Document
Privacy policy
1. Data controller
The controller of your personal data is Daniel Zieliński, a sole proprietor entered in the Polish business register (CEIDG), ul. Polna 2J/10, 06-450 Glinojeck, Poland, tax ID (NIP) 1182128780 (“StackGentic” or “we”).
For any matter concerning personal data you can write to kontakt@stackgentic.com. No data protection officer has been appointed.
2. What data we collect
This section covers the site and its contact form; the data in the Ragio service is described in section 11. The data comes only from the form and the anti-spam check attached to it. We collect:
- the data you enter in the form: first name, last name, e-mail address and, if you wish, also a phone number, a company name and the text of your message;
- anti-spam check data: when you use the form, the Cloudflare Turnstile widget processes your IP address and browser characteristics to tell a person from a bot (section 6). Only the result of that check, a one-time token, is sent with the enquiry.
We no longer collect the address of the page you send the form from, the address of the referring page or UTM campaign parameters, and we do not record the moment of consent or the version of the policy. Ticking the consent box is a condition for sending the form.
First name, last name and e-mail address are needed so that we can reply to the enquiry. The other fields are optional. You do not have to give any data to use the site itself.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Replying to the enquiry from the form and contacting you | Art. 6(1)(a), that is your consent, given by ticking the box in the form |
| Taking steps before entering into a contract, when your enquiry asks for a quote or a conversation about working together | Art. 6(1)(b) |
| Security of the form and the system, and protection against abuse and spam, including the Cloudflare Turnstile anti-spam check | Art. 6(1)(f), that is our legitimate interest in securing the site and the system |
You can withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
4. IP address and server logs
When you send the form, your IP address is used momentarily to limit the number of enquiries from one address per hour (a counter in the server's memory, not in a database) and to check the result of the anti-spam check with Cloudflare (section 6). We do not store it together with your enquiry, and it is not in the e-mail we receive from you.
Your IP address does, however, appear in the server logs, which we keep for as long as the log rotation dictates, that is for a short time. The basis is our legitimate interest in ensuring security (Art. 6(1)(f) GDPR).
5. Where we store the data
The enquiry from the form is sent as an e-mail to our company mailbox (Google Workspace, section 6). We do not store it in a database or in a CRM system. The form connects to the same address you loaded the site from (stackgentic.com), on a server in Germany (netcup, European Union), and the data is encrypted in transit (HTTPS). The server passes the message on to the mail system and does not keep it.
Data may leave the European Economic Area (EEA) in two cases. The first is the Cloudflare Turnstile anti-spam check (section 6): Cloudflare, Inc. is based in the USA, so using it may mean transferring your IP address and browser characteristics outside the EEA. The second is e-mail: the messages from the form and our correspondence with you go through Google Workspace (section 6), and Google may also process data on servers in the USA. In both cases the basis is the provider's certification under the EU-US Data Privacy Framework and the standard contractual clauses included in its data processing terms. Transfers connected with Ragio are described in section 11.
6. Recipients of the data
Data may go to entities that help us run the service:
- netcup GmbH (Karlsruhe, Germany): the hosting provider, on whose server the site and Ragio run;
- Google Ireland Limited (Dublin, Ireland): the provider of our company mailbox and e-mail relay (Google Workspace). The whole message from the form (first name, last name, e-mail address, phone number, company name and text) arrives in our mailbox, and through it we correspond with you when we answer your enquiry. Ragio sends invitations and one-time codes to guests through the same channel (section 11). More in Google's privacy policy: policies.google.com/privacy (opens in a new tab);
- Cloudflare, Inc. (San Francisco, USA): the provider of the Cloudflare Turnstile anti-spam check, a processor. When you start using the form, your browser loads the widget from Cloudflare's servers, which processes your IP address and browser characteristics to tell a person from a bot. Our server checks the result with Cloudflare, sending it the token it received and your IP address. This may involve a transfer outside the EEA, on the basis described in section 5. More in Cloudflare's privacy policy: cloudflare.com/privacypolicy (opens in a new tab).
- Anthropic (USA) and Typesafe: model providers used only by Ragio, not by the contact form. They are described in section 11.
We do not use analytics or tracking tools and we do not pass your data to advertising networks. We may disclose data to public authorities if the law obliges us to.
8. How long we keep the data
- An enquiry from the form: it is an e-mail in our company mailbox; we delete it no later than 12 months from the last contact about it. We delete it sooner if you withdraw your consent or ask us to.
- Customer data, when an enquiry leads to a working relationship: for the duration of the relationship and 3 years after the last activity once it has ended; accounting documents for as long as tax and accounting regulations require.
- Server logs: for a short time resulting from the log rotation (section 4).
- Data in Ragio: as set out in section 11.
9. Your rights
You have the right to:
- access your data and receive a copy of it;
- rectify data that is incorrect;
- have your data erased;
- restrict processing;
- data portability;
- object to processing based on our legitimate interest;
- withdraw your consent at any time;
- lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland).
To exercise these rights, write to kontakt@stackgentic.com. We may ask you to confirm your identity so that the data does not reach the wrong person.
10. Automated decisions
We do not make decisions about you based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect you.
11. Ragio (ragio.stackgentic.com)
Ragio is a separate service in which we upload documents and ask questions about them in a chat. It is not part of this site or of the contact form. It is used by us (the account administrator) and, in an “on-demand chat”, by people we have invited by e-mail to talk about a chosen set of documents (guests). We process the data in Ragio as the controller.
What data
- our documents and questions: uploaded files, their content and summaries, and the questions asked in the chat with the answers. Documents may contain other people's personal data; we upload only documents we have the right to use;
- guests: the e-mail address we sent the invitation to (the invitation and the one-time sign-in codes are sent to it), the questions you ask, and the answers with the list of documents and pages they are based on. Codes and session identifiers are stored only as hashes;
- the guest cookie: one strictly necessary session cookie (ragio_guest, HttpOnly, valid for 8 hours) that keeps your conversation going after you enter the code. It is not used for analytics or advertising;
- IP address: in the server logs, as described in section 4.
Purpose and basis
We process guests' data to give the invited person a chat about the chosen documents and to protect it from unauthorised persons: Art. 6(1)(f) GDPR (our legitimate interest), and where a contract links us with the guest, also point (b). We process our own documents and questions in the course of running our business (point (f)).
Who else processes the data
- Anthropic (Anthropic Ireland, Limited, our contracting party for the EEA, part of Anthropic PBC, San Francisco, USA): the Claude language model, a processor under Anthropic's commercial terms. To answer a question, Ragio sends it the question and the passages or whole documents the answer is to be built from. Because Anthropic processes data in the USA, this involves a transfer outside the EEA, made on the basis of the EU Standard Contractual Clauses incorporated in Anthropic's Data Processing Addendum. Under its commercial terms Anthropic does not train its models on what we send it or on its answers. Anthropic deletes API inputs and outputs within 30 days, unless it must keep them longer to enforce its usage policy (content flagged as a violation, up to 2 years) or to comply with the law;
- Typesafe (the Jev reranker): judges which passages of the documents best fit the question, and for this receives the question and the text of the passages. Legal entity: TypeSafe AI, Inc., USA; its services are hosted in the USA, so this is a transfer outside the EEA; its privacy policy does not name a transfer mechanism such as the EU Standard Contractual Clauses. Under its privacy policy TypeSafe does not train models on what it receives and keeps personal data as long as reasonably necessary to provide its service;
- Google Workspace and netcup: sending the e-mails with invitations and codes, and hosting (section 6).
The model providers act on our behalf and under their data processing terms; how long they keep data under those terms is stated above and is separate from the deletion described below.
How long
- a one-time code is valid for 10 minutes and a guest session for 8 hours; expired codes and sessions are deleted every hour;
- a guest's link works until the day we set when inviting (90 days at most) or until we revoke it, and then it stops working;
- a guest's e-mail address, one-time codes, questions and answers, including what the model provider's session holds, are not deleted automatically yet: we keep them until we delete them, and we delete them at your request sent to kontakt@stackgentic.com.
You have the rights described in section 9.
12. Changes to this policy
If we change the way we process data, we will update this policy and give a new effective date. The consent given in the form always refers to the version of the policy in force at the moment it was given.