Privacy notice

Who I am

I'm Jakub Szwajka. I run this site as a private person, and I am the controller of the data you send me through the work-with-me form. This notice follows Article 13 of the GDPR.

Write to me about anything on this page at [email protected]. Contact is by email only. I have no data protection officer.

What the form sends

When you press Send, your browser posts these fields to studio.kubaszwajka.com/api/contact:

• your email address;
• your message;
• your name, if you give it;
• which option you picked, engineer or business;
• a token from the Cloudflare Turnstile spam check.

The server also sees your IP address, like any web server. Please leave private code, customer data and other people's personal data out of the message.

Sometimes the form is not switched on. Then Send opens a draft in your own email app, and no data leaves your browser until you send that email yourself. It goes to [email protected], which forwards it to my mailbox like any other email.

What happens after you press Send

1. Turnstile checks in your browser that you are a person. Cloudflare sees your IP address and signals from your browser for this.
2. The server asks Cloudflare whether the Turnstile token is valid.
3. The server counts messages per IP address in its memory, to limit how many one address can send.
4. It sends one email with your message to my mailbox through Resend.
5. It posts a one-line note to my Discord: a new enquiry came in, engineer or business. The note has no message, name, email or IP address in it.

Nothing goes into a database. The server does not log your message, email, name or IP address.

Why I use it, and the legal basis

Answering an enquiry about a paid service (a workflow review or a process discovery)

Art. 6(1)(b) GDPR. You ask me to take a step before a possible contract: reply, then agree scope and price.

Answering any other message

Art. 6(1)(f) GDPR. My legitimate interest is to answer people who write to me.

Keeping spam and abuse out of the form

Art. 6(1)(f) GDPR. My legitimate interest is to keep the form usable. This uses your IP address and the Turnstile token.

Who else gets your data

• Cloudflare, Inc. runs the Turnstile check. Its Turnstile privacy notice says it processes the signals for me, and also uses them on its own account to improve its bot detection. Cloudflare also sits in front of this site and studio.kubaszwajka.com, so your request passes through its network. It also forwards mail sent to [email protected] on to my mailbox.
• Resend (Plus Five Five, Inc.) sends the email with your message to me. It works for me under its data processing addendum.
• Google runs Gmail, where my mailbox is. Your message and our emails end up there. See Google's privacy policy.
• Hetzner Online GmbH rents me the servers the form's server runs on.
• Discord gets only the one-line note above. It gets no personal data.

I do not sell your data and do not use it for marketing.

Transfers outside the EEA

• Cloudflare is a US company. It is certified under the EU-U.S. Data Privacy Framework, and its data processing addendum adds the EU standard contractual clauses (source).
• Resend sends the email from its Ireland region, but it stores account data, email metadata and logs in the United States. Its data processing addendum covers that transfer with the EU standard contractual clauses.
• Google may process mail on servers outside your country. Google says it relies on the EU-U.S. Data Privacy Framework for this (source).

How long I keep it

• Your enquiry and our emails: 12 months after our last contact. Then I delete them.
• The per-IP count: each count covers one hour. It lives only in the server's memory, it is never written to disk, and a restart wipes it.
• Resend keeps its record of sent emails for 30 days on its standard plans (source).

Your rights

You have the right to:

• see your data and get a copy;
• have it corrected;
• have it erased;
• restrict how I use it;
• object when I rely on my legitimate interest, Art. 6(1)(f);
• get the data you gave me in a portable format, where I rely on Art. 6(1)(b).

Email me at [email protected] to use any of them.

You can also complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes UODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl.

Do you have to give me your data?

No. Writing to me is voluntary. Without an email address and a message I can't answer you. Your name is optional.

Automated decisions

I make no decisions about you by automated means alone, and I do no profiling. The Turnstile check only decides whether the form accepts a message.