LEGAL

Privacy policy

Last updated: 11 October 2026

Who is responsible for your data

Lech Kaniuk runs lechkaniuk.com and is the controller of the personal data collected here. For anything privacy-related, write to contact@lechkaniuk.com.

Data is never sold or used for advertising. I use no automated decision-making, including profiling.

What I collect, why, and for how long

Visits (Vercel Web Analytics)

Data: Page views, the page visited, referrer, country, device and browser type. No cookies. Visits are told apart by a hash of the request, discarded after 24 hours.

Legal basis: Legitimate interest (GDPR art. 6(1)(f)): knowing which content is useful.

Retention: Aggregate figures that cannot identify a person.

Google Analytics 4 (only after you click Accept)

Data: Pages viewed, clicks (for example on books or tools), device, browser and approximate location. Google Analytics sets the _ga and _ga_* cookies. Before you accept, the Google script does not load at all.

Legal basis: Consent (art. 399(1) of the Polish Electronic Communications Law and GDPR art. 6(1)(a)). Withdraw it at any time with "Cookie settings" in the footer; the Google cookies are then deleted.

Retention: No longer than 14 months. When a form is submitted, the server may also record in Google Analytics that the event happened (for example "newsletter signup"), with no identifier and no personal data.

Newsletter and unlocking book chapters

Data: Email address, language and where on the site you signed up. Entering your email to unlock further book chapters subscribes you to the newsletter. The unlock is remembered by a signed reader_unlock cookie that contains no email address.

Legal basis: Consent (GDPR art. 6(1)(a)).

Retention: Until you unsubscribe (link in every email) or ask for deletion.

Forms: contact, speaking, pitch

Data: Name, email, company, your message and anything you choose to include (for example a link to a deck).

Legal basis: Legitimate interest in replying to you (GDPR art. 6(1)(f)), or steps taken at your request before a contract, such as a speaking engagement (art. 6(1)(b)).

Retention: Up to 24 months after our last exchange, unless longer storage is needed to perform a contract or to establish, exercise or defend legal claims. If the email notification about a submission fails, the submission is stored temporarily in a database until it is handled.

Technical logs

Data: IP address, requested page, time and browser.

Legal basis: Legitimate interest in security and fixing errors (GDPR art. 6(1)(f)).

Retention: Short, as set by the hosting provider (typically a day to a few weeks).

Books are bought in a Shopify store or on Amazon, under their own terms and privacy policies. I never receive card details.

Cookies and browser storage

  • lk_cookie_consent, analytics_consent · browser storage Your analytics choice. Necessary.
  • reader_unlock · cookie, 12 months Proof that you unlocked the chapters. Necessary for that feature.
  • _ga, _ga_* · cookie, up to 2 years Google Analytics. Only after consent; deleted when you withdraw it.
  • reading progress, tool answers, reader_email · browser storage Stay on your device and are never sent to me.

Change your choice at any time: .

Who receives data

Providers that process data on my behalf under data processing agreements, and other recipients:

  • Vercel Inc.: hosting and server functions (Frankfurt region, EU).
  • Google Ireland Limited: Google Analytics, only with consent.
  • MailerLite: newsletter delivery.
  • MailerSend or Resend: delivering form notifications.
  • Supabase: signup database and a backup copy of undelivered submissions.
  • Eleven Ventures: a pitch may be forwarded to the fund when it fits its focus. You will be told in my reply.

Some are US companies. Transfers outside the European Economic Area rely on the EU-US Data Privacy Framework or on Standard Contractual Clauses approved by the European Commission.

Your rights

You have the right to access, correct, delete, restrict and port your data, and to object to processing based on legitimate interest. You can withdraw consent at any time; this does not affect processing that happened before. Write to contact@lechkaniuk.com . I reply within one month.

You can also complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl ), or to the authority in the country where you live, such as IMY in Sweden.

Do you have to provide data

No. Providing data is voluntary, but without an email address I cannot send the newsletter or reply to your message.

Changes

When the way data is processed changes, I update this page and the date at the top.