Privacy notice
Last updated 31 October 2026.
Who is responsible
Rainforge is run by two companies. If you are in the EU, the EEA, the UK or Switzerland, or you work with us through our EU company, the controller is Boolx Kft., represented by its managing director (ügyvezető), Fejér Katalin Anna. Everywhere else, including the US, it is Iron Rainbow LLC. The registered addresses and registration numbers of both companies are on our Imprint.
To reach us about your data, email [email protected], reply to any email we sent you, or write to the registered address on our Imprint.
What we collect and why
- The booking form: your name, email, phone, company, website and answers. We use them to call you back and prepare the call. Legal basis: steps you asked for before a possible contract (GDPR Art. 6(1)(b)).
- The booking calendar: when you book a call, the time you picked, your time zone, your name, email, and the phone number and note if you give them. They are stored in our booking calendar (Cal.diy, open-source software that runs on our own server at book.rainforgedesign.com), which sends you the invite and lets you move or cancel the call. Legal basis: steps you asked for before a possible contract (Art. 6(1)(b)).
- Phone calls: if you call us, we see your phone number and the time of the call, and we keep them with your enquiry. Legal basis: steps you asked for (Art. 6(1)(b)).
- Case-study emails: only if you tick the box. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time by replying "stop".
- Spam protection: your browser type and a one-way hash of your IP address. Legal basis: our legitimate interest in keeping the form usable (Art. 6(1)(f)).
- Visit counts: see "Visit counting" below. No cookies, nothing that identifies you. Legal basis: our legitimate interest in knowing which pages are read (Art. 6(1)(f)).
- How you found us: the landing page, the referring site, campaign tags (
utm_*) and ad click IDs:gclid,gbraidandwbraidfrom Google,fbclidfrom Meta andmsclkidfrom Microsoft Advertising. They are stored in your browser and sent with the form or booking, but only when advertising measurement is allowed (see below). We don’t run a Microsoft tag; anmsclkidis only kept if a link brought one.
Emails
Booking confirmations and changes, and our own emails to you, are sent from [email protected] through Migadu (Switzerland), which also holds that mailbox. When you send the form, book a call or reply to us, a copy and a short alert reach our Gmail account, so Google also processes these messages to deliver and store them. If you book a call with a US phone number, we text you about it from our business number through Quo (OpenPhone, US), and our texts and calls with you on that number are kept there and with your enquiry. Reply STOP and we send no more texts.
We call and email people who asked us to. We don't buy lists, and we don't use your form data for anything else.
Visit counting
We count visits with Plausible Analytics, which runs on our own server and sets no cookies. It loads on every page without asking, because it stores nothing on your device and nothing that identifies you. For each page view it records the page address, the site you came from, campaign tags in the link, your browser, operating system and device type, and your country, which it looks up from your IP address. The IP address itself is not stored. To tell visitors apart within a day, it makes a one-way code from your IP address and browser with a random value that changes every 24 hours and is then deleted, so visits can't be linked to you or across days. It also counts a few on-page actions, such as which button was clicked or that the booking form was sent, without any of the form's contents. None of this goes to anyone else.
Visit log
If you allow measurement, we also keep a log of your visits on our own server: which of our pages you opened, the site or ad link you came from (including the campaign tags in the link and whether it carried an ad click ID), how long each page was on your screen, how far down you scrolled, which links and buttons you clicked, whether you played a video, and whether you started or sent a form, without any of the form's contents. We also note your screen size and whether you opened the page in an app's built-in browser. To tell your visits apart we store a random visitor code (rf_vid) and a visit code (rf_sid) in your browser. They contain nothing about you. If you send us an enquiry or book a call, the form sends the visitor code with it, so we can see how you found us and what you looked at before you wrote to us. We use this only to understand which ads and pages help people, and to prepare for our conversation with you. Your IP address is not stored, only a one-way code made from it. The log is not shared with anyone.
In the EU, the EEA, the UK and Switzerland the log starts only after you agree to measurement in the cookie banner. In the US it is on by default, and you can turn it off in the cookie settings. If you turn it off, we delete the codes from your browser. Legal basis: consent (Art. 6(1)(a)) in the EU, the EEA, the UK and Switzerland; in the US, our interest in understanding which pages and ads work, with the right to opt out.
Cookies and similar technology
Apart from the two settings this site needs, everything below is optional:
| Purpose | Tool | What is stored | How long |
|---|---|---|---|
| Necessary | This site | rf_consent_v2 (your choice), rf_region (US or EU company shown) | Until you clear it; 1 year |
| Advertising | Google Ads | _gcl_au and ad click IDs | 90 days |
| Advertising | Meta Pixel | _fbp, _fbc | 90 days |
| Advertising | This site | rf_first, rf_last, rf_entry (how you found us) | Until you clear it |
| Measurement | This site | rf_vid (random visitor code), rf_sid (current visit) | Until you clear it; the visit code is replaced after 30 minutes without activity |
We don't use Google Analytics.
In the EU, the EEA, the UK and Switzerland (and anywhere we can't tell where you are), none of the optional tools load until you agree in the cookie banner. Hungarian law requires this (Section 155(4) of the Electronic Communications Act, Eht., and the GDPR). Rejecting is as easy as accepting.
In the US the optional tools are on by default. You can turn advertising off with "Do not sell or share my personal information" at the bottom of every page, and we treat a Global Privacy Control signal from your browser the same way.
You can change your choice at any time: .
Ads and conversion measurement
If advertising measurement is allowed and you came from one of our ads, we may tell Google or Meta that you sent the form, booked a call or tapped our phone number, so we can see which ads work. For Meta this can include your email and phone number, hashed (turned into a code that can’t be read back) before sending, plus your IP address and browser type so Meta can match the visit to the ad. Without that permission we send nothing to ad platforms.
Checks on ad clicks
When you arrive on our site from one of our Google ads, we record your IP address, your browser type and language, the page you landed on, the time, and a code made from the ad's click ID. For 30 minutes after that we also count how many more pages you open from the same IP address. We use this only to spot fake or repeated clicks on our ads, which we pay for. We read nothing from your device for it and set no cookie. Legal basis: our legitimate interest in preventing fraud (GDPR Art. 6(1)(f) and Recital 47).
These records are deleted after 30 days. If an IP address appears to be clicking our ads fraudulently, we may pass it to Google Ads so that our ads are no longer shown to it. We keep such addresses on our block list, with the reason and the date, for as long as the block is in place, and we review the list every six months.
You can object at any time: email [email protected] with the IP address you used. We then stop using it and delete its records, unless we have compelling grounds to keep them, such as clear signs of click fraud.
Who else sees data
We keep the data on our own server, and the visit counts and the booking calendar stay there too. The site and the booking calendar are delivered through Cloudflare. Emails go through Migadu (Switzerland) and Google (Gmail); texts and calls on our US number go through Quo (OpenPhone, US). If you allow it, Google (Ads) and Meta receive the data described above. They process it in the US under the EU–US Data Privacy Framework. We don't sell your data for money.
How long we keep it
Enquiries: up to 24 months after our last contact, unless we start working together (then as long as the law requires for business records). Records of your cookie choice: 2 years. Visit logs: 180 days, or, if you send us an enquiry or book a call, as long as we keep your enquiry.
Your rights in the EU, the EEA and the UK
You can ask for a copy of your data, a correction, deletion, a restriction, or a machine-readable export, and you can object to processing based on legitimate interest. Where we rely on consent you can withdraw it at any time; this doesn't affect what happened before. You can also complain to a data-protection authority. In Hungary that is the NAIH (Nemzeti Adatvédelmi és Információszabadság Hatóság), 1055 Budapest, Falk Miksa utca 9–11, naih.hu. We answer requests within one month.
Your rights in the US (including California)
In the last 12 months we collected identifiers (name, email, phone), business details, and internet activity (pages visited and ad clicks), for the purposes above. We don't sell personal information for money. Letting ad platforms measure our ads can count as "sharing" for cross-context behavioural advertising under California law, and you can opt out:
You also have the right to know what we hold, to have it corrected or deleted, and not to be treated differently for using these rights. You can use an authorised agent. Contact us as described at the top; we verify requests by confirming the email address or phone number you gave us.
Children
This site is for businesses. We don't knowingly collect data from anyone under 16.
Changes
If we change this notice we update the date at the top. If a change affects what you agreed to, we ask again.