Privacy Policy & Cookies

1. Data Controller

The controller of your personal data is:

2. What Data We Collect

• ◆ Contact form data - name, email address, message content, and any other information you voluntarily provide.
• ◆ Analytics data - IP address (anonymized), browser type, operating system, screen resolution, traffic source, pages visited, time on site, clicks, scrolling, mouse movements (heatmaps), session recordings.
• ◆ Cookie data - session identifiers and preferences as described in the cookies section below.

3. Purposes of Processing

• ◆ Responding to inquiries - answering messages submitted through the contact form.
• ◆ Analytics - analyzing website traffic, understanding user behavior, improving site quality.
• ◆ Marketing - tailoring content and communications to user needs.

4. Legal Basis

We process your data under the General Data Protection Regulation (EU) 2016/679 (GDPR), specifically:

• ◆ Art. 6(1)(a) - consent (e.g. for analytics cookies).
• ◆ Art. 6(1)(b) - necessity for the performance of a contract or to take steps at your request (e.g. responding to an inquiry).
• ◆ Art. 6(1)(f) - legitimate interest of the controller (analytics, direct marketing).

5. Data Recipients

Your data may be shared with the following third parties:

• ◆ Google LLC - Google Tag Manager, Google Analytics 4 (website traffic analysis). Google Privacy Policy.
• ◆ Microsoft Corporation - Microsoft Clarity (heatmaps, session recordings, user behavior analysis). Clarity Terms of Use.

Data may be transferred to third countries (USA) based on Standard Contractual Clauses or the European Commission's adequacy decision (EU-US Data Privacy Framework).

6. Cookies

The aikuznia.pl website uses cookies - small text files stored on your device. Below is a list of cookies we use:

Essential cookies

Analytics cookies - Google Analytics

Analytics cookies - Microsoft Clarity

7. Managing Cookies

You can manage cookies by changing your browser settings. Here are instructions for the most popular browsers:

• Google Chrome
• Mozilla Firefox
• Safari
• Microsoft Edge

Deleting or blocking cookies may affect the functionality of some website features.

8. Your Rights

Under GDPR, you have the following rights:

• ◆ Right of access - you may request information about what personal data we process.
• ◆ Right to rectification - you may correct inaccurate or incomplete data.
• ◆ Right to erasure - you may request the deletion of your data ("right to be forgotten").
• ◆ Right to restriction - you may restrict the scope of data processing.
• ◆ Right to data portability - you may receive your data in a machine-readable format.
• ◆ Right to object - you may object to processing based on legitimate interest.
• ◆ Right to withdraw consent - you may withdraw your consent at any time, which does not affect the lawfulness of processing carried out before withdrawal.

You also have the right to lodge a complaint with the supervisory authority - the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl).

9. Prompt Forge - additional data processing

If you use the Prompt Forge tool (aikuznia.pl/forge/), additional data processing applies in addition to the rules above.

9.1 Purpose

We store the prompts you submit to Prompt Forge anonymously (without your name, email, or IP address) in order to understand what goals people want to achieve with AI and to build better educational content. Data is auto-deleted after 12 months.

9.2 Data collected

• ◆ Prompt content - the text you paste into the Forge input field (max 2000 characters).
• ◆ AI-generated output - the rewritten prompt in RCTFE structure plus the explanation we display.
• ◆ Session identifier (UUID) - random ID stored in your browser as pf_session cookie, used only to let you delete your own data later.
• ◆ Timestamp - date and time of submission (used for the 12-month auto-delete).

We do not collect: your name, email (unless you explicitly subscribe to the newsletter - see 9.7), IP address, or any device fingerprint linked to Forge usage.

9.3 Legal basis

Art. 6(1)(f) GDPR - legitimate interest of the controller (building educational AI products based on anonymous, aggregated insights).

9.4 Sub-processors

• ◆ Amazon Web Services (AWS) EMEA SARL - AWS Lambda (compute), DynamoDB (database), API Gateway, Secrets Manager. Region: eu-central-1 (Frankfurt). AWS Privacy Notice.
• ◆ Anthropic, PBC - Claude Haiku 4.5 model (via AWS Bedrock, eu-central-1) for rewriting prompts. Anthropic does not retain prompts sent through Bedrock. Anthropic Privacy Policy.
• ◆ Cloudflare, Inc. - Cloudflare Pages (hosting), CDN, DDoS protection. Cloudflare Privacy Policy.
• ◆ Sendinblue SAS (Brevo) - email newsletter (if you opt in, see 9.7). Located in France. Brevo Privacy Policy.

9.5 Retention

Prompts and AI outputs are kept for 12 months from submission, after which they are automatically deleted from DynamoDB via TTL (time-to-live). Anonymous aggregated audit logs (counts only, no prompt content or session IDs) are retained for compliance purposes.

9.6 Your rights specific to Forge

You can delete your Forge data at any time (right to erasure, GDPR Art. 17) by visiting aikuznia.pl/en/forge/privacy/ and pasting your session_id (found in the pf_session cookie or in the result card after using Forge). Deletion is permanent and irreversible.

9.7 Newsletter (optional opt-in)

If you subscribe to the Kuźnia AI newsletter from inside Forge, your email address is processed by Brevo (Sendinblue SAS, France) under Art. 6(1)(a) GDPR (consent) for the purpose of sending 1-2 educational emails per week. You can unsubscribe with one click from any email - this withdraws consent and removes you from the list immediately. Email addresses are stored in Brevo until you unsubscribe or until 24 months of inactivity.

10. Contact forms, WhatsApp Business and Google Business Profile

On subpages aikuznia.pl/strony-lokalne/ and aikuznia.pl/wizytowka-google/ the main contact channel is WhatsApp Business with a pre-filled message ("Hi, I'm writing from google maps."). Some clients also find us via Google Business Profile (Kuźnia AI Marcin Opieczyński, Pomlewo).

10.1 Contact via WhatsApp Business

• ◆ Data collected: your phone number (visible to you in the WhatsApp app), content of messages you send, optionally your WhatsApp profile name and avatar if set public.
• ◆ Legal basis: Art. 6(1)(b) GDPR (steps to enter into a contract at your request) and Art. 6(1)(f) GDPR (legitimate interest of conducting commercial correspondence).
• ◆ Processor: Meta Platforms Ireland Ltd. (WhatsApp Business). Transfer to USA under Standard Contractual Clauses + EU-US Data Privacy Framework.
• ◆ Retention: up to 24 months from the last message or until contract end, whichever is later. You can request deletion of conversation history at any time by emailing [email protected].

10.2 Google Business Profile (Google Maps)

• ◆ What happens: when you see Kuźnia AI on Google Maps and click "Website" or "Directions", you are redirected to aikuznia.pl or the maps app. Google sends us aggregated statistics (views, clicks, calls) without identifying individuals.
• ◆ Reviews: when you leave a review on Google Maps, your account name and review content are publicly visible. We may reply publicly. This is governed by the Google Maps Terms, not this document.
• ◆ Processor: Google LLC (Google Business Profile + Google Maps).

10.3 Brevo newsletter (if you opt in)

If you subscribe to the Kuźnia AI newsletter (form inside Forge or a separate form on the site), your email address is processed by Brevo (Sendinblue SAS, France) under Art. 6(1)(a) GDPR (consent). Purpose: send 1-2 educational emails per week about AI in business. You can unsubscribe with one click from any email, which withdraws consent and removes you from the list. Emails are stored in Brevo until unsubscribed or 24 months of inactivity.