Privacy policy

Who I am

Givyx is run by me, Stanislau Zakharevich, through my sole proprietorship Stanislau Zakharevich TechStream, NIP 8222407798, REGON 528225262, Kraków, Poland. I am the controller of the personal data described on this page. For anything about your data, email me at info@givyx.com.

What I collect

• Contact form. When you send the form on the Contact page, I get a way to reach you (email or phone) and, if you fill them in, the plan you are interested in, your type of business and your message. The message is linked to the visit it came from, so I can see which page brought you to me.

• Email. When you write to info@givyx.com, I get your address and whatever you send.

• Account. If you create an account to set up your site, I keep your email address, your password and the plan you chose. If you sign in with Google, I receive the email address of your Google account and copy its profile photo into the panel.

• Clients. If you become a client, I also keep what I need to build your site and invoice you: the materials you send me and the invoices. For an invoice I need your company or full name, address, NIP (or a foreign tax ID) and an email address to send it to.

• Visits. I record the pages you view, the links and buttons you click, the page you came from, the campaign tags in the link (utm_source, utm_medium, utm_campaign), your country and your type of device. The statistics don't store your IP address: it is used to work out your country and which language to show, and, with your browser details, to calculate a code that groups your visits within one day. The code changes every day, so visits on different days can't be linked. The web server keeps no access log, and its technical error logs are overwritten automatically and cleared with every update, usually within days. I don't use them to identify anyone.

Cookies and similar tools

givyx.com sets no advertising cookies. It sets givyx_lang, which remembers your language for a year, and two sign-in cookies (next-auth) that the login needs.

Google Analytics runs without cookies: it is set up to store nothing on your device, with Google signals and ad personalisation turned off. Your browser still sends Google each page view. Pages also load an icon font from Google Fonts, so your browser connects to Google's servers, which see your IP address.

Nothing optional is stored on your device, which is why the site shows no cookie banner.

Why I use it

• To reply to you and prepare a quote: steps you ask for before a contract (Art. 6(1)(b) GDPR).

• To build and run your site and your account: performing our contract (Art. 6(1)(b) GDPR).

• To issue invoices and keep accounting records: a legal obligation (Art. 6(1)(c) GDPR).

• To see how the site is used and which pages bring enquiries: my legitimate interest (Art. 6(1)(f) GDPR).

I use contact details only to reply about your project. Giving me your data is voluntary, but without a way to reach you I can't reply.

Who else handles it

A few providers process data for me:

• Kylos (kylos.pl): the server in Poland that runs givyx.com and holds accounts, form messages, visit statistics and images.

• Microsoft Azure, in an EU region: site content and settings, and payment records.

• SendGrid (Twilio): sends the platform's emails and the mail I send from info@givyx.com, including the notification I get when you send the form.

• Google: Google Analytics, Google Fonts, the Gmail mailbox where form notifications and mail to info@givyx.com arrive, and Google sign-in if you use it.

• ImprovMX: forwards mail sent to info@givyx.com to my Gmail mailbox.

• Stripe (Ireland): card payments, only if you choose to save a card in the panel. Otherwise you pay by bank transfer.

• OpenRouter: the AI editor in the client panel. When you use it, your instructions and the content you are editing go through OpenRouter to an AI model.

• My accountant, Kancelaria Mentzen: receives the invoices and the records my bookkeeping needs.

I issue invoices in KSeF, the Polish national e-invoicing system. Google, Twilio (SendGrid), Stripe, ImprovMX and OpenRouter may process some data outside the European Economic Area. Such transfers rely on the EU-US Data Privacy Framework where the provider is certified under it, and on the European Commission's standard contractual clauses otherwise.

Sites I build for clients

On a site I run for a client, the client decides what data the site collects from its visitors (forms, bookings, statistics) and is the controller of that data; I process it on the client's behalf. The data-processing section of my terms of service (Art. 28 GDPR) lists the sub-processors I use for client sites, and I delete that data within 30 days after the service ends. Questions about such a site go to that business first.

If I wrote to you first

Sometimes I build a demo site for a business and contact the owner about it by email, SMS or phone. I take business contact details from public listings and registers: panoramafirm.pl, Google Maps and CEIDG. The legal basis is my legitimate interest in offering my service to businesses (Art. 6(1)(f) GDPR). The form on a demo site asks for the business name and city and a phone number or email, and records which demo and campaign it came from. If you don't reply, I delete your details 12 months after I last contacted you. If you don't want to hear from me again, reply or email info@givyx.com and I will stop. I then keep only your business name and contact details on a do-not-contact list, so that I don't contact you again.

How long I keep it

• Detailed visit statistics: about six months; after that only daily totals remain.

• Form messages and emails: 12 months after our last contact if you don't become a client. For clients: as long as the contract lasts and 3 years after it ends (the limitation period, Art. 118 of the Polish Civil Code). Backup copies are overwritten within about five weeks after that.

• Account data: deleted within 30 days of closing the account, except invoices and records the law requires me to keep. Backup copies are overwritten about five weeks later.

• Invoices and accounting records: as long as tax law requires, which is 5 years from the end of the calendar year in which the tax was due (Art. 70 and 86 of the Polish Tax Ordinance).

Your rights

You can ask me for a copy of your data, and to correct it, delete it, limit how I use it or hand it over in a portable format. You can also object to uses based on my legitimate interest. Email info@givyx.com; I reply within one month, as the GDPR requires.

If you think I handle your data unlawfully, you can complain to the Polish data protection authority, the President of the Personal Data Protection Office (uodo.gov.pl).

Changes

If I change this policy, I update the date at the top of this page.