# Privacy Policy

> How AppWave processes personal data on appwave.dev: purposes, GDPR legal bases, cookies, analytics tools, retention periods and your rights.

- **Canonical URL:** https://appwave.dev/en/privacy
- **Language:** en

---

Version 1.0 · in force from 27 July 2026

This policy explains what data we collect on appwave.dev, why, on what legal basis and for how long we keep it. We wrote it to be readable without a lawyer - the statutes sit next to the explanation, not instead of it.

## 1. In short

The one-glance version: we do not sell data, we do not track you for advertising without consent, and everything outside analytics and marketing happens because you asked for it - by sending the form, downloading a quote or messaging the assistant.

- Simply reading the site requires no consent and no data from you. Your browser sends the standard technical data - IP address, browser type - that we need to serve the page and protect it from abuse.
- Analytics (Google Analytics 4, PostHog) and marketing (Google Ads and Meta Pixel) only start after you consent in the banner. Refusing does not restrict access to any content.
- The contact form, the quote download and the AI assistant collect exactly the data you type in - and only to reply to you.
- You can withdraw consent at any time: the “Manage cookies” button in the footer, the full file list in the [Cookie Policy](https://appwave.dev/cookies), and for marketing simply an email to [office@appwave.dev](mailto:office@appwave.dev).
- We do not sell your data and we do not share it with data brokers or ad networks for their own purposes.

## 2. Who is the controller of your data

The controller of your personal data is AppWave sp. z o.o., registered at ul. Kolumny 147E/1, 93-611 Łódź, Poland, entered in the Polish National Court Register under KRS number 0001193213, tax number (NIP) 9820394623, statistical number (REGON) 542683999.

Contact for data protection matters: email [office@appwave.dev](mailto:office@appwave.dev), phone [+48 538 441 413](tel:+48538441413), postal address as above. We answer every request, at the latest within one month (Article 12(3) GDPR).

We have not appointed a Data Protection Officer. We are not required to - we do not monitor individuals on a large scale and we do not process special categories of data on a large scale (Article 37 GDPR). All data protection matters are handled at the address above.

## 3. The law we operate under

- GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.
- The Polish Personal Data Protection Act of 10 May 2018 - national provisions supplementing the GDPR.
- The Polish Act of 18 July 2002 on the Provision of Electronic Services - which governs, among other things, commercial messages sent to your email address.
- The Polish Electronic Communications Law of 12 July 2024, Article 398. Since 10 November 2024 this is the provision that governs cookies and any data stored on your device in Poland; it replaced the former Article 173 of the Telecommunications Law.
- Regulation (EU) 2024/1689 (AI Act), Article 50 - the obligation to tell you that you are interacting with an artificial intelligence system. It applies to the assistant described in section 8.

## 4. What data we collect

We collect three kinds of data. The distinction matters, because each has a different legal basis and a different retention period.

| Kind | What exactly | Where it comes from |
| --- | --- | --- |
| Data you give us | First and last name, email address, phone number, company name, message content, the content of your conversation with the AI assistant, records of the consents you gave | Contact form, the form shown before a quote download, the assistant chat, email, phone calls |
| Technical data | IP address, browser type and version, operating system, language, referring page, the page you visit, date and time | Automatically, by the server - on every visit |
| Behavioural data | Pages visited, time on page, button clicks, calculator selections, approximate location (country and city), analytics identifier | Google Analytics 4 and PostHog - only after you consent to analytics cookies |

We do not collect special categories of data under Article 9 GDPR - health, opinions, trade union membership, biometrics. Please do not put such data in a message or in the chat.

Providing data is always voluntary. Without a name and email address we cannot reply to an enquiry, and without the form data we cannot release the quote file - those are the only consequences.

## 5. Why we process data, on what basis and for how long

Every purpose has its own legal basis and its own retention period. The table below is the complete list - we do not use data for anything that is not here.

| Purpose | Legal basis | How long |
| --- | --- | --- |
| Replying to a contact form enquiry and following up on it | Article 6(1)(b) GDPR - steps taken at your request before entering into a contract; Article 6(1)(f) GDPR - our legitimate interest in handling correspondence | 24 months from the last contact. If we start working together - for the duration of the engagement and the limitation period for claims |
| Releasing the calculator quote file and the sales follow-up on it | Article 6(1)(b) GDPR - providing the file at your request; Article 6(1)(f) GDPR - direct marketing of our own services | 24 months from receiving the data, or until you object |
| Handling your conversation with the AI assistant | Article 6(1)(b) and (f) GDPR - giving you the answer you asked for | 12 months from the end of the conversation |
| Sending marketing information to your email address (a separate, optional checkbox) | Article 6(1)(a) GDPR - consent, together with Article 10 of the Polish Act on the Provision of Electronic Services | Until you withdraw consent. We keep the record of the consent being given and withdrawn for 3 years longer, as accountability evidence (Article 7(1) GDPR) |
| Statistics and improving the site - Google Analytics 4, PostHog | Article 6(1)(a) GDPR - consent to analytics cookies; Article 398 of the Polish Electronic Communications Law | Analytics events: up to 14 months in GA4 and up to 12 months in PostHog. Session recordings: up to 30 days |
| Counting visits without cookies when you refuse analytics consent | Article 6(1)(f) GDPR - our legitimate interest in basic traffic statistics, achieved without storing anything on your device (details in section 7) | Up to 12 months, in a form that does not allow us to identify you |
| Advertising and measuring its effectiveness - Google Ads and Meta Pixel | Article 6(1)(a) GDPR - consent to marketing cookies | Until you withdraw consent. Individual files expire after 13 months at the latest |
| Site security: server logs, spam protection, submission rate limits | Article 6(1)(f) GDPR - our legitimate interest in keeping the service secure and available | Server logs: 12 months. Rate limiter data: 1 hour, held only in the server memory |
| Invoicing, accounting and tax obligations, if we start working together | Article 6(1)(c) GDPR - legal obligation under the Polish Accounting Act and Tax Ordinance, among others | 5 years from the end of the tax year in which the obligation arose |
| Establishing, pursuing or defending legal claims | Article 6(1)(f) GDPR - legitimate interest | Until the limitation period for claims expires, as a rule 3 or 6 years |

Wherever we rely on legitimate interest (Article 6(1)(f) GDPR) you have the right to object. How to do it - section 12.

## 6. Cookies and browser storage

Cookies and similar technologies - local storage, session storage - are data written to your device. In Poland they are governed by Article 398 of the Electronic Communications Law: everything beyond what is strictly necessary to deliver the service you asked for requires your consent, given knowingly and before anything is stored.

That is why the consent banner appears before we run anything optional, and every toggle is off by default. Closing the banner with the X is recorded as a refusal, not as consent.

The banner has exactly three categories, and those same three are described below. Nothing runs outside them.

| Banner category | What it does | Basis | Can you turn it off |
| --- | --- | --- | --- |
| Necessary | Remembers your banner choice and your language, keeps your assistant conversation going, and makes sure the form before a file download does not ask for the same data twice within 30 days | Article 398(3) of the Electronic Communications Law - the exemption for data strictly necessary to deliver the service you requested | No. Without them the site cannot even remember that you refused cookies |
| Analytics | Google Analytics 4 and PostHog count visits and show which content gets read and where people get lost. With consent PostHog may also record a session (form field contents are masked) and show a short survey | Article 6(1)(a) GDPR - consent | Yes, at any time |
| Marketing | Measure how well our ads work and let us show you more relevant ads off our site. Google Ads and Meta Pixel on Facebook and Instagram | Article 6(1)(a) GDPR - consent | Yes, at any time |

The named list of files - name, provider, purpose and lifetime - is in the [Cookie Policy](https://appwave.dev/cookies).

You can change your choice at any moment: click “Manage cookies” in the site footer. The change takes effect immediately - we stop collecting and delete the Google Analytics files from your browser. Withdrawing consent does not affect the lawfulness of what we collected beforehand (Article 7(3) GDPR).

You can also block and delete cookies in your browser settings. Blocking the necessary ones will break the site - the consent banner will reappear on every visit, because there is nowhere to record your choice.

## 7. Analytics and marketing tools in detail

We describe each tool separately, because they differ in where the data goes and what exactly they do.

### Google Analytics 4 - traffic statistics

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. GA4 tells us how many people visit the site, where they come from and what they read.

We run it in Google Consent Mode v2 with every consent denied by default. Until you click something in the banner, the Google tag stores no files and no identifiers. We also enabled two settings that limit data in the absence of consent: ads_data_redaction strips identifiers from advertising requests, and url_passthrough carries the visit source in the URL instead of in a cookie. Your IP address is truncated before storage and is not retained by Google.

When you withdraw analytics consent, we delete the _ga, _gid and _gat files from your browser.

More: [how Google uses data from partner sites](https://policies.google.com/technologies/partner-sites) and the [Google Privacy Policy](https://policies.google.com/privacy).

### PostHog - on-site behaviour

Provider: PostHog Inc. We use its European cloud, so the data is stored in the European Union (Frankfurt, Germany). PostHog shows us visitor paths and the points where people give up.

Two things are worth saying plainly here, because they are not visible from the outside.

- Requests to PostHog go through our own domain, at appwave.dev/ph. This is a technical relay: the data still reaches PostHog, but ad-blocking extensions do not strip it along with the rest of the scripts. We mention it because the address alone gives no hint that a third-party provider is involved.
- If you refuse analytics cookies, PostHog stores nothing on your device and assigns you no identifier. It records the visit itself by computing, on the server side, a hash of your IP address, browser type and a random value that rotates daily. The hash cannot be reversed, and once the value rotates, two visits on different days can no longer be linked. We do this under Article 6(1)(f) GDPR: we want to know how many people our content reaches, without knowing who they are. You may object - write to [office@appwave.dev](mailto:office@appwave.dev).

Once you consent, PostHog may additionally record the session: cursor movement, clicks, scrolling. Form field contents are masked by default - we cannot see what you type until you submit the form.

More: [PostHog Privacy Policy](https://posthog.com/privacy).

### Google Ads

If you consent to marketing cookies, Google can connect your visit to a click on one of our ads, so we know which campaigns actually produce enquiries. The _gcl_au file does this. We do not pass your name, email address or phone number to Google.

### Meta Pixel

Meta Pixel is live on the site - a tool from Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland) that measures how well our ads perform on Facebook and Instagram.

The pixel runs only after you consent to marketing cookies, and it stores _fbp (our domain, 90 days) and fr (facebook.com domain, 90 days). It sends Meta information about the page visited and the action taken. We do not send form data through it.

We send the same events to Meta a second time from our own server, through the Conversions API. The reason is technical. Ad blockers and privacy settings swallow 20 to 40 percent of events sent from the browser, including those of people who did consent. Both copies carry the same identifier, so Meta counts each event once.

The server sends exactly what the browser pixel sends: the event name, the page address, which resource it concerned, and your IP address, browser details and the _fbp and _fbc files. Form data is never sent this way, in any form, including encrypted. Your name, email address and phone number stay in our enquiry system and never reach Meta. Without marketing consent nothing is sent from there either.

For the collection of that data and its transmission to Meta, we and Meta Platforms Ireland Limited are joint controllers (Article 26 GDPR). The arrangement is set out in the [Meta Controller Addendum](https://www.facebook.com/legal/controller_addendum); Meta is responsible for its own subsequent processing and for handling your rights in that respect. Details: [Meta Privacy Policy](https://www.facebook.com/privacy/policy).

### Fonts, maps and video

We serve the Inter typeface from our own server - it is downloaded once, at build time. Your browser never contacts Google servers for it and never sends them your IP address. We also do not embed Google Maps or YouTube videos.

## 8. The AI assistant on the site

In the bottom right corner of the site there is the BetterCX assistant - our own product. You are talking to an artificial intelligence system, not to a person. We say so explicitly, because Article 50 of Regulation (EU) 2024/1689 (the AI Act) requires it.

The assistant only starts when you open it. We then process the content of your messages, any images you attach, the conversation identifier and timestamps. The conversation identifier is stored in your browser so that refreshing the page does not restart the conversation.

Responses are generated by a language model supplied by OpenAI, L.L.C. (USA), acting as our sub-processor. Under its API terms, data sent through the interface is not used to train models and logs are deleted as a rule within 30 days. The BetterCX platform infrastructure runs on Amazon Web Services in a European Union region.

Please do not type passwords, document numbers, health data or other people’s personal data into the chat - none of it is needed to talk about a project.

The assistant makes no decisions about you that produce legal effects. If you consent to analytics cookies, we additionally record the fact that the chat was opened and a message sent - without its content - as a statistical event.

## 9. Forms, downloads and booking a call

### Contact form

Fields: first name, email address, optionally company name, and the message. Delivery is handled on our behalf by Resend, a transactional email provider. The message lands in our office@appwave.dev mailbox.

Before sending, we ask you to tick a data processing consent box. It confirms that you have read the information notice: the processing itself rests on Article 6(1)(b) and (f) GDPR, so unticking it does not automatically delete earlier correspondence. Any erasure request will of course be handled as described in section 12.

Marketing consent is a separate checkbox, unticked by default. It is not required to send the message and you can withdraw it with a single email.

The form is protected from spam by a hidden trap field and by measuring how long it took to fill in, and the server limits submissions from one IP address to three per hour. The IP address is held for that purpose in the server memory only and disappears after an hour.

### Downloading a quote from the calculator

To download the quote file we ask for your first and last name, email address, phone number and optionally company name. The data goes to our CRM - HubSpot - together with a note of where on the site the contact came from and a separate marketing consent flag.

Your browser then only stores the date the file was unlocked, so that we do not ask for the same data again for 30 days. The file itself is generated in your browser - its contents are never sent anywhere.

Ticking the marketing consent box is optional and is never a condition of the download.

### Booking a consultation

The “book a consultation” buttons lead to Calendly, an external service. We do not embed it, so Calendly stores nothing on your device until you go there yourself. The link carries only which page you came from and which quote variant you were looking at; none of your personal data is passed in it.

The data you give when booking - name, email address, chosen time - reaches us as controller, and Calendly processes it on our behalf. The [Calendly Privacy Notice](https://calendly.com/privacy) also applies.

## 10. Who we share data with

We do not sell data. We share it only with providers working for us under a data processing agreement (Article 28 GDPR), and with bodies we are legally obliged to disclose it to.

| Recipient | What for | Where it processes data |
| --- | --- | --- |
| Hetzner Online GmbH | Hosting the site, the application and the CMS; server logs | Germany and Finland (EEA) |
| Resend, Inc. | Delivering messages sent from the contact form | USA |
| HubSpot, Inc. | CRM - handling contacts captured at the quote download | EU and USA |
| Google Ireland Limited | Google Analytics 4 and Google Ads - after consent | EU, with access from the USA |
| PostHog Inc. | On-site behaviour analytics | EU (Frankfurt), with support access from outside the EEA |
| Meta Platforms Ireland Limited | Meta Pixel - only after marketing consent | EU, with access from the USA |
| OpenAI, L.L.C. | Generating the AI assistant’s responses | USA |
| Amazon Web Services | Infrastructure of the BetterCX platform behind the assistant | EU |
| Calendly, LLC | Booking consultation slots | USA |
| Accountants, legal counsel, IT service providers | Accounting and legal support, systems maintenance | Poland and the EEA |
| Public authorities | Only where the law obliges us to disclose | Poland |

We have a data processing agreement with every provider in this table that processes data on our behalf. None of them may use your data for their own purposes.

## 11. Transfers outside the European Economic Area

Some of the providers listed in section 10 are based in the United States. Transfers outside the EEA then rely on one of two mechanisms:

- the European Commission adequacy decision of 10 July 2023 for the EU-US Data Privacy Framework, where the provider is certified under that programme (Article 45 GDPR);
- Standard Contractual Clauses approved by the European Commission, supplemented by a transfer impact assessment and additional technical safeguards including encryption (Article 46(2)(c) GDPR).

Site hosting is entirely within the EEA. PostHog analytics data and the AI assistant infrastructure run in the European Union; only the provider’s support traffic leaves the EEA.

We will provide a copy of the safeguards in place on request - write to [office@appwave.dev](mailto:office@appwave.dev).

## 12. Your rights

The GDPR gives you specific rights against us. To use them, one email to [office@appwave.dev](mailto:office@appwave.dev) is enough. You do not need to cite a legal basis or fill in any form.

| Right | What you can actually do |
| --- | --- |
| Access (Art. 15) | Find out whether and what data we hold about you, and get a copy of it |
| Rectification (Art. 16) | Correct inaccurate data and complete incomplete data |
| Erasure (Art. 17) | Ask us to delete data - including when it is no longer needed, when you withdraw consent, or when you successfully object |
| Restriction (Art. 18) | Pause processing while we verify the accuracy of the data or consider your objection |
| Portability (Art. 20) | Receive the data you provided under consent or a contract in a machine-readable format - or have it sent to another controller |
| Objection (Art. 21) | Object to processing based on our legitimate interest. If the objection concerns direct marketing, we stop immediately and without asking why |
| Withdrawal of consent (Art. 7(3)) | Withdraw any consent at any time. This does not affect the lawfulness of processing before withdrawal |
| Complaint (Art. 77) | Lodge a complaint with a supervisory authority |

We respond within one month. If the matter is complex we may extend this by two months - but we will tell you within the first month and explain why (Article 12(3) GDPR). Exercising your rights is free of charge.

The supervisory authority in Poland is the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, [uodo.gov.pl](https://uodo.gov.pl). You may also complain to the authority in your country of habitual residence or place of work.

## 13. Automated decisions and profiling

We do not take decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you (Article 22 GDPR). How we answer an enquiry and what price we quote is decided by a person.

Once you consent to analytics and marketing cookies, we group visitor behaviour into statistics and advertising audiences. That is profiling within the meaning of the GDPR, but it serves only to improve the site and target ads - it never changes the offer or the price shown to an individual.

## 14. Data security

We apply technical and organisational measures appropriate to the risk (Article 32 GDPR).

- All traffic on the site is encrypted - HTTPS with HSTS enforced.
- Servers are located in the European Union, in certified data centres.
- Access to mailboxes, the CRM and analytics tools is limited to people who need it for their work, with two-factor authentication.
- We block our site from being framed by other services and we disable access to the camera, microphone and geolocation - our site will never ask for them.
- We collect only the data we actually need and delete it once the periods in section 5 expire.

If a personal data breach nevertheless occurred and posed a high risk to your rights, we would notify you without undue delay (Article 34 GDPR) and the supervisory authority within 72 hours.

## 15. Children

Our services are aimed at companies and self-employed professionals. The site is not intended for people under 16 and we do not knowingly collect their data. If you know that a child has given us their data, write to [office@appwave.dev](mailto:office@appwave.dev) and we will delete it.

## 16. External links and social media

The site links out to external services, including our profiles on [LinkedIn](https://www.linkedin.com/company/appwavedev), [Instagram](https://www.instagram.com/appwave.dev) and [TikTok](https://www.tiktok.com/@appwave), and to the [BetterCX](https://bettercx.ai) platform. This policy does not cover them - once you follow the link, those services’ own rules apply.

If you interact with us on one of our social profiles - a follow, a comment, a message - we process the data visible there in order to run the profile and reply, under Article 6(1)(f) GDPR. The platform provider is then a separate or joint controller, according to its own terms.

## 17. Changes to this policy

We update this policy when what we actually do with data changes - for example when a new tool is added.

The version number and the date it takes effect are at the top of the page. For material changes - ones that widen the scope of processing or add a new recipient - we will notify you by showing the consent banner again and, if we have your address, by email.

Previous versions are available on request.

## 18. Contact

A question about this policy or about your data? Write plainly - a person will answer.

- Email: [office@appwave.dev](mailto:office@appwave.dev)
- Phone: [+48 538 441 413](tel:+48538441413)
- Address: AppWave sp. z o.o., ul. Kolumny 147E/1, 93-611 Łódź, Poland

---

## About AppWave

AI automation agency from Łódź, Poland. We build custom AI software, automation agents and web applications. We co-create them with the client and guarantee every system we deliver.

- **Legal name:** AppWave sp. z o.o.
- **Address:** ul. Kolumny 147E/1, 93-611 Łódź, Poland
- **Phone:** +48 538 441 413
- **Email:** office@appwave.dev
- **Business hours:** Monday-Friday, 09:00-17:00
- [Free consultation](https://appwave.dev/en/appointment)