sgat.me website
Privacy Policy
Effective 1 October 2026Version 1.1
Contents
sgat.me — marketing website for the Tales & Tails app
This Policy covers the marketing website only. Data processing inside the Tales & Tails mobile and web app (account, library, reading sessions, Nine Tails subscription) is governed by a separate in-app Privacy Policy.
1. Who processes your data
The data owner under the Law of Ukraine "On Personal Data Protection" and the data controller under Regulation (EU) 2016/679 ("GDPR") is:
| Owner / controller | Hombosh Tomash Zoltanovych (individual entrepreneur, Ukraine) |
|---|---|
| Tax ID (RNOKPP) | 3461006118 |
| Address | 15 Lomonosova St., Vynohradiv, Zakarpattia Oblast, 90300, Ukraine |
| Privacy contact | privacy@sgat.me |
| General contact | hello@sgat.me |
Use of this address. The address is published only to meet legal disclosure requirements and is intended solely for official correspondence. Using it to cause harm, to harass or threaten anyone, for fraud, or for any other unlawful purpose is prohibited and entails liability under the law of Ukraine.
We have not appointed a Data Protection Officer, as we do not meet the criteria of Art. 37 GDPR. All privacy requests are handled at privacy@sgat.me.
2. In short: what happens when you visit
- The site has no sign-up, newsletter or contact forms. We never ask you to enter your name, email or any other detail.
- We do not create accounts on this site.
- The site shows no advertising.
- We use strictly necessary cookies (always active) and — only with your consent — analytics and marketing cookies and pixels.
- You can use the entire site after declining all optional cookies.
3. What data we process
3.1. Technical data (always processed)
Every request to the site causes our hosting provider and CDN to receive:
- IP address (truncated/anonymised in logs where technically possible);
- date and time of the request, requested URL, response code;
- browser type and version, operating system, interface language;
- referrer, if sent by your browser.
| Purpose | Serving the site, security, detecting attacks and abuse, troubleshooting. |
|---|---|
| Legal basis | Legitimate interests — Art. 6(1)(f) GDPR; Art. 11 of the Law of Ukraine "On Personal Data Protection". |
| Retention | 30 days in server logs, then deleted or irreversibly anonymised. |
3.2. Analytics data (consent only)
Every measurement tag is delivered through Google Tag Manager, a container that collects no statistics for us but, once loaded, receives your IP address and browser details. It loads only after you consent; §5 lists the tags the container currently holds.
Where Google Analytics 4 is enabled on the site, the following is processed in addition: a pseudonymous device/browser identifier, pages viewed, visit duration, referral source, approximate region (city/oblast level, derived from an IP address Google does not store), device type. §5 lists what is currently active.
| Purpose | Measuring site and marketing channel performance, improving content. |
|---|---|
| Legal basis | Consent — Art. 6(1)(a) GDPR; Art. 11(1) of the Ukrainian Law. |
| Retention | Up to 14 months in Google Analytics; cookies up to 24 months (see §5). |
3.3. Marketing data (consent only)
We use Meta Pixel (Meta Platforms Ireland Limited) and the other advertising pixels listed in §5 to measure campaign performance and to show ads for the app to people with similar interests. Processed: pseudonymous identifiers, the fact of your visit and pages viewed, interaction with download buttons.
| Purpose | Conversion measurement, retargeting, lookalike audiences. |
|---|---|
| Legal basis | Consent — Art. 6(1)(a) GDPR. |
| Retention | As defined by each platform's policies; cookies up to 90 days for Meta. |
3.4. What we do not do on this site
- collect special category data (health, religious or political beliefs, biometrics);
- sell personal data;
- make automated decisions producing legal effects for you, or profile you beyond the advertising analytics described above;
- knowingly collect children's data (see §9).
4. Recipients of your data
| Recipient | Role | What it receives | Jurisdiction |
|---|---|---|---|
| Amazon Web Services (Amazon S3 + Amazon CloudFront) | Hosting / CDN, processor acting on our instructions | Technical data §3.1 | EU — Stockholm, Sweden (AWS region eu-north-1); delivery through the global CloudFront edge network |
| Google Ireland Limited / Google LLC | Tag management (Google Tag Manager) and analytics (GA4), joint/independent controller per Google's terms | Data §3.2 | EU / USA |
| Meta Platforms Ireland Limited | Advertising analytics, joint controller for measurement | Data §3.3 | EU / USA |
| Competent authorities | Upon a binding legal request | As scoped by the request | Ukraine |
We do not share data with any other third parties except where required by law.
International transfers. Google and Meta may process data outside Ukraine and the EEA, including in the USA, on the basis of the European Commission's Standard Contractual Clauses (SCCs) and/or their participation in the EU–US Data Privacy Framework. A copy of the relevant safeguards is available on request at privacy@sgat.me.
5. Cookies and similar technologies
On your first visit we display a consent banner. No optional script loads before you make a choice. You can change your decision at any time via the "Cookie settings" link in the site footer — withdrawing consent is as easy as giving it.
5.1. Strictly necessary (no consent required)
| Cookie | Purpose | Lifetime |
|---|---|---|
tt_consent |
Stores your cookie choice together with the Policy version and the time of the choice | 12 months |
| Hosting/CDN session cookies | Load balancing, attack protection | Session |
5.2. Analytics (consent)
| Cookie | Provider | Purpose | Lifetime |
|---|---|---|---|
_ga, _ga_* |
Distinguishing visitors, aggregate statistics | up to 24 months |
The Google Tag Manager container sets no cookies itself — the tags inside it do. Even so, the container loads only after you consent: if you refuse both categories it never appears on the page at all.
5.3. Marketing (consent)
| Cookie | Provider | Purpose | Lifetime |
|---|---|---|---|
_fbp, _fbc |
Meta | Conversion measurement, retargeting | up to 90 days |
_gcl_au |
Links visits to ad clicks (conversion linker) | up to 90 days |
You may also manage cookies in your browser settings. Blocking strictly necessary cookies may break the site.
6. Your rights
Wherever you are located, you have the right to:
- know whether we process your data and obtain a copy (access);
- rectify inaccurate data;
- erase your data ("right to be forgotten");
- restrict processing;
- object to processing based on legitimate interests, and to direct marketing at any time without giving reasons;
- receive your data in a structured format and transmit it to another controller (portability);
- withdraw consent at any time — this does not affect the lawfulness of processing before withdrawal;
- lodge a complaint with a supervisory authority.
How to exercise them: email privacy@sgat.me. We respond within 30 calendar days (extendable by a further 60 days for complex requests, with notice and reasons). Because the site has no user accounts, in most cases we cannot identify you from a visit alone; we will then ask you for identifiers (for example, cookie values) or inform you that we hold no data relating to you (Art. 11 GDPR).
Where to complain:
- Ukraine: Ukrainian Parliament Commissioner for Human Rights — ombudsman.gov.ua
- EEA: the supervisory authority of your habitual residence, place of work, or place of the alleged infringement
7. Security
The site is served exclusively over HTTPS. Access to analytics dashboards is restricted and protected by two-factor authentication. We store no user credentials on this site because we collect none. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security, but we apply organisational and technical measures proportionate to the risk.
8. Retention summary
| Category | Retention |
|---|---|
| Server logs | 30 days |
| GA4 analytics | up to 14 months |
| Marketing identifiers | up to 90 days (Meta) |
| Record of your consent/refusal | 12 months or until withdrawal |
| Privacy request correspondence | 3 years (proof of compliance) |
9. Children
The site is intended for adults and is not directed at children. We do not knowingly collect data from anyone under 16 (or a lower age set by an EEA member state, but not below 13). If you believe a child has provided us with data, write to privacy@sgat.me and we will delete it.
10. Changes to this Policy
We may update this Policy. The current version is always available at sgat.me/privacy, with the effective date at the top. We will announce material changes (new data categories, new recipients, new purposes) via a prominent site banner at least 14 days before they take effect and, where required, request your consent again.
11. Contact
Questions, rights requests, complaints: privacy@sgat.me
Individual entrepreneur Hombosh Tomash Zoltanovych, 15 Lomonosova St., Vynohradiv, Zakarpattia Oblast, 90300, Ukraine
In case of any discrepancy, the Ukrainian version prevails.