DRAFT for legal review. Fill in every [BRACKETED FIELD], resolve every [VERIFY] / [LEGAL REVIEW] marker and remove this notice before publishing.
Privacy Policy — GorCore contact form
This policy explains how personal data submitted through the contact form on gorcore.com is processed. The Content Loop application has its own policy at /privacy/.
1. Who is responsible
This website is operated under the name GorCore by an individual, [FULL NAME OF THE OPERATOR], Republic of Moldova. GorCore is a personal project and is not a registered company. The operator is the controller of the personal data described here.
Postal address of the operator: [POSTAL ADDRESS: locality and country].
Contact for all privacy matters, including requests to access or delete your data: privacy@gorcore.com [VERIFY: the mailbox exists, receives mail and is monitored before publication].
2. What we collect
Through the contact form: your name, company (optional), phone number and/or e-mail address, the topic you select, your message, the language of the page, and the time you submitted the form and gave consent. Your name and a phone number or e-mail address are needed so that we can answer you; the other fields are optional.
Technical data: your IP address is processed by Cloudflare to deliver and protect the website. We do not store your IP address in our database; to limit abuse we keep only a salted, irreversible hash of it for at most 2 hours.
This website does not set cookies and does not store data in your browser on its own. The anti-abuse check (Cloudflare Turnstile) may use technical storage in your browser. [VERIFY on the production domain]
3. Why and on what basis
To answer your enquiry and, if you wish, prepare an offer: your consent (Art. 6(1)(a) GDPR; Art. 6 of Law No. 195/2024) and steps taken at your request before a contract (Art. 6(1)(b)).
To protect the form against spam and abuse: our legitimate interest (Art. 6(1)(f)).
To handle requests about your data and keep the records needed to show that we comply: legal obligation.
Applicable law: Law No. 195/2024 of the Republic of Moldova on personal data protection (in force since 23 August 2026) and, to the extent it applies to the data of people in the EU/EEA, Regulation (EU) 2016/679 (GDPR). [LEGAL REVIEW: confirm the legal bases, and whether and to what extent the GDPR applies]
4. Who receives your data
Cloudflare, Inc. (processor): hosts and delivers the website, provides DNS, the Turnstile anti-abuse check, Workers and the Cloudflare D1 database in which contact requests are stored.
Telegram Messenger is used only to tell the operator that a request has arrived. The notification contains an internal request number and nothing else: not your name, contact details or message. The request itself stays in our database and is read only by the operator.
E-mails you send to privacy@gorcore.com are forwarded by Cloudflare Email Routing to the operator's own mailbox. [VERIFY: name and location of the operator's mailbox provider]
We do not sell your data, do not use it for advertising and do not pass it to anyone else, except to authorities where the law requires it.
5. Transfers outside Moldova and the EU
Cloudflare may process data in several countries, including the United States; transfers rely on Cloudflare's EU–U.S. Data Privacy Framework certification and the standard contractual clauses in its data processing agreement. [VERIFY: Cloudflare's status on the official DPF list]
No personal data is sent to Telegram (see section 4).
6. How long we keep it
Contact requests are stored for 180 days from submission and are then deleted automatically (the check runs every hour). This applies to requests that could not be delivered as well.
Deleted data may remain in technical backups of the database (Cloudflare D1 Time Travel) for up to 30 days after deletion and is then removed permanently.
The hash used to limit abuse is kept for at most 2 hours. The Telegram notification contains no personal data, so it is not subject to this period.
7. Your rights
You have the right to access your data, have it corrected or deleted, restrict or object to its processing, receive it in a portable form, and withdraw your consent at any time (this does not affect the lawfulness of earlier processing).
Write to privacy@gorcore.com. We may ask you to confirm your identity. We answer without undue delay and in any case within one month of receiving your request.
To delete a specific request, write from the e-mail address or phone number you used and give the approximate date. We delete it from the database without undue delay and confirm this to you; backups are covered in section 6.
8. Complaints
You may lodge a complaint with the National Centre for Personal Data Protection of the Republic of Moldova (www.datepersonale.md, Chișinău, Serghei Lazo street 48). [VERIFY: current contact details] If you live in the EU/EEA you may also complain to the supervisory authority of your country.
9. Security
The website uses HTTPS. Requests can be read only by the operator, through an access-restricted command-line tool; there is no web administration panel. Your IP address is not stored (only a hash) and logs do not contain the content of requests. If a personal data breach is likely to put you at risk, we will notify the authority within 72 hours and the persons concerned where the law requires. [VERIFY]
10. Changes
We may update this policy; the date of the latest version is shown below.
Last updated: [DATE OF LAST UPDATE]