Skip to content
AI for Everyone
Menu

Privacy policy

Effective from 14 October 2026.

1. Who is the data controller

The controller of personal data is Juliusz Tomeczek, running a business under the name JT CONSULTING - Juliusz Tomeczek, ul. Panewnicka 327/8, 40-773 Katowice, Poland, tax ID (NIP) 633-182-39-45, REGON 278085759. The AI for Everyone blog is one of the brands of this business. For data protection matters, please write to the address shown when JavaScript is enabled.

2. What data I process and why

You can read the blog without providing any data. I process personal data in five situations:

  • Newsletter. When you sign up, you provide your e-mail address and, if you wish, your first name. I also record the language of the page you signed up on and the date of sign-up, and, when you confirm, the date of confirmation and your IP address. This data is used to send the newsletter and to demonstrate that consent was given.
  • Contact form. You provide your first name, e-mail address and message. I also record which language version of the form the message came from and its date. I store the message in my contact management system and send a confirmation of receipt to the address you provided. I process this data in order to reply to your message. If you tick the newsletter consent, I also record the wording of that consent, and your address is added to the newsletter list on the terms described above.
  • Protecting the forms against abuse. The sign-up and contact forms are protected by ALTCHA, which runs on my own server without third-party services. To prevent automated mass sign-ups of other people's addresses or flooding them with confirmations from the contact form, I limit the number of form submissions from one IP address, the number of sign-ups of one e-mail address and the number of confirmations sent to that address per day. To count these attempts, I keep a cryptographic hash of the IP address and e-mail address, not the addresses themselves, for no longer than one day.
  • Server operation and security. The server logs technical data about each request, including the IP address and browser type.
  • Correspondence. If you write to me or reply to the newsletter, I process your e-mail address and the content of your message in order to reply.

3. Legal basis

Sending the newsletter is based on your consent (Article 6(1)(a) GDPR), which is also required by Article 398 of the Polish Electronic Communications Law, because the newsletter contains information about the services of JT CONSULTING. You give consent by ticking the box in the form and confirm it by clicking the link in the e-mail sent to the address you provided. Keeping proof of consent, protecting the forms, server logs, backups, replying to correspondence and to messages from the contact form, and sending a confirmation of their receipt are based on the controller's legitimate interest (Article 6(1)(f) GDPR), namely the need to demonstrate consent, keep the services secure and handle correspondence.

4. Who processes data on my behalf

To run the blog and the newsletter, I use the services of the following providers:

  • OVH provides the server in a data centre in Warsaw, on which the blog, the newsletter, the contact management system and the automations run,
  • Amazon Web Services EMEA SARL sends e-mails through Amazon SES from a data centre in Frankfurt,
  • Google Ireland Limited provides e-mail for the aiforeveryone.blog domain and stores encrypted server backups.

The newsletter (Listmonk), the contact management system (Twenty), the automations (n8n) and the statistics (Umami) are software running on my own server; their developers have no access to the data. The providers listed above process data on my behalf under data processing agreements and may not use it for their own purposes, with one exception: Amazon may store and automatically scan sent e-mails to block spam and malware.

5. Is data transferred outside the European Economic Area

The server and the sending service operate within the European Union. With Google and Amazon services, however, a transfer outside the European Economic Area cannot be ruled out. Such a transfer is then based on a European Commission adequacy decision (Data Privacy Framework) or on standard contractual clauses.

6. How long I keep data

  • I keep subscriber data until consent is withdrawn. After unsubscribing, the address stays on the list of unsubscribed addresses so that no further e-mail is sent to it, and I keep proof of consent and of unsubscribing for the limitation period for possible claims, no longer than three years.
  • I delete a sign-up that is not confirmed after 30 days.
  • I delete the hashes used to protect the forms after one day.
  • If processing a sign-up or a contact form message fails, the submitted data stays in the automation system for no longer than 14 days so that the cause of the error can be found.
  • I keep server logs for 30 days.
  • I keep backups for 7 days on the server and for 30 days in an encrypted external copy.
  • I keep correspondence, including contact form messages, for as long as the matter lasts and, after it ends, for the limitation period for possible claims, no longer than three years.

7. Your rights

You have the right to access your data, to have it rectified, erased or restricted, to data portability, and to object to processing based on legitimate interest. You can withdraw your consent to the newsletter at any time using the link at the bottom of every e-mail or by writing to the address in section 1; this does not affect the lawfulness of processing before withdrawal. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland).

8. Cookies and statistics

The blog does not set cookies. Visitor statistics are collected by Umami, a tool running on my own server, which does not use cookies and does not identify visitors. In the newsletter, I count e-mail opens and link clicks only in aggregate, without attributing them to any individual.

9. Is providing data mandatory

Providing data is voluntary. Without an e-mail address, however, I cannot send the newsletter or reply to a message. The first name in the sign-up form is optional; in the contact form, your first name, e-mail address and message are needed so that I can reply.

10. Automated decision-making and profiling

I do not make decisions based solely on automated processing and I do not profile blog visitors or subscribers.

11. Changes to this policy

This policy may change as the blog develops, for example when new tools are added. The version published at this address, with the date shown at the top, applies.