Legal
Privacy policy
Effective from 1 October 2026
This policy explains what personal data we process when you visit craftweb.pl, write to us, use the chat assistant or send visual feedback, why we do it and what rights you have. We keep it short and specific. If anything is unclear, write to hello@craftweb.pl.
1. Who we are
The controller of your personal data is CraftWeb spółka z ograniczoną odpowiedzialnością, Osiedle Pod Wiatrakami 9, 62-261 Lednogóra, Poland, entered in the Register of Entrepreneurs of the National Court Register (KRS) under number 0001039024, kept by the District Court Poznań - Nowe Miasto i Wilda in Poznań, IX Commercial Division of the National Court Register. NIP (tax ID): 7842535739, REGON: 525423100, share capital: PLN 5,000.
Contact on any data protection matter: hello@craftweb.pl or by post to the address above. We have not appointed a Data Protection Officer, as the law does not require one for our activity.
2. At a glance
| What | Why | Legal basis (GDPR) | How long |
|---|---|---|---|
| Contact form and email | Replying, preparing a proposal, talking about a project | Art. 6(1)(b) steps before a contract; Art. 6(1)(f) our legitimate interest in answering enquiries | Up to 12 months after the last message, longer if a contract follows (see section 3) |
| Chat assistant | Answering your questions about our services | Art. 6(1)(f) legitimate interest; Art. 6(1)(b) if you ask for a proposal | Up to 90 days, unless the chat turns into an enquiry |
| Visual feedback | Fixing bugs and improving the site | Art. 6(1)(f) legitimate interest | Until the report is resolved, at most 12 months |
| Analytics (Google Analytics 4, Microsoft Clarity) | Understanding how the site is used | Art. 6(1)(a) consent | Up to 14 months in Google Analytics, up to 13 months in Clarity |
| Advertising (Google Ads) | Measuring and showing our ads | Art. 6(1)(a) consent | Up to 540 days in Google Ads audiences |
| Server logs | Security and keeping the site running | Art. 6(1)(f) legitimate interest | Up to 30 days |
| Claims and accounting | Establishing or defending claims, tax duties | Art. 6(1)(f) and Art. 6(1)(c) | For the limitation period or as required by law |
3. Contact form and email
When you send the form we receive your name, email address, company (optional), project type, message and the address of the page you sent it from. When you email us directly we receive your address and whatever you write. Name, email and message are needed to reply; without them we cannot answer the form.
The form is delivered by our own automation server (n8n, hosted by us in the European Union) to our Google Workspace mailbox. We use the data only to reply to you and to talk about a possible project. We do not add you to a newsletter or sell your data.
We keep the conversation for up to 12 months after the last message. If we sign a contract, the correspondence becomes part of the project file and we keep it for the duration of the contract and then for the limitation period of claims and the periods required by tax law.
4. Chat assistant
When the chat assistant is available on the site, it runs on HeyHeyo, a conversational AI product built and operated by CraftWeb. We process the messages you type, the time of the conversation, the page you are on and technical data needed to keep the session (a random session ID). If you leave your email or phone number in the chat, we use it to get back to you.
Answers are generated with the help of an AI language model provider acting as our processor; the provider may not use your messages to train its models. Please do not share sensitive data (for example health data) in the chat. Conversations are kept for up to 90 days, unless they turn into an enquiry, in which case section 3 applies. The assistant does not make decisions about you that have legal or similarly significant effects.
5. Visual feedback (SnapFeed)
We may show a feedback button on the site, powered by SnapFeed, a visual feedback tool built and operated by CraftWeb. Nothing is collected unless you use it. When you send a report we receive your comment, the screenshot or screen recording you choose to make, your annotations, the page address, browser and device details (type, viewport size), console errors and, if you provide it, your email address.
Recordings capture only what you choose to share. We use reports to find and fix problems and keep them until the issue is resolved, at most 12 months.
6. Analytics and advertising
We use the tools below only if you agree in the cookie banner. You can change your mind at any time under Cookie settings.
- Google Analytics 4 (Google Ireland Limited): pages visited, time on site, approximate location (country, city), device and browser, traffic source and interactions such as scrolling or sending the form. IP addresses are not stored in Google Analytics 4.
- Microsoft Clarity (Microsoft Ireland Operations Limited): heatmaps and session replays showing clicks, scrolling and mouse movement, to find confusing parts of the site. Text you type into form fields is masked and not recorded.
- Google Ads (Google Ireland Limited): measuring whether our ads lead to enquiries (conversions) and showing our ads to people who visited the site (remarketing). This is a form of profiling for advertising; it has no legal effects on you.
We use Google Consent Mode v2. Before you choose, every Google signal (analytics_storage, ad_storage, ad_user_data, ad_personalization) is set to "denied". While it stays denied, Google tags do not set or read cookies and may send only cookieless pings without identifiers, which Google uses for aggregated, modelled statistics. Once you agree, the signals switch to "granted" for the categories you accepted. Microsoft Clarity loads only after you accept analytics.
8. Hosting and server logs
The site and the contact automation run on our server rented from Hetzner Online GmbH (Gunzenhausen, Germany), located in a data centre in Helsinki, Finland. When you open the site, the web server records your IP address, date and time, requested address, browser (user agent) and response status. We keep these logs for up to 30 days to protect the service against abuse and to diagnose errors. Fonts and site files are served from our own server, without third-party CDNs.
9. Who receives the data
We do not sell personal data. It may be processed on our behalf, under data processing agreements, by:
- Hetzner Online GmbH: server hosting (site, form automation);
- Google Ireland Limited: email (Google Workspace), and if you consent, Google Analytics and Google Ads;
- Microsoft Ireland Operations Limited: Microsoft Clarity, if you consent;
- the AI language model provider and cloud hosting used by the chat assistant and SnapFeed;
- our accounting and legal advisers, where needed for a contract or a claim.
We may also disclose data to public authorities when the law requires it.
10. Transfers outside the EEA
Google and Microsoft may process data in the United States. Both are certified under the EU-US Data Privacy Framework, which the European Commission recognised as providing an adequate level of protection (Art. 45 GDPR); where it does not apply, transfers rely on the Standard Contractual Clauses (Art. 46 GDPR). Our own server is located in the European Union.
11. Your rights
You have the right to access your data and receive a copy, to rectify it, to have it erased, to restrict processing, to data portability and to object to processing based on our legitimate interest (Art. 15-21 GDPR). Where we rely on consent, you can withdraw it at any time, for cookies under Cookie settings, without affecting the lawfulness of earlier processing.
To use your rights, write to hello@craftweb.pl. We answer within one month. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).
We do not make decisions based solely on automated processing that produce legal effects concerning you.
12. Changes to this policy
We update this policy when we add a tool or change how we process data. The date at the top shows the current version. If a change affects what you agreed to in the cookie banner, we ask for your consent again.