Privacy policy

What I collect

What you enter in the form: your name, email address, a description of what needs to change and the type of project — and, if you give them, your company name, current website address and phone number.

Why, and on what legal basis

To reply to your message and talk about the project before you decide whether to work together. The legal basis is Article 6(1)(b) GDPR (steps taken at your request before entering into a contract) and, for the correspondence itself, Article 6(1)(f) GDPR (a legitimate interest in replying to your message).

I don't use this data for a newsletter or for advertising, and I don't use it for automated decisions or profiling.

How long

For as long as it takes to reply and talk about the project. If we work together, also for the duration of the project and for as long as the law requires.

Who else can access it

Only the providers the site and email can't work without: Vercel, whose servers run the site and carry the form's message; Resend, which delivers it to my inbox; and the provider of that mailbox.

Vercel and Resend are based in the United States, so the form data leaves the European Economic Area. Both are certified under the EU-US Data Privacy Framework, so the transfer relies on the European Commission's adequacy decision.

I don't sell the data or share it with anyone for marketing.

Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing, to data portability, and to object. To use them, write to the address above. You can also lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO).

Do I have to give my data?

Giving your data is voluntary, but without your name, email address and a description I can't reply.

Cookies, analytics and technical data

The site doesn't use cookies or analytics tools, and it doesn't track visitors.

As with any website, the hosting (Vercel) technically processes the IP address and basic request data, such as the page address and browser type, on every visit, to deliver the site and protect it from abuse. Vercel processes this data as a separate controller, under its own privacy notice (vercel.com/legal/privacy-notice).

To limit abuse of the form, the site's code keeps the IP address only in the server's working memory, to count sending attempts from the last 10 minutes. An entry is removed at the first form submission after those 10 minutes, and all of that memory when the server shuts down. The address isn't added to the message or saved in any database. The legal basis is my legitimate interest in keeping the form secure (Article 6(1)(f) GDPR).