Privacy policy
What I collect, why, and how to say no
This policy covers every page and tool under ciunkos.com. I keep it short on purpose. If a sentence here is unclear, write to me and I will fix the sentence.
Last updated:
Who is responsible
Data controller: Przemysław Zalewski, ul. Tęczowa 31A/56, 53-601 Wrocław, Poland · NIP 8952144360 · REGON 367652014
Contact: ciunkos@gmail.com
I am the data controller for everything on this domain. There is no data protection officer, because the law does not require one for a business of this size, so questions go straight to me.
What I do not do
- I do not sell or share your data, and I do not work with data brokers.
- No advertising pixels: no Meta, TikTok, Google Ads or LinkedIn tags, and no retargeting anywhere.
- No cookie banner, because there are no tracking cookies. Analytics stores a random id in your browser’s local storage, and you can turn it off below.
- I do not read the reports my tools generate for you, and I do not train models on your data.
- I do not send marketing email unless you asked for a specific list, and every message has a one-click unsubscribe.
What I collect and why
Visiting the pages
PostHog in the EU records page views, clicks, Web Vitals, errors and session replays with every input masked. A random identifier lives in local storage, no cookies. Legal basis: my legitimate interest in understanding what works and what breaks, so I can build better tools and services. You can opt out below, and browsers that send Global Privacy Control or Do Not Track are respected.
Writing or booking a call
Email through Gmail, bookings through Cal.com, calls on Google Meet. I keep your name, email and what we discussed. Legal basis: steps before a contract, at your request.
Using the free tools
Each tool stores only what it needs to show you the result, in Cloudflare databases in the EU, and deletes it after the period in the table below. If you ask for a report by email, Resend sends it from the EU and a copy of the request goes to me so I can follow up if you want to talk.
Tools with AI inside
What you type goes to the model, Claude by Anthropic through Cloudflare AI Gateway, or Workers AI for the agent on the hire pages. API traffic is not used for training. The text is kept only as long as the report it produced.
Newsletter and skill updates
Your address on the list you picked, with the date and the list name. Legal basis: consent, given by clicking the button. Unsubscribe in one click from any message; a hash of the address then stays on a suppression list so you are not emailed again.
Being a client
Company details for contracts and invoices, kept for five years after the tax year because Polish law says so. Your code and your customers’ data are handled under our contract and a data processing agreement, which take precedence over this page.
Turn analytics off on this device
One click, no account. The setting lives in your browser, so repeat it on each device or browser you use. Clearing site data resets it.
How long I keep things
| What | How long |
|---|---|
| Session replays (PostHog) | 30 days |
| Analytics events (PostHog) | Up to 12 months, then aggregated |
| Quote Desk: items read from your inquiry file | 30 days; the file itself is never stored |
| Business idea validator reports | 180 days under a random link, deletable from the report page |
| Eval Desk and AI Visibility results | 180 days, everything with the account; a hashed usage counter 62 days |
| Vitals Desk measurements of public pages | 400 days (page addresses, no personal data) |
| Newsletter and skill update lists | Until you unsubscribe; a hash of the address stays on a suppression list so you are not emailed again |
| Email and call notes with people who contact me | Up to 3 years after the last contact |
| Contracts and invoices | 5 years after the end of the tax year (Polish law) |
Who processes data for me
| Processor | What for | Where | Transfer basis |
|---|---|---|---|
| Cloudflare, Inc. | Hosting of every page and tool (Workers), databases and storage (D1, KV, R2), AI Gateway, Workers AI, inbound email routing, access control for admin panels | Global edge network; data stores in the EU where the product allows it | EU-US Data Privacy Framework and SCCs |
| PostHog, Inc. | Product analytics: page views, clicks, Web Vitals, errors, session replays with inputs masked | EU cloud (Frankfurt) | None: data stays in the EU |
| Resend, Inc. | Transactional email: confirmations, report links, newsletter broadcasts | EU region (eu-west-1) | SCCs in the Resend DPA |
| Anthropic, PBC | Language models (Claude) behind the AI tools, called through Cloudflare AI Gateway; API data is not used for training | United States | SCCs in the Anthropic DPA |
| Cal.com, Inc. | Booking the free 30-minute call: your name, email and the time you pick | United States | SCCs in the Cal.com DPA |
| Google LLC | Email correspondence (Gmail) and video calls (Google Meet) | EU and United States | EU-US Data Privacy Framework |
| GitHub, Inc. | Public source code of this site and the agent skills; your repositories only when you invite me | United States | EU-US Data Privacy Framework |
| wFirma.pl | Invoices and bookkeeping for clients (company name, address, tax id) | Poland | None |
Transfers outside the European Economic Area rely on the EU-US Data Privacy Framework where the processor is certified, and on standard contractual clauses otherwise. Each processor has a data processing agreement with me.
Your rights
Under GDPR you can ask for access, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest or withdraw consent at any time. One email is enough. I reply within 24 hours on working days and complete the request within 30 days, usually much sooner. If you are not satisfied, you can complain to the Polish supervisory authority, the Urząd Ochrony Danych Osobowych (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or to the authority in your own country.
If you are in the United Kingdom, UK GDPR gives you the same rights and the Information Commissioner’s Office hears complaints. If you are in California, I do not sell or share personal information, I do not use it for profiling with legal effects, you have the right to know and to delete, and Global Privacy Control signals are honored as an opt-out.
Children, changes, contact
These pages and tools are for adults running or building a business and are not directed at anyone under 16. Changes to this policy carry a new date at the top and a short note of what changed. Questions and requests: email me at the address in the footer.