Home · Privacy policy
Privacy policy.
What this site learns about you, why, and how long it keeps it. The short version: analytics stays off until you allow it, and the only thing we genuinely receive is whatever you type into the contact form.
Last updated 6 September 2026
Controller
Who processes the data.
Massruum OÜ, registry code 12329892, Tallinn, Estonia. Write to hello@massruum.ee – the same address answers if you want to see or delete what we hold.
Data
What is collected, and what happens to it.
01
The contact form
The form asks for your name, email address, company, project type and your message. When a submission goes through, it is emailed to hello@massruum.ee and no copy is written to the site’s database. From there your enquiry lives in our mailbox like any other email.
Basis: legitimate interest in replying to someone who contacted us, and taking steps towards a contract if the enquiry becomes work.
How long: enquiries that do not turn into work are deleted from the mailbox within a year. Client correspondence is kept for as long as the engagement lasts, and invoices for seven years, which is what Estonian accounting law requires.
02
Spam defence
This form receives roughly ten automated submissions a day. To tell them apart from people, the site does two things. It counts submissions from one IP address within an hour, keeping only a hash of that address, which expires after the hour. And it keeps the last 40 rejected or suspicious submissions – with the IP address, name, email and the beginning of the message – so the heuristics can be corrected when a real person is caught by mistake.
That list is 40 entries long and every new submission pushes the oldest out, so entries delete themselves. It also catches an enquiry that passed every check but failed to send, because otherwise that enquiry would simply be lost.
Basis: legitimate interest in keeping our own mailbox usable.
03
Analytics
The site uses Google Analytics (GA4) to see which pages people care about and where they arrive from. Until you allow analytics in the cookie notice, it is off: Google Consent Mode tells Analytics up front that nothing is permitted, and nothing is written to your device. Once you allow it, the cookies _ga and _ga_* appear.
We do not export these statistics anywhere, and we do not join them to any name, email address or enquiry. A number stays a number to us. The data itself is held in Google Analytics under Google’s retention settings, and only we log in to it.
We also read Google Search Console, which shows which searches surface the site in Google. Those figures are aggregates and no individual can be identified from them.
Basis: your consent. You can withdraw it at any time – open cookie settings.
04
Server logs
The site runs on Zone Media OÜ servers in Estonia. Like any web server, it writes every request to a log: IP address, timestamp, the address requested and the browser identifier. Those logs are used to investigate faults and attacks, not for marketing, and the hosting provider sets how long they are held.
Basis: legitimate interest in keeping the site running and secure.
Cookies
What reaches your browser.
Everything below is a first-party cookie set by massruum.ee itself. There are no third-party tracking pixels here: no Facebook, no LinkedIn, no ad networks.
| Cookie | What for | How long |
|---|---|---|
massruum_consent | Remembers whether you allowed analytics. Without it the site would ask again on every visit | 1 year |
massruum_lead | Tells analytics that an enquiry was genuine rather than a bot. Deleted immediately after it is read | 5 minutes |
_ga, _ga_* | Google Analytics. Only appear if you allow analytics | Set by Google |
wp-wpml_current_language | Remembers whether you are reading the Estonian or the English site | 1 day |
wordpress_*, wp-settings-* | Only for a logged-in editor. An ordinary visitor never receives these | Session to 1 year |
You can change your mind at any time: open cookie settings. You can also delete cookies in your browser settings, and the site will ask again next time.
Third parties
Where the data goes.
We do not sell or trade data. It is seen only by the providers whose services the site uses:
- Zone Media OÜ (Estonia) – hosting and email. All of the site’s data sits on their servers.
- Google Ireland Limited – Analytics and Search Console. Google may process data outside the European Union, relying on the European Commission’s standard contractual clauses and the EU-US Data Privacy Framework.
- Public authorities, where the law requires it. Not otherwise.
If we ever run an advertising pixel on the site, it will not fire before you have given consent, and this list gets a new row first.
Your rights
What you can ask for.
The General Data Protection Regulation gives you the right to ask what data we hold about you, to have it corrected or deleted, to restrict how it is used, to object to processing based on legitimate interest, to receive your data in a machine-readable form, and to withdraw consent you have given.
Write to hello@massruum.ee. We answer within a month and usually much faster – our mailbox is not a big one.
If the answer does not satisfy you, you can complain to the Estonian Data Protection Inspectorate: www.aki.ee, info@aki.ee, Tatari 39, Tallinn.
Changes
When this page changes.
If a new tool or cookie arrives on the site, we update this page and change the date at the top. If the change affects consent, the cookie notice asks again.
