This is a translation of the Polish privacy policy, which is the binding version.

This policy explains what personal data we process in connection with Astrocool, why, on what basis and for how long. We keep it plain and short.

1. Data controller

Astrocool is a service run by Frontcraft - Michał Kokociński (“we”). It is a sole proprietorship, tax ID (NIP): 585-144-01-38. We are the controller of your personal data.

Contact for privacy matters: contact@astrocool.tech.

We have not appointed a data protection officer.

2. What data we process and why

2.1. The astrocool.tech website

The website uses no cookies and no client-side tracking or analytics scripts. We load no external fonts or resources from external networks (CDN). The exception is the “Book a meeting” page: it shows the Zoho Bookings booking calendar, which loads from Zoho’s servers. Zoho may process technical data (e.g. your IP address) and use cookies needed for the calendar to work. Details in section 2.2.

We count traffic statistics on our own server, from server logs. The statistics do not store your IP address or browser data. We use a temporary visitor identifier (a hash), which is deleted after the next day. Only daily aggregates are kept long term.

The web server access logs include your IP address and browser data. We keep them for 7 days, then they are deleted by automatic log rotation.

Why: to keep the site working and secure, and to know how it is used. Basis: our legitimate interest (art. 6(1)(f) GDPR). How long: logs 7 days, identifier until the end of the next day, daily aggregates without personal data longer.

2.2. Booking a meeting

When you book a meeting, we process the data from the booking form: your name, email address, phone number, the time you choose and your answers (what you do, what you expect from the website, links to your current website or profiles, whether you have a domain, and whether you would prefer a phone call first).

Bookings are handled by Zoho Bookings. Meetings take place on Google Meet, and we record their times in Google Calendar. Before the meeting we send a confirmation and reminders to the email address you give. We do not record meetings.

Why: to book and hold the meeting and to prepare your website. Basis: steps taken at your request before entering into a contract (art. 6(1)(b) GDPR). How long: if you become our client, the data moves to your account and is kept as described in 2.4 and 2.5. If not, we delete it within 12 months of the meeting.

2.3. Newsletter

There used to be a waitlist on the website. We no longer collect new sign-ups, but we send people who signed up messages about Astrocool, the offer for first customers and product news. We store only your email address and a record of your consent, in our self-hosted mailing tool (listmonk), which runs on our own server.

Basis: your consent (art. 6(1)(a) GDPR). You can withdraw it at any time with the unsubscribe link in any message, or by writing to contact@astrocool.tech. How long: until you withdraw consent.

2.4. Dashboard account (dashboard.astrocool.tech)

In the dashboard we process: your name, email address, password (stored only as a hash), login sessions, and website memberships and invites.

A strictly necessary session cookie keeps you signed in. It needs no consent, and we use no other cookies in the dashboard.

Account emails (verification, password reset, invites, service notices) are sent from our own mail server.

Basis: contract (art. 6(1)(b) GDPR). We keep security logs based on our legitimate interest (art. 6(1)(f) GDPR). How long: while the account exists. We delete the data within 30 days after the account is closed, unless a longer period is required by law or needed to handle claims.

2.5. Website building and AI editing

We process the content you give us: texts, images, the brief from the intake meeting, and your chat history with the webmaster AI.

Chat messages and attached images are sent to Anthropic, the provider of the Claude AI model, to generate changes to your website. Attached images are deleted from our servers after the change is made.

Basis: contract (art. 6(1)(b) GDPR). How long: chat history is kept while your website exists in the service.

2.6. Payments and invoices

We process billing details (name or company name, NIP for businesses, address, email), payment history and invoices.

Payments are processed by mBank S.A. through its Paynow payment gateway. We do not receive or store card data. We may issue invoices through an online invoicing service and, where required, send them to the national e-invoicing system (KSeF). Accounting is handled by an accounting service provider.

Basis: contract (art. 6(1)(b) GDPR) and legal obligations under tax and accounting law (art. 6(1)(c) GDPR). How long: invoices and accounting records are kept for 5 years from the end of the calendar year in which the tax obligation arose.

2.7. Email correspondence

When you write to us, we process your email address and the content of your message to reply to you.

Basis: our legitimate interest (art. 6(1)(f) GDPR). How long: as long as needed to handle the matter and for possible claims.

3. Visitors of our clients’ websites

Websites built on Astrocool are run by our clients. They are the controllers of their visitors’ data.

We host these websites and count their traffic statistics on our server, in the same privacy-friendly way as described in 2.1. We do this as a processor, on the client’s behalf, under a data processing agreement that is part of our terms of service.

If you have a question about data on such a website, contact the website’s owner first.

4. Who receives data

We do not sell data. We use these providers:

• Hostinger (VPS hosting, servers in Germany, Frankfurt): all our systems run on these servers, including the website, dashboard, database, mail server and client websites. Hostinger processes data on our behalf.
• Anthropic (AI model provider, USA): receives chat messages and attached images to generate website changes. Data is transferred outside the European Economic Area based on standard contractual clauses or another safeguard required by GDPR.
• Zoho (data centre in the European Union): the Zoho Bookings meeting booking system and the mailbox for our incoming email. If data is transferred outside the European Economic Area, this is based on standard contractual clauses or another safeguard required by GDPR.
• Google: Google Meet (online meetings) and Google Calendar (meeting times). If data is transferred outside the European Economic Area, this is based on standard contractual clauses or another safeguard required by GDPR.
• mBank S.A.: the Paynow payment gateway and our bank account.
• An invoicing service provider and an accounting service provider: issuing invoices and keeping the books.
• Public authorities, when the law requires it (e.g. the tax office, KSeF).

Self-hosted tools (mailing, code repositories, deployment) run on our own server and do not share data with their vendors.

5. Your rights

You have the right to:

• access your data,
• have it corrected,
• have it erased,
• restrict processing,
• data portability,
• object to processing based on legitimate interest,
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

To use your rights, email contact@astrocool.tech.

You can also lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa).

6. Other information

We make no automated decisions and do no profiling with legal effects.

Providing data is voluntary, but it is needed to book a meeting, create an account, use the service or receive an invoice.

Security: connections are encrypted, and access to data is limited to what is needed.

We announce changes to this policy on this page. For significant changes we also email account holders.