Legal · v2026-10-13.3
Privacy Policy
1. Controller
The controller of personal data is IBB MEDIA Roman Rozenberger, Kargowska 12, 66-133 Klenica, Poland, NIP 929 179 66 80, REGON 363374908 ("we"). Contact for data protection matters: roman@rozenberger.com or the form at https://zwinnie.com/#kontakt. We have not appointed a Data Protection Officer, as we are not required to (Article 37 GDPR); write to the address above.
This policy covers the website https://askaniela.com (including the beta signup and contact forms), our e-mails and the AskAniela application and API (the "Service"). For pages and content that Business Customers submit for analysis, the customer is the controller and we act as processor under the Data Processing Agreement.
2. Beta signup and e-mails
What we collect. When you request beta access on the website we collect: your e-mail address, and optionally your name, the website you want to check and your role (for example SEO agency), plus the language of the form, the time of the request and of your confirmation, and the IP address and browser information sent with the request. The "Contact sales" form collects your e-mail, name, company and message.
Purpose. To send you a beta invitation and beta updates about AskAniela, to decide the order of invitations, and to answer your sales enquiry.
Legal basis. Beta signup and beta updates: your consent (Art. 6(1)(a) GDPR and Art. 398 of the Polish Electronic Communications Law for e-mail communication), given by ticking the consent box. Sales enquiries: steps taken at your request before entering into a contract (Art. 6(1)(b)) and our legitimate interest in answering (Art. 6(1)(f)).
Double opt-in. After you submit the form we send one e-mail asking you to confirm your address. We send nothing else until you confirm. Unconfirmed requests are deleted after 30 days.
Unsubscribe. Every e-mail we send contains an unsubscribe link. Unsubscribing or withdrawing consent takes effect immediately and does not affect earlier processing. After you unsubscribe we keep only your e-mail address on a suppression list so that we do not write to you again (Art. 6(1)(f)).
Retention. Beta signup data: until you unsubscribe or withdraw consent, and at the latest 12 months after the end of the closed beta. Sales enquiries: 12 months after the last contact, unless a contract follows. Records of consent and of its withdrawal: for the limitation period of possible claims (up to 6 years).
Providing this data is voluntary; without an e-mail address we cannot invite you to the beta.
3. Using the Service
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Account: e-mail, password hash, role, organisation and project membership | account, sign-in, access control | Art. 6(1)(b) contract | while the account exists, then up to 30 days |
| Acceptance records: document, version, hash, time, hashed IP address | proof of acceptance and of the withdrawal waiver | Art. 6(1)(c) legal obligation, 6(1)(f) defence of claims | account lifetime + 6 years (limitation period) |
| URLs you submit (normalised: no fragment, no tracking or secret parameters) | running checks, history | Art. 6(1)(b) | with the report |
| Page text/HTML fetched or sent in a job | running the check | Art. 6(1)(b) | 30 days after the job ends; private mode: deleted when the job ends |
| Reports: per-rule scores, quotes from the page | history, exports | Art. 6(1)(b) | 90 days (beta) or until deleted |
| Feedback on results | improving rules and calibration | Art. 6(1)(f) legitimate interest | until the end of the beta |
| Product events: user and organisation id, module, result, amounts (no page content, no e-mail addresses) | product analytics, billing checks | Art. 6(1)(f) | 24 months |
| Provider response archive: model outputs with scores, search result data, fetch metadata (host/URL, status, cost) | product analysis, calibration, billing reconciliation | Art. 6(1)(f) | no fixed limit; page content in it follows the 30-day rule above; private mode: no page content, URL only as host and hash |
| Balance, usage counters, purchases and invoices | billing, quotas | Art. 6(1)(b), 6(1)(c) tax law | usage: 90 days; accounting records: 5 years from year end |
| Technical logs (time, path, status, request id; host only, never full URLs, passwords or keys) | security, debugging | Art. 6(1)(f) | 30 days |
Private mode (project setting): reports keep only the host and a keyed hash of the address, and page content is removed as soon as the job finishes. API keys and invite tokens are stored only as hashes. IP addresses in acceptance records are stored only as a keyed hash. Product events are self-hosted; we use no third-party trackers in the application.
Providing account data is necessary to use the Service. We do not use your data for automated decisions with legal effect on you; the automated scores concern web pages, not people.
4. Recipients and processors
We share data only with providers needed to run the website and the Service, under data processing agreements:
| Category | Provider | Data | Location |
|---|---|---|---|
| Mailing list software | Sendy, self-hosted by us (our own instance) on a server of LH.pl Sp. z o.o. | beta signup data, consent and unsubscribe records | Poland (EU) |
| E-mail delivery | Amazon SES (Amazon Web Services EMEA SARL) | e-mail address, message content, delivery events | EU (Ireland, eu-west-1) |
| Website CDN and DNS | Bunny.net (BunnyWay d.o.o.) | IP address and request data when you visit the website | EU (Slovenia); edge servers may be outside the EU |
| Application, database and object storage hosting | Hetzner Online GmbH | all data stored by the Service, including beta and contact form data | EU (Germany, Finland) |
| LLM inference | OpenRouter, Inc. and the model hosts it routes to | page text, URL without query string, rule question; no account data | USA / various |
| GPU hosting (own model) | RunPod (Runpod, Inc.) | page text, URL without query string, rule question | USA / EU data centres |
| Page fetching (only when enabled) | Spider (spider.cloud) | URL without query string | USA |
| Payments (when paid plans start) | Stripe Payments Europe, Ltd. | name, e-mail, billing details, payment data | EU / USA |
We may disclose data to authorities where required by law.
5. Transfers outside the EEA
Some providers are located in or access data from the USA or other third countries (inference, GPU hosting, page fetching, payments; Amazon and Bunny.net may access data from outside the EEA for support and security). Transfers are based on an adequacy decision (EU-US Data Privacy Framework, where the provider is certified) or on the European Commission's Standard Contractual Clauses (2021/914) with supplementary measures. You can obtain a copy of the safeguards at roman@rozenberger.com.
6. Your rights
You have the right to access your data, to rectification, erasure, restriction of processing, data portability (for example export of your reports) and to object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time (for e-mails: the unsubscribe link) without affecting earlier processing. Write to roman@rozenberger.com; we reply within one month. You may lodge a complaint with a supervisory authority - in Poland the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warszawa).
7. Cookies
The website sets no cookies; the application uses only strictly necessary cookies. See the Cookie Notice.
8. Changes
We will publish changes here with a new version and notify account holders and subscribers of material changes.