Privacy policy

This site is run by Filip Piątek and Jakub Bilski, operating together as PB Devs from Poznań, Poland. PB Devs is not yet a registered company, so the two of us are the data controllers as individuals.

Any question about your data: kontakt@pbdevs.com. A real person answers.

The contact form: your name, email address and the content of your message. We use them for one thing: to reply to you. The legal basis is Article 6(1)(b) GDPR (steps prior to entering a contract) or Article 6(1)(f) (our legitimate interest in answering people who write to us). The same applies to an audit order and to the estimate summary sent to your address.

Where you came from: to a message from the contact form, the audit order and the estimate tool we attach the first page of your visit, the name of the site that sent you here, and the campaign tag from the link, if it had one. That is how we know which sources bring enquiries. It is kept in the memory of the open tab, with no cookie and nothing written to your browser, and it is gone when you close the tab. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in knowing where enquiries come from.

Traffic statistics: we run Umami, an analytics tool hosted on our own server, which counts page views and records the country, browser and device type, plus the site that linked you here. It writes no cookie and stores nothing in your browser; a visit is recognised by a one-way hash that is discarded daily and cannot be traced back to you. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in knowing whether anyone reads this.

Analytics: if you agree to it, Google Analytics 4 records which pages are opened, roughly where in the world you are, what kind of device you use, and the fact that a form was sent, without its content. The legal basis is your consent: Article 6(1)(a) GDPR. If you don't agree, the script is never loaded and no analytics cookie is set.

The chat on this site: if you agree to it, an assistant appears in the bottom right corner and answers questions about what we do. What we process there is what you type: the content of the conversation, and the email address you give us if you ask to be contacted. It serves one purpose: answering you, and handing the matter to us directly when that's what you want. The legal basis is your consent: Article 6(1)(a) GDPR; without it the chat script is never loaded. You don't have to give any personal data in the conversation, and the only thing the chat itself asks for is an email address.

Server logs: our hosting keeps standard technical logs (IP address, time, requested address) so we can find failures and abuse. Legal basis: Article 6(1)(f) GDPR.

We set no marketing cookies and we sell nothing to ad networks.

One essential entry in your browser's local storage remembers what you agreed to: analytics, the chat, both or neither. It cannot identify you and it exists so the site doesn't ask again on every visit. Two more are kept only until you close the tab: whether you dismissed the trade fair notice, and the summary from the cost calculator that you chose to carry over into the contact form.

Analytics cookies (_ga, _ga_*) are set by Google Analytics only after you agree. You can change or withdraw that agreement at any time: the "Privacy settings" link at the bottom of every page opens the same choice again. When you withdraw, we delete the analytics cookies and the chat entries from your browser straight away.

The chat sets no cookie either, but once you have agreed to it, it does keep a few entries in local storage: a conversation id, the transcript (so you can pick the thread back up on your next visit), which prompt variant you were shown, and whether it has been shown already. They all start with "dp_" and they go when you clear this site's data in your browser.

Umami, our own traffic counter, sets no cookie at all. It writes nothing on your device. The only thing it reads is an opt-out flag, which exists only if you set it yourself.

Hosting: Hetzner Online GmbH (servers in the EU). The site and its database run there.

Email: messages from the contact form are delivered through pbdevs-mail, a service we built and run ourselves, which hands the message to an SMTP provider for final delivery.

Traffic statistics: nobody. Umami runs on our own server in the EU, so those numbers never leave our hands.

Analytics: Google Ireland Limited, only if you agreed. Google may transfer data outside the EU under the EU-US Data Privacy Framework.

The chat: its engine is CartBot (our own product, running on the same Hetzner server as this site), so the conversation goes to no outside company with one exception. To compose a reply, the content of the conversation is sent to Anthropic PBC (the Claude model), which processes it in the United States and, under its API terms, does not use it to train models. This happens only if you agreed to the chat.

We give your data to nobody else. We don't sell it and we don't use it to profile you or to advertise.

We publish to our own brands' social media accounts (PB Devs, CartBot, Hooplytics) from an internal panel at social.pbdevs.com. It is not offered to anyone outside PB Devs. To post short videos to our YouTube channels, the panel uses the YouTube API Services.

By connecting a YouTube channel to the panel you agree to be bound by the YouTube Terms of Service: https://www.youtube.com/t/terms. Google processes data under the Google Privacy Policy: https://policies.google.com/privacy.

What the panel accesses: the connected channel's ID, name, handle and profile picture (to show which channel is connected), and permission to upload videos to that channel. It stores the channel's ID, name, handle, the address of its profile picture and an OAuth refresh token, on our own server in the EU (Hetzner). It does not read your viewing history, subscriptions, comments or any other YouTube data, and it shares none of it with anyone.

The refresh token is used only to upload the videos we choose to publish, and it is deleted together with everything else stored about the channel when the channel is disconnected in the panel. You can also revoke the panel's access at any time in your Google Account's security settings: https://myaccount.google.com/permissions.

Contact messages: as long as the conversation is live, and up to 24 months afterwards, so we can pick up a thread you left open. Ask and we delete them sooner.

Chat conversations: on the same basis as contact messages, up to 24 months, because they are the same kind of enquiry. We delete those sooner on request too. The transcript held in your own browser is yours to clear, by clearing this site's data.

Traffic statistics: aggregate counts kept indefinitely; the daily visitor hash they are built from is discarded every 24 hours.

Analytics data: 14 months, per the Google Analytics setting.

Server logs: up to 30 days.

You can ask us for a copy of your data, to correct it, to delete it, to limit what we do with it, or to move it elsewhere. You can object to processing based on legitimate interest. Where we rely on consent, you can withdraw it at any time without giving a reason.

Write to kontakt@pbdevs.com and we'll handle it within 30 days.

If you think we've mishandled your data, you can complain to the Polish data protection authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa.

If this policy changes, the date at the top changes with it. The history of every version is public in the site's git repository.