Privacy Policy

Applies to the GTM Toolkit client portal (gtm.zbigniew.ai) and the zbigniew.ai website. Last updated: 30 October 2026. In case of discrepancies, the Polish version prevails.

1. Data controller

The controller of personal data is Zbigniew Borowski, ul. Kasprowicza 41/1, 01-817 Warsaw, Poland, tax ID (NIP) 1181952413. Contact for all data matters: contact@zbigniew.ai.

2. Data we process

• Sign-in data: email address and full name provided at sign-in — via a one-time code sent by email, a Google account or (once enabled) LinkedIn.
• Portal account data: email address, full name, the company whose data the person may access, and the record of accepting the non-disclosure agreement (email, company, time, agreement version, language, country).
• Technical data and access log: date and time of visits, views opened, country derived from the IP address, a hash of the session identifier, a hash of the IP address (rotated daily) and a hash identifying the browser and device. The portal does not store the full IP address. The full IP address and browser data are recorded in the logs of the hosting and sign-in provider (Cloudflare).
• Content entered by users: e.g. questions asked to the assistant (chat) in the portal, requests and notification settings.

The zbigniew.ai website uses no cookies, analytics or trackers. The portal uses only strictly necessary cookies: the sign-in session cookie (Cloudflare Access) and a cookie remembering the selected client.

3. Purposes and legal bases

• authentication and access control to the portal — performance of a contract or steps taken at the person's request before entering into it (Art. 6(1)(b) GDPR) and the controller's legitimate interest (Art. 6(1)(f) GDPR);
• security, including detection of account sharing and abuse — legitimate interest (Art. 6(1)(f) GDPR);
• providing the service, including assistant answers to questions — performance of a contract (Art. 6(1)(b) GDPR);
• proof of acceptance of the non-disclosure agreement and the establishment or defence of legal claims — legitimate interest (Art. 6(1)(f) GDPR).

4. Google sign-in

When you sign in with Google we receive only basic profile data within the openid, email and profile scopes (email address and full name). We have no access to your mailbox, contacts, calendar or files. This data is used solely to sign you in and to check whether you have access to the portal; it is not sold, shared for advertising, or used to train AI models. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Processors

• Cloudflare, Inc. — hosting of the portal and website, sign-in (Cloudflare Access), database (D1);
• Google LLC — Google account sign-in, email;
• Anthropic, PBC — processing of questions asked to the assistant (chat) in the portal;
• LinkedIn Corporation — LinkedIn sign-in, once enabled.

Some of these providers are based in the United States. Transfers outside the European Economic Area are based on the standard contractual clauses approved by the European Commission, included in the data processing agreements with the providers, and — for certified providers — also on the European Commission's adequacy decision for the EU-US Data Privacy Framework. A copy of the safeguards can be obtained by writing to the address above.

6. Retention

Data is deleted automatically, daily, according to the following periods:

• account data (email, full name, company access, settings, notifications) — for as long as the person has access to the portal and 12 months after access ends;
• portal usage events (views opened, device fingerprint) — 180 days from recording;
• access log, questions to the assistant and answers, requests — 12 months from recording;
• non-disclosure agreement acceptance record — for the duration of portal access and 6 years after it ends (limitation period for claims).

Logs kept by providers (e.g. Cloudflare Access sign-in logs) are retained according to those providers' policies.

7. Your rights

You have the right to access, rectify and erase your data, to restrict processing, to data portability and to object to processing based on legitimate interest. You may also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland. For any request concerning your data, write to contact@zbigniew.ai.

8. Changes

We will announce material changes in the portal. The current version is always available at zbigniew.ai/en/privacy.