court or a public authority with a valid request.

5. Transfers outside Bosnia and Herzegovina and the EU

Some providers above are based in the United States. Where data leaves Bosnia and Herzegovina or the EU, the transfer relies on the safeguards the provider offers, such as the EU–US Data Privacy Framework or Standard Contractual Clauses approved by the European Commission.

6. Your rights

Depending on the law that applies to you, you can ask us to:

• tell you whether we process your data and give you a copy (access);
• correct data that is wrong or incomplete (rectification);
• delete your data when there is no longer a reason to keep it (erasure);
• limit how we use it while a question is being resolved (restriction);
• give you your data in a common, machine-readable format (portability);
• stop processing based on our legitimate interests (objection);
• withdraw consent you gave, without affecting processing before the withdrawal.

Send requests to hello@g99labs.com. We answer within one month. We may ask you to confirm your identity before acting on a request.

You can also complain to a supervisory authority: in Bosnia and Herzegovina, the Personal Data Protection Agency (Agencija za zaštitu ličnih podataka u BiH); in the EU, the authority in your country; in the UK, the Information Commissioner’s Office.

7. Security

The site is served only over HTTPS. Access to our email and systems is protected with strong passwords and two-factor authentication, and we keep personal data to the minimum we need.

8. Children

This website is meant for businesses and is not aimed at children. We do not knowingly collect data from children.

9. Changes

We update this policy when the way we process data changes. The date at the top shows the latest version.