Who's responsible
CANDEV is run by Bart Grudka, based in Poland. I'm the controller of any personal data this site collects. For anything privacy-related, write to we@candev.pl.
Cookies
This site sets no cookies and stores nothing in your browser (no local storage, no session storage). There are no ad pixels, no Google Analytics, no embedded videos or third-party widgets. That's why you don't see a cookie banner.
Visitor statistics
I use Vercel Web Analytics to see which pages get read. It counts page views, the referring site, country, device type, browser and operating system. It doesn't use cookies. Visitors are told apart by a hash of the request that resets every day, so nobody can be followed across days or across other websites. I only see aggregated numbers, never individual visitors.
Legal basis: my legitimate interest in knowing how the site is used (Art. 6(1)(f) GDPR).
Server logs
The site is hosted by Vercel. Like any web server, it briefly processes your IP address, browser details and the page you asked for, so it can deliver the page and block abuse. These logs are kept for a short period set by Vercel and aren't used to identify you.
Legal basis: legitimate interest in running a secure website (Art. 6(1)(f) GDPR).
The contact form and email
When you use the contact form I receive what you type: your name, email address, store URL (optional), the kind of help you need and your message. The form is sent as an email through Resend and lands in the we@candev.pl inbox, which is forwarded by Cloudflare Email Routing to a Google Workspace mailbox. The same applies if you email me directly.
To stop spam, the form checks your IP address against a short rate limit. That check lives in server memory for about 10 minutes and isn't saved anywhere.
I use your details only to reply and, if we end up working together, to run the project. No newsletter, no marketing lists, nothing sold or shared for advertising.
Legal basis: steps you asked for before a possible contract (Art. 6(1)(b) GDPR) and my legitimate interest in answering messages (Art. 6(1)(f) GDPR).
How long: enquiries that don't turn into a project are deleted within 2 years of our last message. If we work together, messages are kept as long as needed for the project and any legal, tax or accounting obligations.
Who processes data for me
- Vercel Inc. (USA): hosting, server logs, visitor statistics.
- Resend (Plus Five Five, Inc., USA): sends contact form emails. Sending runs in the EU region (Ireland).
- Cloudflare, Inc. (USA): DNS and email forwarding.
- Google (Google Workspace): email storage.
Some of these companies are based in the USA. Transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
Your rights
You can ask for a copy of your data, have it corrected or deleted, restrict or object to its use, and get it in a portable format. Email we@candev.pl and I'll reply within 30 days. Giving your details is voluntary, but I can't answer a message without an email address.
You can also complain to the Polish data protection authority: Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.
No automated decisions or profiling happen on this site.
Changes
If what the site collects changes, this page changes first. The date at the top shows the latest version.