Editorial websites for design-led brands and creative businesses

Privacy Policy

Last updated: August 30, 2026

This page explains what happens to your personal data when you visit this website or get in touch with me. It describes what this site actually does — nothing more, nothing less. If anything here is unclear, write to me and I will explain it.

Who is responsible

This website is run by Maria Morozova, an independent web designer based in Belgrade, Serbia. I decide what data this site collects and why, which makes me the controller of that data. There is no company, no team and no agency behind this — just me.

You can reach me at hello@mariamorozova.design about anything in this policy, including a request to see, correct or delete your data.

What I collect

  • Contact form. Your name and email address, which are required, and — if you choose to fill them in — a description of your project and an indicative budget range. Submissions are stored by Webflow, which hosts this site, and forwarded to my inbox.
  • Email. If you write to me directly, I hold your message and your address in my mailbox, together with whatever you chose to tell me.
  • Analytics. If you accept analytics cookies, Google Analytics records which pages you view, how long you stay, an approximate location derived from a shortened IP address, and your device and browser type. See the Analytics section below.
  • Technical logs. Webflow’s servers record your IP address, your browser and the pages requested, as any web server does. I see only aggregate hosting statistics, not the raw logs.
  • Spam protection. The contact form is protected by Cloudflare Turnstile, which checks your IP address and browser signals to distinguish people from bots. It is not used to track you across websites.

There are no user accounts on this site, no shop, no newsletter and no SMS messaging. I do not buy or sell personal data, and I do not build advertising or marketing profiles.

Why, and on what legal basis

  • To answer you. When you submit the contact form you tick a box confirming that you agree to the processing described here. That is your consent; where an enquiry turns into a project, it is also processing necessary to take steps before entering into a contract.
  • To understand how the site is used. Analytics run only on the basis of your consent, given through the cookie banner, and never before it.
  • To keep the site running and free of spam. Server logs and bot protection rest on my legitimate interest in a website that stays online and an inbox that is not flooded.

Cookies and similar technologies

A cookie is a small file a website stores in your browser. This site uses very few, and the only optional ones are for analytics. You choose whether to allow those when the banner appears on your first visit.

  • Essential Set by: Webflow, CloudflareBasis: legitimate interest Purpose: keeping the site secure and the contact form working. These cannot be switched off without breaking the site, and they are not used to follow you anywhere.
  • Your cookie choice Set by: meBasis: legitimate interest Purpose: remembering whether you accepted or declined analytics, so the banner does not ask again on every page. Strictly speaking this is not a cookie: it is stored in your browser’s local storage under the name mm-consent, kept for 12 months, and contains nothing but your choice and its date.
  • Analytics Set by: GoogleBasis: your consent Purpose: measuring visits. Set only if you choose “Accept all”, and never if you choose “Essentials only”. They are named _ga and _ga_XFSV6VGMDZ and last up to two years.

Analytics

I use Google Analytics 4, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), to see which work resonates and which pages people never reach. It is not used for advertising, remarketing or ad personalisation, and Google Signals is switched off.

This site uses Google Consent Mode. Until you accept analytics cookies, Google Analytics runs in a restricted mode: it sets no cookies, creates no persistent identifier for you, and sends only aggregated, non-identifying signals that Google uses to model overall traffic. Once you accept, it sets the cookies named above and can recognise a returning browser.

Data tied to cookies and identifiers is kept in Google Analytics for 14 months and then deleted automatically. You can change your mind at any time by clearing this site’s data in your browser, which brings the banner back on your next visit, or by installing Google’s opt-out add-on at tools.google.com/dlpage/gaoptout, which disables Google Analytics on every site you visit. How Google handles the data is described in Google’s Privacy Policy.

Who else handles your data

These are service providers acting on my instructions. No one else receives your data, and none of it is shared for marketing.

  • Webflow, Inc. United States — hosting, contact form submissions, server logs.
  • Google Ireland Limited Ireland, with processing by Google LLC — analytics and the typefaces this site loads.
  • Cloudflare, Inc. United States — spam protection on the contact form.
  • My email provider — delivery and storage of the messages we exchange.

One thing worth stating plainly: this site loads its typefaces and one JavaScript library from Google’s servers, which means your IP address reaches Google as the page loads, before any banner appears. This is a common way to build a website rather than anything specific to this one, and I am working towards serving those files from my own hosting instead.

Where your data goes

Some of the providers above are based in the United States, so your data may be processed outside the European Economic Area. Those transfers rely on the EU-U.S. Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses, together with the additional safeguards each provider documents.

How long I keep it

  • Enquiries that do not lead to work. Up to 12 months after our last message, then deleted.
  • Correspondence about a project. For as long as the project runs and up to three years after it ends, in case questions come up later.
  • Analytics. 14 months from collection, deleted automatically by Google. Aggregated reports that cannot identify anyone may be kept longer.
  • Your cookie choice. 12 months, held in your own browser. Clearing your browser data removes it.
  • Server logs. Held by Webflow under their own retention schedule, which I do not control.

You can ask me to delete your data earlier than any of this, and I will unless I have a legal reason to keep it.

Your rights

Wherever you are reading this from, you can ask me to show you the data I hold about you, correct it, delete it, restrict what I do with it, or send it to you in a portable form. You can object to processing based on legitimate interest, and you can withdraw consent at any time — which does not affect anything done lawfully before you withdrew it.

Write to hello@mariamorozova.design and I will reply within 30 days. There is no charge for this.

If you think I have handled your data badly and my answer does not satisfy you, you can complain to a supervisory authority: in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection; in the EEA or the UK, the data protection authority where you live.

Disclosure required by law

I may have to disclose personal data if a law, a court or a competent public authority requires it, or where it is necessary to establish or defend a legal claim. This has never happened, and I would tell you if it did, unless I were legally barred from doing so.

Children

This site is aimed at people commissioning design work and is not directed at children. I do not knowingly collect data from anyone under 16. If you believe a child has sent me their data, write to me and I will delete it.

Security

The site is served over HTTPS, form submissions are protected against bots, and access to my inbox and to the Webflow account is protected by strong, unique credentials and two-factor authentication. No website can promise perfect security, and I would rather say that than pretend otherwise.

Links to other sites

This site links to places I do not control — client websites, Behance, Dribbble. Once you follow a link, that site’s own privacy policy applies, not this one.

Changes to this policy

If what this site does with data changes, I will update this page and change the date at the top. Material changes will be announced on the site before they take effect.

Contact

Questions, requests, corrections: hello@mariamorozova.design.