Let's talk
Legal

Privacy notice

What this website collects, why, and what happens to it.

Who is responsible

The controller of the personal data described here is Michał Gorski (Michał Gorski Misoft), based in Wrocław, Poland. You can reach me through the contact page, where my email address and phone number are shown after a short human check.

The contact form and email

When you send a message through the form, I receive your name, email address, the topic you chose, your message, and, if you add it, your organization, together with the page you came from. I use these only to read and answer your message and to take steps you ask for before we agree to work together.

  • Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) and my legitimate interest in answering business enquiries (Article 6(1)(f) GDPR).
  • Giving these details is voluntary, but without your name, email address and message I cannot reply.
  • Retention: for as long as needed to handle your enquiry and, if we work together, for the period required by law. Enquiries that do not lead to cooperation are deleted after 24 months.
  • Recipients: the email provider Resend delivers the message to me, and the hosting provider Mikrus (UW-TEAM.org) serves the site. To limit abuse the form uses a hidden field, a rate limit and Cloudflare Turnstile. Short-lived technical records (for example a hashed network address for rate limiting) are kept only in the server's memory and for no longer than 24 hours.
  • I do not add you to a mailing list and I do not use your details for marketing.
  • Nothing you write or say on the contact page is sent to me until you press "Send message".

Occasional notes by email

If you subscribe to occasional notes, I send you occasional emails about my work, for example new case studies, articles and posts, and changes in my role. Subscribing has two steps: I first send a link to the address you gave, and the address is added only after you confirm it. An address that is not confirmed is not stored; the link expires after 7 days. Resend stores your email address, the language you chose, the page where you subscribed and the date you confirmed, and sends the emails for me. Legal basis: consent (Article 6(1)(a) GDPR). You can withdraw it at any time with the unsubscribe link in every email or by writing to me; your address is then deleted. I never sell or share your address. Subscribing is voluntary.

Voice dictation

If you choose "Speak instead of typing", your browser first asks for permission to use the microphone. Your browser then turns your speech into text on your own device: the audio and the text are not sent to this website or to any other service, and they are not stored. The text appears in the message box so that you can read and edit it; it is sent to me only if you press "Send message". The button is shown only in browsers that can recognise speech on the device.

Showing my email address and phone number

My email address and phone number are not printed in the page. Each is shown after a short check that you are a person, done by the same bot-protection service as the contact form. The check does not require you to enter personal data.

WhatsApp

If you choose to message me on WhatsApp, the conversation takes place in WhatsApp, which is operated by Meta Platforms Ireland Limited under its own terms and privacy policy. I can see your phone number, your profile name and your messages, and I use them only to reply to you. This website does not load any WhatsApp scripts and does not set cookies for it. Legal basis: Article 6(1)(b) and 6(1)(f) GDPR. I delete conversations that do not lead to cooperation after 24 months.

AI assistant

If you use the AI assistant, the questions you type are sent to Anthropic, which processes them to generate an answer. When Anthropic is unavailable, they are sent to Google instead. Both work under a data-processing agreement and with training on inputs disabled. When the assistant cannot read a job offer link directly, it may send that link, and nothing else about you, to Jina AI (Jina Reader) to fetch the page text. The assistant does not set cookies. While the browser tab is open, the conversation is kept in that tab's session storage so it survives moving between pages; it is deleted when you close the tab or choose New conversation. I store your conversation with the assistant on the server of this website: your messages, with email addresses and phone numbers masked, the assistant answers, and the time and language of each message. I use it to improve the assistant, to let you come back to an evaluation page and share it, and so that I can read it. A conversation that you never shared or sent is deleted 90 days after its last message. An evaluation page is kept for 12 months after it was created, and then deleted. Anyone who has the link to an evaluation page can open it. When you ask for a job-fit estimate, the website fetches the job offer from the link you give on its server, and an evaluation page stores the text of that offer. If you give an email address, the website sends the conversation to it from [email protected] through Resend, and I get a copy. The address, the time of each send and whether it worked are kept with the conversation for 12 months after the last share or send, then deleted. A conversation that you share, or send to an email address, gets a page that anyone with the link can open, and it is kept for 12 months after the last share or send. The email also has a link that lets anyone who holds it continue the conversation with the assistant for 12 months. Legal basis for sending it: Article 6(1)(b) GDPR (sending it at your request). I do not use the address for marketing. I can read the stored conversations and evaluation pages. Legal basis for storing them: Article 6(1)(f) GDPR (my legitimate interest in improving the assistant and in answering you). If the assistant cannot answer, the text of your question may be logged for up to 30 days, with email addresses, phone numbers and links masked and without any identifier, so that I can improve the assistant. Please do not enter confidential or personal information. Legal basis: Article 6(1)(f) GDPR (providing and improving the assistant you chose to use). When you use the "Message on WhatsApp" button from the assistant, the AI model writes a short summary of what you asked, from your own messages, and it is included in the draft message. You can read and edit the draft in WhatsApp, and nothing is sent to me until you press send there. The summary is not stored by this website. Email addresses and phone numbers that you type into the chat are hidden before your question is sent to the AI model.

Booking a call

If you use the Calendly link, Calendly processes the data you enter under its own privacy policy; the Calendly widget loads only after you agree to the "Scheduling" cookies, otherwise the link opens Calendly in a new tab. Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) and my legitimate interest in arranging business calls (Article 6(1)(f) GDPR). Bookings that do not lead to cooperation are deleted after 24 months.

Analytics

With your consent I use Google Analytics 4 to count page views and interactions, such as opening a case study or starting the form. It does not receive the contents of the form or the assistant. IP addresses are anonymized. Legal basis: consent (Article 6(1)(a) GDPR), which you can withdraw at any time through "Cookie settings". Retention: 2 months. Google may process data outside the European Economic Area under recognized transfer safeguards.

Videos in articles

Some articles include a video from my YouTube channel. The player loads only when you press the button on the video or allow "External media" in Cookie settings; before that, nothing is sent to YouTube. When it loads, Google (YouTube) receives your IP address, browser details and the page you are on, sets cookies and uses local storage in your browser. I use YouTube's privacy-enhanced mode (youtube-nocookie.com), in which, according to Google, your views of the video do not personalise ads shown to you elsewhere. Google processes this data as a separate controller under its own privacy policy, and may process it outside the European Economic Area under the EU-US Data Privacy Framework or standard contractual clauses. Legal basis: consent (Article 6(1)(a) GDPR), given by pressing the button or in Cookie settings; you can withdraw it at any time through "Cookie settings".

Server logs and security

Traffic to this site passes through Cloudflare, which delivers it securely to the server and processes technical data (such as IP address and request details) for that purpose and to protect the site. The hosting provider processes technical data (such as IP address and request details) to deliver and secure the site. The site's own logs record only technical events, never IP addresses, names or the content of messages. When something on the site fails, an error report is sent to Sentry so that the fault can be found and fixed. A report describes the error, the page and the browser, and may include an email address or other text that was part of the error. IP addresses are not stored, name and phone fields are removed, and phone numbers are masked in the error text. Reports are kept for at most 30 days. I am notified about errors by email and in Slack; a notification shows the error and the page where it happened. Sentry also receives the names of the site's log events, counts of events such as a sent contact form and the timing of about one in ten requests; they contain no IP addresses or message content and are kept for at most 30 days. Legal basis: legitimate interest in security and reliable operation (Article 6(1)(f) GDPR).

Who else processes data

Hosting: Mikrus (UW-TEAM.org). Network delivery and security: Cloudflare. Email delivery: Resend. Occasional notes: Resend. Abuse protection: Cloudflare Turnstile. AI assistant: Anthropic (Google as a fallback). Scheduling: Calendly. Messaging: WhatsApp (Meta). Analytics: Google. Videos in articles: Google (YouTube). Error monitoring: Sentry, with data stored in the European Union. Error notifications: Slack. Some of these providers process data outside the European Economic Area; where that happens they rely on recognized safeguards such as the EU-US Data Privacy Framework or standard contractual clauses.

People quoted in recommendations

The Recommendations page quotes recommendations that their authors published on LinkedIn, with their name, role and a link to their public profile. I publish them in my legitimate interest in presenting professional references (Article 6(1)(f) GDPR). If you are one of the authors and want your recommendation changed or removed, contact me and I will do it.

No automated decisions and no sale of data

I do not make decisions about you by automated means and I do not sell personal data.

Your rights

You can ask for access to your personal data, ask for it to be corrected or deleted, ask me to restrict or stop processing it, object to processing based on legitimate interest, ask for a portable copy, and withdraw consent at any time. To do any of these, contact me through the contact page. You also have the right to complain to the President of the Personal Data Protection Office (UODO) in Poland, or to your local supervisory authority.

Changes

I update this notice when the services behind the site change. Last reviewed: 29 September 2026.

Want this conversation in your inbox?

I'll send you the whole conversation with links, so you can come back to it or forward it.

Details of every cookie are in the Cookie notice.