Privacy Policy

Data controller

Couders is currently a project team and is not yet registered as a company or a sole proprietorship. Until registration is complete, the individuals who make up the Couders team act as joint controllers, and all data protection matters, including your requests, are handled at the email address below. Once registered, we will add the full legal name, registered address and tax identifiers here.

1. What data we process

We process only the data you give us yourself, plus basic technical data recorded automatically by the server. We do not buy databases and we do not obtain data from other sources.

• Contact form: first name, last name, email address, an optional message, and the date and time of submission.
• AI assistant: the messages you type into the chat window, plus a technical thread identifier that links messages within one session.
• Technical data: IP address, browser and operating system type and request time, recorded in logs by our hosting provider.

We do not ask for special categories of data (art. 9 GDPR) and we ask that you do not include such data in a message or in the chat.

2. Purposes and legal bases

• Replying to a form enquiry and handling correspondence: art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) and art. 6(1)(f) GDPR (our legitimate interest in handling enquiries).
• Running the AI assistant conversation and answering it: art. 6(1)(f) GDPR (legitimate interest in handling enquiries and presenting our services).
• Keeping the site secure and stable, including log analysis: art. 6(1)(f) GDPR.
• Establishing, exercising or defending legal claims: art. 6(1)(f) GDPR.
• Meeting legal obligations, in particular tax and accounting ones, if a contract is signed: art. 6(1)(c) GDPR.

Providing data is voluntary. Without a name and email address, however, we cannot answer an enquiry sent through the form.

3. How long we keep data

• Contact form data: for as long as the correspondence lasts, then up to 24 months from the last contact in case the conversation resumes.
• AI assistant conversations: for as long as needed to handle the enquiry and for diagnostics, no longer than 12 months.
• Server logs: for the period set by our hosting provider, typically up to 12 months.
• Contract related data: for the duration of the contract, then for the limitation period for claims and the period required by tax law (as a rule 5 years from the end of the year in which the tax obligation arose).

After these periods we delete or anonymise the data.

4. Who processes your data

Your data may be processed by trusted providers acting on our instructions under data processing agreements. These are currently:

• A hosting and content delivery provider, whose servers run the site and record access logs.
• An automation platform provider, through which contact form submissions and AI assistant messages pass.
• A spreadsheet and email provider, where we store submissions and handle correspondence.
• A language model provider, which generates the AI assistant's answers from your message.

Data may also be disclosed to authorities entitled to it by law, on a justified request. We do not sell data and we do not share it with third parties for their marketing.

5. Transfers outside the EEA

Some of our providers, in particular the hosting provider and the language model provider, are based or operate infrastructure outside the European Economic Area, mainly in the United States.

Such transfers rely on the mechanisms in Chapter V of the GDPR: an adequacy decision of the European Commission (the Data Privacy Framework) or standard contractual clauses, supplemented by additional safeguards. You can request a copy of the safeguards in place at our contact address.

6. Data in the AI assistant

Messages you type into the chat are sent to the language model provider solely to generate an answer. We do not use them to train our own models.

Please do not enter passwords, document numbers, financial data, health data or other people's personal data into the chat. If such data is sent by mistake, contact us and we will remove it from our records.

7. Cookies and browser storage

This site does not set its own cookies for analytics, marketing or profiling. We do not use Google Analytics, advertising pixels or cross site tracking tools.

We do use the browser's session storage to keep one technical identifier for the AI assistant conversation, so that consecutive messages can be linked within a session. It holds no personal data and is deleted automatically when you close the tab. You can also clear it at any time through your browser's site data settings.

If we ever add analytics that require consent, they will run only after you give it, and this document will be updated beforehand.

8. Your rights

In relation to your data you have the right to:

• access your data and obtain a copy of it (art. 15 GDPR),
• have inaccurate or incomplete data corrected (art. 16 GDPR),
• have your data erased, the right to be forgotten (art. 17 GDPR),
• restrict processing (art. 18 GDPR),
• port your data to another controller (art. 20 GDPR),
• object to processing based on legitimate interest (art. 21 GDPR),
• withdraw consent at any time where processing is based on it, without affecting the lawfulness of processing before withdrawal.

To exercise any of these, write to our contact address. We respond without undue delay and no later than one month from receiving the request.

You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw.

9. Automated decision making

We do not make decisions about you based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect you. The AI assistant's answers are informational and are not used to assess or score people.

10. Data security

We apply technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), access limited to people who need it, two factor authentication on the tools that hold submissions, and keeping access keys server side, outside the code sent to the browser.

11. Changes to this policy

We update this policy when the way the site works, the data we process, the list of providers or the law changes. The current version is always available at this address, with the date of the last update shown at the top.