Privacy policy

1. Who is the data controller

The controller of personal data is StartOrbit sp. z o.o., Tax ID (NIP) 7394032668, KRS 0001234782, ul. Władysława Trylińskiego 2, 10-683 Olsztyn, operating under the RobimyWeb brand. For matters concerning personal data, write to admin@robimyweb.pl.

2. What data I collect and why

Contact form and email

I collect your full name and email address and, if you provide them, also your phone number, company name and the content of your inquiry. I use them to reply and prepare an offer (Art. 6(1)(b) GDPR) and to contact you about your inquiry (Art. 6(1)(f) GDPR). I keep them for up to 12 months from our last contact, unless we sign a contract.

Together with your inquiry (also one sent from the chat or from a tool report) I save where it came from: which page of my website (e.g. a tip or the pricing page) or which source (e.g. Google search, Facebook, a direct visit). This shows me which content helps clients. I don’t save your browsing history, only this one piece of information.

Contracts and invoices

I keep the data needed for the contract and the invoice for the period required by tax law, i.e. 5 years from the end of the year in which the invoice was issued (Art. 6(1)(c) GDPR).

AI assistant on the website

I send the messages you type in the chat to Anthropic (Claude API, Anthropic PBC, USA) to generate a reply. Anthropic does not use data sent through the API to train its models. I store your questions and the assistant’s replies on my server for 90 days to see what the assistant could not answer and to fill the gaps in its knowledge. I do not store your IP address or browser data with them, and I replace email addresses and numbers (e.g. phone numbers) with placeholders before saving. Questions from one conversation are linked by a random number that stays with the conversation history in your browser until you close the tab. After 90 days the conversation is deleted automatically. Do not enter sensitive data in the chat. Legal basis: answering your question and improving the assistant (Art. 6(1)(f) GDPR). Anthropic processes the data in the USA on the basis of standard contractual clauses approved by the European Commission.

If you leave your name and email (and optionally your phone number) in the chat and send the conversation, it reaches me by email together with that data, the page you are writing from and the services in your inquiry. I treat it like an inquiry from the form: I use it to reply and prepare an offer (Art. 6(1)(b) GDPR) and keep it for up to 12 months from our last contact, unless we sign a contract.

If you write to the company number on WhatsApp (+48 723 467 579), an AI assistant that knows RobimyWeb’s offer replies straight away and says so in its first message. I send the message content to Anthropic (as with the chat on this website) to prepare the reply. On my server I store your number, your WhatsApp profile name and the questions and answers (I replace email addresses and other numbers in the text with placeholders) for 90 days from the last message. The assistant also assesses whether the conversation concerns an order: if so, it reaches me as an enquiry, which I keep for up to 12 months from the last contact. I read the conversations and can reply personally at any time; if you prefer to talk only to me, write “Anton”. Legal basis: answering your question and preparing an offer (Art. 6(1)(b) and (f) GDPR). Messages also pass through WhatsApp (Meta) under its own terms.

Booking a call (Cal.com)

The “Book a call” button opens a calendar on Cal.com (Cal.com, Inc., USA) in a new tab. No Cal.com script loads on my website. If you book a slot, you provide your name, email and the topic of the call there, and optionally your phone number and website address. I receive them together with the booking and use them to hold the call and prepare an offer (Art. 6(1)(b) GDPR). Cal.com processes data in the USA on the basis of standard contractual clauses approved by the European Commission. I keep booking data for up to 12 months from our last contact, unless we sign a contract.

Free website audit (“Check your website”)

When you enter a website address in the Check your website tool, my server fetches a few of the site’s public URLs (the page, the http:// version, robots.txt, the sitemap, llms.txt and security.txt) and checks the domain’s public DNS records. I also send the website address to Google PageSpeed Insights (Google LLC) to measure its speed. I store the address and the result for 30 days so that the report link works. Anyone who has this link can view the report. To enforce the audit limit and protect the tool against abuse, I store a hash of the IP address (not the address itself): for 24 hours in the limit counter, and for 30 days in the audit log together with the checked address. Legal basis: my legitimate interest in providing the tool and protecting it against abuse (Art. 6(1)(f) GDPR). If you send me the report with your name and email below the result, I treat it as an inquiry from the contact form.

Below the result you can also ask for the report by email. I send it once and, unless you tick the consent box, I do not store your address (to enforce the sending limit I keep only its hash for a day). Legal basis: performing your request (Art. 6(1)(b) GDPR). If you tick the consent box, I will send 2 more messages: a plan of fixes after 3 days and, after 10 days, the result of a second check of the site with an offer. For that time I store your email address, the address of the audited site, the score, the date and the wording of the consent, and I delete them 30 days after the last message. Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 398 of the Polish Electronic Communications Law). You can withdraw consent via the link in every message or by emailing me; the messages stop immediately.

Free competitor audit

When you enter a search phrase, a city and optionally your business in the Competitor audit tool, I send the phrase and city to Google Maps Platform (Google LLC) to get a list of businesses from Google Maps. I don’t store any data about the businesses: the analysis exists only in your open browser tab. My bot downloads the home pages of up to seven businesses from the analysis, and I send the addresses of these pages to Google PageSpeed Insights to measure their speed. To enforce the analysis limit and protect the tool from abuse, I store a hash of your IP address (not the address itself): for one day in the limit counter and, together with the phrase and city, for 30 days in the analysis log. Before the analysis, your browser solves a short computational task that filters out bots and contains no personal data. Legal basis: my legitimate interest in providing the tool and protecting it from abuse (Art. 6(1)(f) GDPR). If you send me the analysis with your name and email address, I treat it like an inquiry from the contact form.

Free Google Business Profile audit

When you enter a business name and city or paste a Google Maps link in the Google Business Profile audit tool (available in Polish only), I send this text to Google Maps Platform (Google LLC) to find the business, and once you select it, I retrieve its profile data from Google Maps. If you paste a short link (e.g. maps.app.goo.gl), my server first opens it at Google to read the full address. I don’t store any data about the business: the result exists only in your open browser tab. To enforce the audit limit and protect the tool from abuse, I store a hash of your IP address (not the address itself): for one day in the limit counter and, together with the ID of the checked place in Google Maps (Place ID), for 30 days in the audit log. Before the search, your browser solves a short computational task that filters out bots and contains no personal data. Legal basis: my legitimate interest in providing the tool and protecting it from abuse (Art. 6(1)(f) GDPR). If you send me the audit with your name and email address, I treat it like an inquiry from the contact form.

Free website builder

In the website builder (available in Polish only) you enter your business name, industry, city, service area, a description of your business, your email address and optionally a phone number, and in the editor you can add a logo, photos and customer reviews. I use this data to prepare your website and email you a link to download it (Art. 6(1)(b) GDPR). I send the business name, industry, city, service area and description (without the phone number and email address) to Google (Gemini API, paid version) so that the AI can write the website copy. I save photos again from scratch, without metadata, which also removes the GPS location.

The draft, together with its photos, stays on my server for 7 days after the last change (at most 30 days after it was created) and is then deleted. Only your browser and your mailbox know the link to it. When you download the website from the email link for the first time, I receive a message with your business details and your email address, so that I can reply if you want to order the upload of the website. Emails about the website itself (the download and edit links) are not advertising. To protect the builder from abuse, I store hashes of your IP address and email address (not the addresses themselves) in the limit counters for one day (Art. 6(1)(f) GDPR).

I send RobimyWeb offers by email and phone only if you tick a separate, voluntary consent in the builder (Art. 6(1)(a) GDPR). The builder works without it too. The consent takes effect when you confirm your address by downloading the website for the first time; without confirmation it is deleted after 8 days. I then keep your email address, phone number, business name, industry, city and the date and wording of the consent until you withdraw it or for 2 years after our last contact. You can withdraw your consent at any time with the unsubscribe link (“No more offers”) at the end of the email or by writing to me. Your address is then removed from the offer list immediately and the whole record after 30 days.

Analytics and ad measurement (only with consent)

If you consent, I use Google Analytics 4 and Google Ads conversion tracking (Google Ireland Limited). This tells me where inquiries come from. Without your consent, these tools do not load. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with the Cookie settings button in the footer.

Server and security

The server that runs the website keeps technical logs with a shortened IP address (without its last part) to protect the website against attacks and spam (Art. 6(1)(f) GDPR). I delete the logs automatically after about a month at the latest. The form limits the number of messages from a single address; the limit works on a hash of the IP address, not on the address itself. To filter out bots, the form fetches a one-time, time-limited token that contains no personal data. I also keep aggregate statistics, e.g. how many conversations with the assistant, form submissions and clicks on contact buttons (WhatsApp, Telegram, Facebook, phone, e-mail) there were, without message content and without IP addresses.

Without cookies and without storing anything on your device, I also count visits to the website: on every page view the browser sends the page name, the language version and the source of the visit (e.g. a search engine, Facebook or the previous page), and the server adds them to daily totals. I count the “Accept” and “Reject” choices in the cookie banner and the use of buttons in the “Review QR code” tool (e.g. downloading the code) the same way, without the review link or the business name. I don’t save the IP address or anything that could show who browsed the website or how; the counting limit uses a hash of the IP address for one hour (Art. 6(1)(f) GDPR).

When the website rejects a suspicious request (e.g. a hidden field filled in by a bot, a forged or expired token, an exceeded limit for a single address) or someone visits an address typical of break-in attempts (e.g. /wp-login.php), I record the IP address, the time, the type of event and the browser name. This helps me detect bots and attacks (Art. 6(1)(f) GDPR). I delete these entries after 30 days. For an address that sends many such attempts, I may temporarily block sending forms and using the tools; if this is a mistake, write to me. Normal browsing of the website and submitted forms do not go into this log.

Third-party resources

I host the site’s fonts, icons and libraries on my own server, so browsing the site does not connect you to other companies’ servers. The exceptions are Google Analytics and Google Ads measurement, which load only after you consent, and links you click (e.g. booking a call on Cal.com).

3. Cookies and browser storage

This data is needed for features you ask for, so it does not require consent. It stays in your browser and does not reach me until you send the form.

4. Who I share data with

Only companies that help me run the website see the data: the hosting provider OVHcloud (server in Canada, a country covered by a European Commission adequacy decision on data protection), the email provider OVHcloud (the admin@robimyweb.pl mailbox through which the form sends messages), Anthropic (AI assistant), Google (website copy in the website builder, speed measurement in the audits and business search in the competitor audit, and with your consent also Analytics and Ads), Cal.com (if you book a call) and my accounting office, if I issue an invoice. I don’t sell data and don’t send it to anyone else.

If you message me on WhatsApp or follow RobimyWeb on Telegram or Facebook, your data is also processed by these services (WhatsApp and Facebook: Meta Platforms Ireland, Telegram: Telegram Messenger) under their own privacy policies. I only see what the service shows me, e.g. your name and your message.

5. Your rights

You have the right to access your data, to have it rectified or erased, to restrict its processing and to data portability, as well as the right to object. If I process data on the basis of your consent, you can withdraw it at any time. This does not affect the lawfulness of processing carried out before the withdrawal. You can also lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa).

I do not make decisions based solely on automated processing and do not profile you in a way that produces legal effects.

6. Changes

If I change the way I process data, I will update this page and the date at the top.