Privacy policy
Last updated: 28 October 2026
This policy explains what data we collect on hindbrain.io and in project conversations, why, how long we keep it and who processes it for us.
Controller
The controller is Hindbrain Adam Włodarczyk, tax ID (NIP) 1132799905, REGON 146836685, ul. Modlińska 56B/116, 03-198 Warsaw, Poland. For anything about personal data, write to kontakt@hindbrain.io. We have not appointed a data protection officer.
What we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Answering your inquiry, preparing and holding the project conversation | name, email, project description; if you provide them: company, timeline, links to your company website and social profiles, industry, team size, platforms, systems, market, whether sensitive data is involved; the correspondence | Art. 6(1)(b) GDPR (steps taken at your request before a contract) and Art. 6(1)(f) GDPR (handling correspondence) | 12 months from the last substantive contact, then deleted automatically |
| Booking an online call | name, email, chosen time | Art. 6(1)(b) GDPR | as above |
| Initial project review ("first look") and the project space | brief content, public content from the pages you linked, notes, links and files added to the space | Art. 6(1)(f) GDPR (our legitimate interest in preparing properly for the call) | the space link expires 7 days after the call, or 30 days after the inquiry if no call is booked; content is deleted with the inquiry |
| Reminders and follow-up messages about your inquiry | email, conversation stage, message dates | Art. 6(1)(f) GDPR (bringing the project conversation to a close) | at most about 30 days from the inquiry; reply that you want no more messages and they stop |
| Site security and abuse prevention (spam, bots, overload) | signed browser identifier, one-way hash of the IP address, general browser traits (browser and OS family, language, time zone, approximate screen size) during verification | Art. 6(1)(f) GDPR (protecting the site and the form) | 2 minutes to 7 days; rate-limit counters up to about 24 hours; technical server logs up to 30 days |
| Visit statistics and improving the site | only with your consent: pages visited, entry source and campaign parameters (UTM), clicks, page speed metrics, session recordings with form fields and form text masked | Art. 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law | events up to 24 months, session recordings 30 days; after you withdraw consent we collect nothing new |
Messages marked as spam are deleted after 30 days. Database backups are encrypted and rotated; deleted data disappears from them within 30 days at the latest. Emails already sent or received stay in our mailboxes for as long as the conversation needs them, and no longer than the inquiry retention period.
Artificial intelligence and automated messages
We use Anthropic's Claude model to prepare the initial project review. It receives the brief content and public content from the pages you linked. Your name, email address and phone numbers are removed first. The model also rates how complete the brief is. That rating helps us prepare the call and does not decide whether we contact you. The review is sent to you automatically by email and appears in your project space.
When you reply to one of our messages, AI summarises it and drafts a response. A person reads and approves every such response before it is sent. Call reminders and follow-up messages are sent automatically by our system on behalf of the Hindbrain team.
We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you (Art. 22 GDPR).
Who processes data for us
| Provider | What for | Where | Transfer safeguard |
|---|---|---|---|
| Hostinger International Ltd. | server: website, database, project space files, automations | Lithuania (EU) | data stays in the EU |
| Google Ireland Limited (Google Workspace) | email, calendar, Google Meet calls | EU and other countries | data processing agreement, standard contractual clauses, EU-U.S. Data Privacy Framework |
| Anthropic, PBC | Claude AI model: initial review, summaries and reply drafts | USA | data processing agreement with standard contractual clauses |
| Slack Technologies, LLC | internal team notifications about inquiries and reply drafts | USA | data processing agreement, EU-U.S. Data Privacy Framework |
| PostHog Inc. (PostHog Cloud EU) | visit statistics and session recordings, only with consent | EU (Germany) | data stays in the EU; data processing agreement with standard contractual clauses |
| home.pl S.A. | encrypted backups | Poland | data stays in the EU |
We disclose data to public authorities only when the law requires it.
Your rights
You have the right to access, rectify and erase your data, to restrict its processing and to data portability. You can object at any time to processing based on our legitimate interest, including follow-up messages. You can withdraw consent to statistics at any time in "Cookie settings" in the site footer; this does not affect processing that took place before withdrawal. Send requests to kontakt@hindbrain.io; we reply within one month.
You can also lodge a complaint with the Polish supervisory authority, Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw (uodo.gov.pl), or with the authority in your country.
Do you have to provide data
Providing data is voluntary. Without your name, email address and project description we cannot answer the inquiry. Other fields are optional and help us prepare the call.
Cookies and similar technologies
The full list of cookies and browser storage keys is in the cookie policy.
Changes
When we change how we process data, we will update this page and the date at the top.