Privacy Policy

Last updated: October 1, 2026

1. Controller and contact

Artur Mrowicki is the controller of data processed through arturmrowicki.pl. For data-related requests, email kontakt@arturmrowicki.pl.

2. Contact form

The form collects your name, email address, optional phone number and company name, service type, message, optional budget and how you heard about me. It also records the language, source page and a technical inquiry identifier (lead_id). The data is used to handle the inquiry and prepare a response or proposal.

An inquiry may be stored in Supabase and delivered by email through Resend. Resend sends a notification to Artur and — when that channel is available — a confirmation to the address entered in the form.

3. Cookieless measurement

Page views are measured with Vercel Web Analytics and page speed with Speed Insights. Neither uses cookies or stores anything on your device. Vercel recognises a visit by a hash of request data kept for no longer than 24 hours and shows aggregated reports only: pages visited, referrer, country, device type and browser.

An own counter records visits through short ad addresses (for example arturmrowicki.pl/opieka), visits from my Google Search ads and clicks on the phone number, WhatsApp, SMS, email, the form link or the chat link: the day, the name of the ad, campaign or click and the place on the page. The website recognises a visit from an ad by the parameters in the address; the Google click identifier (gclid) is not sent to the counter. To count people rather than clicks, the server creates a daily marker — a hash of the IP address and browser information (user agent) combined with a random salt that changes every day. The IP address reaches Supabase only while the hash is calculated and is not stored anywhere, and the previous day’s salt is deleted, so after midnight a marker can no longer be linked to anyone. The counter stores nothing on your device and is not linked to the contact form or the consultation.

Purpose: to see which ads and which parts of the website lead to contact. The legal basis is my legitimate interest in assessing the effectiveness of the website and ads.

4. Google, consent and entry source

Only with your consent may the website load the Google tag (Google Analytics / Google Ads), which uses cookies or similar identifiers. analytics_storage, ad_storage, ad_user_data and ad_personalization are denied by default, and the Google script is not requested before consent. Consent covers measurement only: ad_personalization stays off even after consent, so I build no remarketing lists and do not personalise ads. The primary Google Ads conversion is sent only after the API confirms that a form inquiry was accepted; it includes the pseudonymous lead_id as a transaction identifier. A secondary conversion marks a click on the phone number, WhatsApp, SMS or email — without the number, address or content.

If you become my client after an inquiry from an ad, I may send Google Ads the click identifier (gclid) stored with your consent together with the label “paying client” — without your name, email, phone number or the amount. This shows whether the ads bring clients.

Calls from ads. When you tap “Call” directly in a Google ad, the call may be routed through a Google forwarding number. Google may then show me the time and duration of the call, the area code and the caller’s number (for calls longer than 15 seconds). Calls are not recorded. This measurement is run by Google under its own privacy terms; the website is not involved.

Also only with consent, the website keeps the entry source in browser localStorage — length-limited values of utm_source, utm_medium, utm_campaign, utm_term, utm_content, click identifiers gclid, gbraid, wbraid and fbclid, the landing page without its query string and the referrer — first and last touch, for up to 90 days. When you submit the form, they are attached to the inquiry in Supabase and may appear in the notification email. Refusing or withdrawing consent removes the stored entry source from the browser.

Refusing does not block the form or consultation. You can change the setting here:

5. AI consultation and browser storage

The consultation may process the conversation, contact details entered in it, IP address, time and session identifier, and the generated summary. Conversation content is sent to Anthropic to generate replies and summaries, while session data is stored in Supabase. Resend may deliver a summary or notification.

localStorage is also used to:

  • store a pseudonymous visitor_id so consultation history can be shown on this device,
  • remember the Google measurement choice and already measured inquiry IDs so conversions are not duplicated.

6. Service providers

Data is shared only as needed for the selected feature to operate:

  • Supabase — contact inquiries, consultation sessions, messages and counters,
  • Resend — notification and confirmation emails,
  • Anthropic — AI consultation replies and summaries,
  • Vercel — hosting, technical logs, Web Analytics and Speed Insights (cookieless),
  • Google — fonts, search ads (including call reporting for ads) and, after consent, Google tag and Google Ads measurement.

Providers may use subprocessors and process data outside the European Economic Area under their own terms and data-transfer mechanisms.

7. Purposes, security and retention

  • handling inquiries and taking steps before a contract,
  • qualifying consultations and providing follow-up contact,
  • security, abuse prevention and website diagnostics,
  • cookieless measurement of website and ad effectiveness (legitimate interest),
  • campaign attribution and Google measurement — only after consent.

Contact-form and consultation data is generally kept until the correspondence ends, for no longer than 12 months, unless a contract or legal duty requires longer retention. Technical logs are kept for up to 30 days. Once the daily salt is deleted, counters cannot identify anyone and are kept as statistics. An entry source stored with consent expires after 90 days; other localStorage data can be removed through browser settings.

8. Your rights

Depending on the basis and circumstances of processing, you may request access, rectification, erasure, restriction, portability or object to processing. You may withdraw consent to Google measurement and lodge a complaint with the Polish supervisory authority (UODO). Contact kontakt@arturmrowicki.pl to make a request.

9. Changes and nature of this notice

This policy may change when the website or providers change. It describes how the website operates and is provided for information only; it is not legal advice.