Privacy policy

1. Controller

The controller of personal data collected through this site is Mateusz Łukaszczyk, Lublin, Poland. Contact: hello@mateuszlukaszczyk.com, +48 733 363 123. Invoices for services are issued by the entity named in the contract or quote, which is a separate controller of billing data.

2. What data and why

If you email me, call, I process your name, email address, phone number, the content of the message in order to reply, prepare a quote and carry out the job. Legal basis: Article 6(1)(b) GDPR (steps before a contract and its performance) and 6(1)(f) (legitimate interest: handling correspondence and possible claims).

3. Brief and enquiry register

The brief saves your answers after each step: the kind of case, the system or site address, company details (tax number, domain, name), the kind of data in the system, timeline, budget, scope and how you heard about me. In the last step you give your email and, optionally, your name and phone. Together with the brief I store the page the enquiry came from, the referring domain and campaign parameters (UTM), to learn which sources bring enquiries. Legal basis: Article 6(1)(b) GDPR (steps before a contract) and 6(1)(f) (legitimate interest: measuring which sources work).

The brief goes through explicit qualification rules (buyer status, budget, kind of data, scope, email or hosting work). This is profiling under the GDPR. Its only automatic effect is whether a link to book a call is shown. A human always makes any decision to decline or refer you elsewhere. You can object to the profiling and ask for a human to review the result.

Consents to email reminders and phone contact are separate and unticked by default. I store the text and version of the consent you saw. You can withdraw consent at any time by replying to a message or writing to hello@mateuszlukaszczyk.com. The register runs on Supabase (EU region) as a processor. Unfinished briefs are deleted after 30 days.

4. Statistics

I use Vercel Web Analytics, which counts page views and clicks on selected buttons without cookies and without personal identifiers. I do not connect this data with your correspondence.

5. Embedded sites

The project frames load external sites only after you click. Until then you see a screenshot. Once an embed is running, the external site works under its own rules and its own privacy policy.

6. AI tools

I work with language and generative models, among them Claude (Anthropic), OpenAI models, and video models from Google and Kling. I use them for writing code, laying out pages, copy variants, data migrations and tests. The rules:

• Your customers’ personal data, passwords, documents and financial data do not go into models unless we agree on it in the contract.
• I use accounts where the provider commits not to train models on submitted content (business and API plans).
• Code repositories are private.
• On request I will point out which parts of a project were made with AI assistance.

7. Hosting and email

The site is hosted by Vercel Inc. (servers in the EU and the US, standard contractual clauses). Email: Google Workspace. Beyond these providers, data may reach the invoicing entity and its accountants, only for billing.

8. How long

I keep correspondence for as long as needed to carry out the job and for the limitation period of claims, usually up to 6 years after the end of the engagement, due to the tax obligations of the invoicing entity. Enquiries that did not turn into a job are deleted after a year.

9. Your rights

You have the right to access, rectify, erase, restrict, port and object. An email to the address above is enough. You also have the right to lodge a complaint with the Polish data protection authority (UODO).

10. Changes

Changes to this policy are published on this page with a new update date. Back to the home page.