TRUST & TRANSPARENCY

Privacy Policy

Effective date: 2 November 2026

1. About this policy

This notice covers website visits, business enquiries, and the interactive browser-local demos. It does not describe all processing by the live monitoring product. Customer monitoring data, including page captures, listing information, and evidence, requires a verified service privacy notice and contractual processing terms before onboarding. Privacy contact: privacy@idxguard.com.

2. Information handled through the website

• Web requests: hosting and security infrastructure may receive IP addresses, browser and device information, requested URLs, timestamps, and error information when delivering pages.
• Enquiries: if you contact us using email, we receive the contact details, organization information, message, and attachments you send. Our published contact addresses use the idxguard.com domain. Cloudflare routes these messages to our Gmail inbox. Do not send passwords, confidential MLS credentials, or sensitive listing/client records by email.
• Demo information: fictional sites, review decisions, notes, and any domains you enter are stored locally in your browser. The demo does not send those records to a dashboard server or contact the entered websites. Use sample information only.
• Coverage planner: board and provider details, including optional client website domains and MLS assignments, are used locally to preview, download, or copy a coverage request. Create email draft opens your email app; you decide whether to send it. The website form does not submit an enquiry or place an order.
• Preferences: your motion setting and demo workspace session use browser storage, described in the storage notice.

3. How and why we use information

We are responsible for how personal information collected through this website is used. The table below explains why we use it and the legal basis for doing so.

When relying on legitimate interests, we consider your privacy rights and use only the information needed for the stated purpose.

Demo records remain in your browser. The coverage planner prepares a request locally and does not submit it to us; you choose whether to download, copy, or email it. See the Cookies & Browser Storage notice for details about saved preferences and demo data.

Optional Google Analytics measures visits to public website pages. It does not receive demo records or form entries through our integration, and demo dashboards are excluded from tracking. We do not use advertising tags. You can accept or reject analytics without affecting access to the website.

4. Recipients and service providers

Cloudflare provides website hosting, DNS, security infrastructure, and inbound email routing. Messages sent to our published domain addresses are forwarded to a Google Gmail inbox. Google Analytics 4 provides optional website measurement after consent. The separate private development preview uses OpenAI Sites and is not the public production host.

Infrastructure and email providers may receive information needed to deliver their services. Information may also be disclosed when required by law or necessary to protect lawful rights, including to professional advisers subject to appropriate duties. The demo code does not intentionally transmit demo records. After acceptance on eligible public pages, Google Analytics receives cookie identifiers, page-view events, browser/device information, and network request information used to measure website usage. See Google’s Privacy Policy and how Google uses partner-site information. Provider roles and terms depend on the service used. See the transfer information below.

The website code does not sell personal information or share it for cross-context behavioral advertising. It includes no advertising pixels; optional Google Analytics runs only after acceptance. The tag disables advertising personalization and Google Signals. This statement describes our use of this website and does not describe the separate monitoring service. Links and your email application involve separate providers with their own notices.

5. Retention and international processing

The periods below describe our operating targets and the provider settings noted. They do not promise that provider backups or all aggregated reports are erased on the same schedule.

• Routine hosting logs: We do not operate a separate application request-log database for this static website. Cloudflare processes operational and security information under its service terms and retention controls. If we retain incident or diagnostic extracts ourselves, our target is to delete them within 30 days unless a documented incident, legal obligation, or claim requires longer.
• Enquiries and correspondence: We aim to delete or anonymize inactive business enquiries 12 months after the last meaningful contact, unless an engagement, legal obligation, or documented claim requires separate retention. Provider backups and deletion schedules may delay final removal after deletion from the active mailbox.
• Privacy-request records: a minimal request and response log for up to 24 months after closure, used only for handling requests and demonstrating compliance. Retain longer only where required by law or a documented claim. Avoid retaining identity documents unless necessary.
• Browser-local information: the cookie notice explains each storage duration. Demo sign-out does not delete saved findings. Files downloaded to your device remain until you delete them.
• Google Analytics: the property was observed on 2 November 2026 with event-data retention set to 2 months, user-data retention set to 14 months, and reset of user retention on new activity enabled. These are the existing account settings, which were not changed. They apply to user/event-level information covered by those controls and do not limit all aggregated reports. Analytics cookie lifetimes are separately set to 180 days without renewal by this website integration.

We delete or anonymize records when they are no longer needed. A specific legal obligation, documented claim, or incident may require longer retention. Provider backups follow their own deletion schedules.

The operator is based in and may access enquiry and administrative information from Croatia. This does not mean providers process all information only in Croatia or the EEA. International processing: Cloudflare and Google operate international infrastructure, so information may be processed outside Croatia and the European Economic Area, including in the United States. Cloudflare describes its transfer arrangements in its Customer Data Processing Addendum; Google describes adequacy decisions, Data Privacy Framework participation, and standard contractual clauses in its data-transfer notice. The mechanism applicable to a particular transfer depends on the provider, service, and applicable terms. Contact us for information about the arrangements relevant to your enquiry.. See Cloudflare’s processing addendum and Google’s data-transfer notice. We do not promise EEA-only processing.

6. Choices and privacy requests

You can clear site storage through your browser and choose whether to send an enquiry. Where applicable law provides them, rights may include access, correction, deletion, portability, restriction, objection, withdrawal of consent, and opt-out of sale, targeted advertising, or certain profiling. We accept privacy requests from visitors regardless of their US state, and assess the rights and exceptions that apply to each request. This does not assert that every state privacy law applies to this business.

Send a request to privacy@idxguard.com, or by post to Otona Kučere 19, 43000 Bjelovar, Croatia, with a description of the request and a way to contact you. We may ask only for proportionate information needed to verify identity or an authorized agent’s authority. Do not send a password or government ID unless a specific and justified secure verification process is agreed. Requests can be made without creating an account.

Our operating targets are to acknowledge within 2 business days and respond without undue delay, aiming for 30 calendar days. Where GDPR applies, respond no later than one month; any shorter mandatory deadline takes priority. Use only legally permitted extensions and explain the reason and new deadline within the original response period.

If we decline all or part of a request, explain the reason and the review or complaint options available. You may ask for a review by emailing privacy@idxguard.com with “Privacy appeal” in the subject and explaining the concern. Our target is to respond to a review request within 30 calendar days, subject to any shorter required deadline. Do not discriminate against visitors for exercising applicable privacy rights.

You may complain to the relevant authority, including AZOP for the Croatian operator or your applicable US state regulator. The available rights, deadlines, and exceptions depend on the law that applies to your request.

Use Cookie settings in any footer to reject optional analytics, accept it, or withdraw a choice. Rejecting analytics does not restrict access. When your browser sends Global Privacy Control or Do Not Track, we keep optional analytics off and skip the consent banner. Cookie settings remains available to explain the active browser preference. This Analytics integration is enabled only on the production domain after acceptance. Storage details are in the cookie notice.

7. Security, children, and changes

This is a business website and is not directed to children under 13. Do not submit children's information. No website can guarantee absolute security. The simulated demo login is not a security control for real data. We will update this notice when the covered practices change and update the published effective date.

8. Website operator and contact

IDX Guard is operated by K.O., obrt za IT usluge, vl. Oleksii Komarov, a Croatian obrt (sole proprietorship), OIB 90255040664. Business address: Otona Kučere 19, 43000 Bjelovar, Croatia.

Privacy questions and requests: privacy@idxguard.com.