Scope and who is responsible
This Privacy Policy describes how AVEN STUDIOS računalniško programiranje Marko Vodopivec s.p., doing business as SameSideSystems ("SameSideSystems," "we," "us," or "our"), handles personal information when people visit this U.S.-facing website, contact us, or ask about our services. The responsible operator is established in Slovenia. This notice does not limit rights that may apply under U.S. state, Slovenian, EEA, UK, or other applicable law.
It does not automatically cover client websites, client-controlled campaigns, or services where SameSideSystems processes information solely on a client's instructions. The applicable client should explain those practices in its own notice.
Privacy contact
Email: hello@samesidesystems.com
Postal address: Potok pri Dornberku 6, 5294 Dornberk, Slovenia
U.S. contact address: 15442 Ventura Boulevard, Sherman Oaks, CA 91403, United States
Registration number: 7415079000
Tax number: 21195501
Privacy requests: hello@samesidesystems.com
Telephone request line: We do not currently provide one; requests can be submitted by email or post.
Information we collect and why
The table below summarizes the website data flows as updated on July 17, 2026. The public site includes a first-party inquiry form and, only after affirmative Preferences consent, an embedded LeadConnector/HighLevel chat feature. It does not currently include a payment flow or advertising pixel. We use information only for disclosed purposes that are compatible with the context in which it was collected, unless we provide another notice or obtain consent where required.
| Category and examples | Sources | Purposes | Recipients | Retention |
|---|---|---|---|---|
| Contact identifiers Name, business email, company, job role, and other details you voluntarily send to us. |
Directly from you or an authorized colleague through the website inquiry form or your email application. The form asks for name, company, business email, and acceptance of this notice; website address and a short message are optional. | Respond to inquiries, schedule calls, prepare proposals, maintain business records, prevent abuse, and follow up where permitted. | Authorized staff; Vercel for hosting and request delivery; Resend for sending the inquiry notification to our business inbox; professional advisers when needed. | While we respond to the inquiry or maintain a business relationship, then only as reasonably needed for business and legal records, disputes, security, and applicable legal obligations. We periodically review and delete or deidentify information that is no longer needed. |
| Embedded chat information Anything you choose to enter in the chat, plus page, device, network, and conversation context processed by the chat provider. |
Directly from you and your browser if you enable Preferences and use the LeadConnector/HighLevel chat on public non-legal pages. | After you enable Preferences, display the chat, respond to a communication you request, maintain the conversation, and prevent misuse. | LeadConnector/HighLevel, the owner of the configured chat-widget account, and their authorized subprocessors. Review the notice shown in the widget before submitting information. | Controlled by the chat provider and configured account owner under their settings, terms, and applicable legal obligations. |
| Inquiry and project information Messages, requested services, budget or timeline information, files you choose to send, and correspondence. |
Directly from you or your organization. | Evaluate and deliver requested services, communicate, secure the service, resolve disputes, and comply with law. | Authorized staff; collaboration and communications providers; professional advisers and authorities when legally necessary. | For the inquiry or project relationship and afterward only as reasonably needed for contractual, accounting, tax, dispute, security, and other legal obligations. Records that are no longer needed are deleted or deidentified following periodic review. |
| Device, network, and activity data IP address, browser and device type, pages requested, timestamps, referring URL, approximate location derived from IP, and security events. |
Your browser or device; hosting, content delivery, and security systems. | Deliver and secure the website, diagnose errors, maintain logs, measure reliability, and detect fraud or abuse. | Vercel, our hosting and delivery provider; authorized staff; and authorities when legally required. See Vercel's privacy notice. | Under our current Vercel Hobby plan, runtime log entries are available to us for up to one hour. Vercel may process and retain service and security data under its own terms and privacy notice. |
| Privacy choice data Your consent categories, policy version, Global Privacy Control status, choice source, and timestamps. |
Your browser and the choices you make. | Remember and apply privacy choices, demonstrate compliance, and prevent optional tools from loading without permission. | The browser-local preference module only. We do not currently maintain a server-side consent log. | The browser preference expires 180 days after the latest saved choice unless you clear it sooner. No server-side consent record is currently used. |
| Optional analytics and interaction data Page views, navigation, coarse device and geography data, campaign parameters, performance events, and—only if enabled and configured—masked heatmaps or session replay. |
Your browser only after analytics consent; Google Analytics 4, Microsoft Clarity, and Vercel Web Analytics. | Understand aggregate use, improve content and usability, diagnose problems, and measure site performance. | Authorized staff and the listed analytics or heatmap processors, subject to configured restrictions and contracts. | Google Analytics browser cookies were observed with a 400-day maximum in Chrome; browser rules or your settings may shorten that period. The GA4 property's raw user/event retention must still be verified in the dashboard before legal approval. Microsoft Clarity recordings are generally retained for up to 30 days, selected or favorited recordings for up to 9 months, and heatmaps for up to 9 months. Vercel Web Analytics does not set cookies or local-storage identifiers; service retention follows the project's Vercel plan and Vercel's current terms. Exact browser-storage durations appear in the Cookie Policy. |
| Advertising and conversion data The preference manager reserves an advertising category for possible future use. |
Not currently collected by an advertising, social, or conversion provider on this website. | Not currently used. | No advertising, social, retargeting, or conversion provider is registered in the production consent manager. | Not applicable while this category is unused. |
We may also create aggregated or deidentified information. We will maintain it in deidentified form and will not attempt to reidentify it except where permitted by law to test whether our deidentification processes are effective.
Cookies, analytics, and heatmaps
We use strictly necessary browser storage to operate privacy controls and essential site functions. Google Analytics 4, Microsoft Clarity, and Vercel Web Analytics are optional analytics tools and remain completely unloaded until the visitor affirmatively enables Analytics. The LeadConnector/HighLevel chat is registered under Preferences and remains completely unloaded until the visitor affirmatively enables Preferences. The Advertising category is available in the controls but no provider is currently registered in it.
If Preferences are enabled, the embedded LeadConnector/HighLevel chat loads on public non-legal pages so a visitor can choose to open it and request a response. If Preferences are declined, the first-party inquiry form remains available. Do not enter sensitive information in the chat.
The consent module itself does not send the saved choice to SameSideSystems or a third party. It stores a versioned preference record in this browser's local storage for 180 days. We do not currently keep a server-side consent log.
Read the Cookie Policy for the current technology inventory, purposes, durations, and controls. You can reopen the panel at any time by selecting Privacy choices.
Heatmap and session-replay guardrails
Microsoft Clarity loads only after analytics consent. Its project currently uses Balanced masking, and the complete inquiry drawer is additionally marked for masking so form fields and submitted values are excluded from recorded page content. The website does not send form-field values to Google Analytics or Clarity events. Masking reduces risk but does not make every item of visible page content anonymous, so production recordings and network traffic are reviewed after form releases.
Disclosures, sale, sharing, and targeted advertising
We may disclose the categories above to vendors that help us host, secure, communicate, analyze, and operate the website; to professional advisers; in a business transaction; or when reasonably necessary to comply with law, protect rights and safety, or investigate misuse. Current website providers include Vercel for hosting and consented Web Analytics, Resend for transmitting inquiry notifications, LeadConnector/HighLevel and the configured widget-account owner for embedded chat only after Preferences consent, and Google Analytics and Microsoft Clarity only after Analytics consent for measurement.
These providers may process information in the United States and other countries. Where applicable law requires it, cross-border processing must use an appropriate transfer mechanism and contractual safeguards. The legal basis, contracts, and transfer mechanism still require qualified review before this draft is approved.
Current advertising status
We do not sell personal information for money. The production website does not currently use advertising pixels, social-media pixels, retargeting audiences, or targeted-advertising providers. Google Analytics, Microsoft Clarity, and Vercel Web Analytics load only after analytics consent and are configured for measurement; Google Signals and ad personalization are disabled. Whether a particular analytics disclosure is legally classified as a sale, sharing, or targeted advertising can depend on the applicable law and vendor contract, so that classification remains part of the legal review.
Direct-marketing and youth status: We do not currently disclose website information to third parties for their own direct marketing. This business-services website is intended for adults, has no age-gated or child-directed flow, and we do not have actual knowledge from the current website flow that a visitor is under 16. We will revalidate this statement whenever vendors, campaigns, forms, or age flows change.
Your privacy rights
Depending on where you live, the law that applies to SameSideSystems, and applicable thresholds and exceptions, U.S. state, EEA, UK, or other privacy law may give you the right to:
- confirm whether we process your personal information and access or know specific information about it;
- correct inaccurate personal information;
- delete personal information, subject to exceptions;
- receive a portable copy of certain information;
- opt out of sale, sharing, targeted advertising, or certain profiling;
- limit certain uses or disclosures of sensitive personal information;
- withdraw consent for processing that relies on consent; and
- appeal a denied privacy request where state law provides that right.
How to submit a request
Email hello@samesidesystems.com or write to the postal address in Section 1. We do not currently provide a telephone request line. To appeal a request decision where an appeal right applies, email the same address with the subject line “Privacy appeal”; we will respond through the verified request channel.
We may need to verify your identity and authority using information proportionate to the request. An authorized agent may submit a request where applicable; we may ask for signed permission or direct confirmation unless the agent has valid legal authority. We will not discriminate against you for exercising a privacy right. If we deny a request, we will explain the basis where required.
Changing browser preferences affects future optional tracking on this browser. It does not, by itself, delete information already retained by a provider or complete an access/deletion request. Use the request channels above for those actions.
Global Privacy Control and Do Not Track
When this website detects Global Privacy Control (GPC), both the server and browser preference manager treat the Sec-GPC: 1 request as an opt-out of advertising, sale, and sharing uses for that browser. The response is varied by the GPC header, and GPC prevents the advertising category from being enabled even if “Accept all” is selected. The site has no login or account system through which to associate that browser signal with an identified account.
We do not separately respond to the older, non-standardized browser “Do Not Track” setting. Microsoft Clarity does not independently honor Do Not Track, but on this website it remains completely unloaded unless you affirmatively enable analytics. Third parties may receive activity only as described in the current inventory and subject to the choices above.
Sensitive information and data minimization
Please do not send government identifiers, account credentials, precise geolocation, health information, biometric information, payment-card data, information about children, or other sensitive personal information by general email unless we specifically request it through an appropriate channel.
The website inquiry form is limited to ordinary business contact and project-interest information and does not intentionally request sensitive personal information. Please do not place sensitive information in its optional message field or in the embedded chat. Any future workflow that needs such data must receive a field-by-field privacy and security review, an updated notice, and consent where applicable before launch.
Retention and security
We keep personal information only as long as reasonably necessary for the disclosed purpose, including providing services, maintaining appropriate business and legal records, resolving disputes, preventing fraud, enforcing agreements, and meeting legal obligations. The category-specific periods or criteria appear in the collection table and cookie inventory.
We use administrative, technical, and physical safeguards designed for the nature of the information and the risks involved. No website, transmission, or storage system can be guaranteed completely secure. If a legally reportable incident occurs, we will provide notices required by applicable law.
Children's privacy
This general business website is intended for adults and is not directed to children under 13. We do not knowingly collect personal information online from a child under 13 without the notice and verifiable parental consent required by the Children's Online Privacy Protection Act. If you believe a child has provided information, contact us using the details above.
Before any content, campaign, form, or service is designed for children or creates actual knowledge of a user's age, SameSideSystems must complete a separate COPPA and state youth-privacy assessment. Persistent identifiers used for tracking can be personal information under COPPA.
Third-party links, changes, and contact
The website may link to sites and services we do not control. Their privacy practices are governed by their own notices. Review them before providing personal information.
We may update this policy as our practices, vendors, or laws change. We will post the revised policy with a new effective date and provide additional notice where required. The policy owner will review this notice at least annually and whenever a material data-flow change is proposed.
Questions or requests can be sent to hello@samesidesystems.com or AVEN STUDIOS računalniško programiranje Marko Vodopivec s.p., Potok pri Dornberku 6, 5294 Dornberk, Slovenia.