1. Data controller
The controller of your personal data is Andrii Deleniv, trading as Deweb studio, ul. Krasiczyńska 8/75, 03-379 Warszawa, Polish tax ID (NIP) 5243037276 (“I” or “the Controller”).
For anything about your personal data, write to andrii.deleniv@gmail.com. I have not appointed a data protection officer because I am not required to.
2. What data I collect, why and on what basis
Quote form. Your name, the contact method you chose and the contact itself (email, Telegram or Instagram handle, WhatsApp number), your project description and the page language. I use them to reply, prepare a quote and, if we agree, sign a contract. Legal basis: Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) or, when your message is not about a contract, Art. 6(1)(f) GDPR (my legitimate interest in answering messages).
AI assistant chat. The conversation and, if you give them, your name, email or other contact and a convenient time for a call. The chat answers questions, books a free video call (Google Meet) or passes me a request to get in touch. Legal basis: Art. 6(1)(b) and (f) GDPR. Replies are generated by an AI model from Anthropic, so the conversation is sent to Anthropic. I do not store conversations on the server, except when you book a call or ask to be contacted: then the conversation and your contact details go to my CRM and a notification, and when you book, Google Calendar emails you an invitation.
Free website audit. The address of the website being checked and the audit result and, if you want the full report, your email or Instagram or Telegram handle. Legal basis: Art. 6(1)(b) GDPR (running the audit and giving you the report) and Art. 6(1)(f) GDPR (one message with advice on the result). You can object at any time by replying.
“Built your site with AI?” checklist. Your answers stay in your browser and are not sent to me.
Email and messengers. Whatever you give me in our correspondence. Legal basis: Art. 6(1)(b) or (f) GDPR.
Working together. If we sign a contract, I process the data needed to perform it (Art. 6(1)(b) GDPR) and to issue invoices and meet tax obligations (Art. 6(1)(c) GDPR).
Security and spam protection. Your IP address, date and time, the page visited and browser details are kept in server logs. The IP address is also used for limits that protect the form, chat and audit from abuse (stored as a hash and deleted within 24 hours), and Cloudflare Turnstile checks that you are human. Legal basis: Art. 6(1)(f) GDPR (website security).
Statistics without personal data. On my own server I count events such as “form opened” or “enquiry sent” (only the number and the page language, no IP and no cookies).
Analytics and advertising, only with your consent. Google Analytics, Microsoft Clarity, Google Ads and Meta Pixel show me how visitors use the site and whether ads work. Clarity records mouse movement, scrolling and clicks; text typed into form fields is masked. These tools start only after you agree in the banner. Legal basis: Art. 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law.
3. Who I share data with
I do not sell data. I use services from companies that process it on my behalf or as separate controllers:
- LH.pl sp. z o.o. (Poznań, Poland): website and server hosting.
- Google (Google Ireland Ltd, Google LLC): Gmail (enquiry notifications), Google Calendar and Meet (video calls), Google Tag Manager, Google Analytics, Google Ads.
- Telegram (Telegram FZ-LLC): notifications about new enquiries in my private chat.
- Anthropic PBC (USA): the AI model that answers in the chat. Under Anthropic’s terms, API data is not used to train models.
- Cloudflare, Inc. (USA): Turnstile bot protection.
- CookieYes Limited (UK): the cookie banner and a record of your consent.
- Microsoft Ireland Operations Ltd: Microsoft Clarity (with consent).
- Meta Platforms Ireland Ltd: Meta Pixel (with consent).
- Tina (SSW): the server the website’s images load from, so it sees your IP address.
- Public authorities, when the law requires it.
4. Transfers outside the EEA
Google, Microsoft, Meta, Cloudflare and Anthropic may process data in the USA. The transfer is based on the European Commission’s adequacy decision (EU-US Data Privacy Framework) for certified companies or on the Commission’s standard contractual clauses. The UK has an adequacy decision. Telegram notifications are transferred outside the EEA to handle your enquiry (Art. 49(1)(b) GDPR).
5. How long I keep data
- Enquiries that do not lead to a project: up to 12 months after our last contact.
- Client data: for as long as we work together, then until legal claims are time-barred; accounting records for 5 years from the end of the tax year.
- Audit reports: up to 12 months.
- Chat conversation in your browser: until you close the tab.
- IP-based spam limits: up to 24 hours.
- Analytics data: up to 14 months; cookies as listed in the table below.
- Data processed on the basis of consent: until you withdraw it.
6. Your rights
You have the right to access, rectify and erase your data, to restrict processing and to data portability. You can object at any time to processing based on my legitimate interest and withdraw your cookie consent (the “Cookie settings” link in the footer). Withdrawing consent does not affect processing that took place before.
To use these rights, write to andrii.deleniv@gmail.com. I will reply within one month.
You can also lodge a complaint with the Polish data protection authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or with the authority in your country.
7. Voluntary data and automated decisions
Giving your data is voluntary, but without a contact I cannot reply to your enquiry or send the report. I do not make decisions about you based solely on automated processing, including profiling, that have legal effects. The AI assistant only answers questions; decisions about working together are mine.
8. Cookies and similar technologies
Cookies are small files stored in your browser. The site also uses browser storage (localStorage and sessionStorage), which works in a similar way. Necessary ones are always on because the site does not work properly without them. Analytics and advertising ones start only after you agree in the banner.
| Name | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
dw_lang | deweb.studio | Remembers the language version you chose | 1 year | Necessary |
cookieyes-consent | CookieYes | Stores your choice in the cookie banner | 1 year | Necessary |
dw_chat (sessionStorage) | deweb.studio | Keeps your chat conversation when you move to another page | Until the tab is closed | Necessary |
dw_chat_teaser, dw-checklist (localStorage) | deweb.studio | Shows the chat greeting at most once a day; keeps your checklist answers | Until cleared in the browser | Functional |
dw-src, dw-ft, dw-path (sessionStorage) | deweb.studio | Where the visit came from (a UTM-tagged link, a search engine, social media) and which pages you open. Sent only together with the form, chat or audit, to show where the request came from | Until the tab is closed | Necessary |
dw-ft0 (localStorage) | deweb.studio | Where your first visit came from, if you come back directly | 30 days | Analytics |
Cloudflare Turnstile | Cloudflare | Tells people from bots on the form, chat and audit | Session | Necessary |
_ga, _ga_* | Google Analytics | Visit statistics: where visitors come from and what they read | Up to 2 years | Analytics |
_clck, _clsk, CLID, MUID | Microsoft Clarity | Click maps and session recordings (mouse movement, scrolling, clicks) | _clsk 1 day, others up to 1 year | Analytics |
_gcl_au | Google Ads | Measures whether a Google ad led to an enquiry | 90 days | Advertising |
_fbp, fr | Meta (Facebook, Instagram) | Ad measurement and remarketing on Facebook and Instagram | Up to 90 days | Advertising |
You can change or withdraw consent at any time via the “Cookie settings” link in the footer. You can also delete or block cookies in your browser settings, but some features may then stop working. Providers may rename their cookies; the banner shows the current list.
9. Changes to this policy
When the tools on the site or the law change, I will update this policy and the date at the top of the page. The Polish version is the binding one.