Privacy policy for the “Projekty” early-access list
Version of 19 October 2026. This is a translation; the Polish version describes the same rules.
This policy applies to people who join the early-access list for the Projekty app or message me about it on Instagram. I keep it short and specific, without unnecessary boilerplate.
1. Who processes your data
The data controller is me:
- Marcin Bykowski, sole proprietorship (Poland)
- ul. Turystyczna 3/6, 16-300 Augustów, Poland
- Tax ID (NIP) 8461620704, REGON 540093437
- Contact about your data: bykowskim@gmail.com
2. What data I collect and where it comes from
From the sign-up form
- your email address,
- the date, time and IP address of your sign-up, and the text shown next to the “Sign me up” button — as proof that you gave consent,
- where you came from (e.g. Instagram — link parameters) and the language version of the form.
From Instagram
When you comment “REELS” on a reel or send me a message:
- your profile name and ID,
- the content of your comment and messages,
- the buttons and answers you choose in the conversation (e.g. what takes up most of your time),
- whether you clicked the link to the form.
I don’t track whether you open my emails or click links in them.
3. Why and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|
| Sending you messages about the Projekty app: an invitation to test it, news, information about pricing and availability | Your consent — Art. 6(1)(a) |
| Replying to your comment and sending you the link in a private message on Instagram | My legitimate interest: answering your request — Art. 6(1)(f) |
| Learning what you need (your answers to my questions), so I know what to build and what to write about | My legitimate interest — Art. 6(1)(f) |
| Demonstrating that consent was given, and defending against possible claims | My legitimate interest — Art. 6(1)(f) |
Providing your data is voluntary. Without an email address you can’t join the list.
4. Who I share data with
I use five services. Each processes data only to the extent needed to do its job:
- Supabase — the database where I keep the list; servers in Frankfurt (Germany).
- Resend (Resend, Inc., USA) — sending emails: the welcome email and list updates. Emails go out from servers in Ireland; Resend stores account data and the sending log in the USA.
- Manychat, Inc. (USA, contact: privacy@manychat.com) — automated replies in Instagram messages.
- Cloudflare (Cloudflare Pages) — hosts the shootos.app/en/projekty page and the function that receives sign-ups; processes e.g. your IP address when you visit.
- Meta Platforms Ireland Ltd. — Instagram. Meta processes your account data under its own rules as a separate controller; its policy: privacycenter.instagram.com.
If you reply to my email, your message lands in my Google mailbox (Google Ireland Ltd.).
I don’t sell data and I don’t pass it to other companies for marketing.
5. Transfers outside the European Economic Area
Manychat, Inc., Resend, Inc. and Cloudflare, Inc. are based in the USA. Data is transferred under the EU-U.S. Data Privacy Framework (a European Commission decision confirming an adequate level of protection) and, for Manychat and Resend, additionally under standard contractual clauses approved by the European Commission. You can get a copy of the safeguards by writing to the address in section 1.
6. How long I keep data
- Email list — until you unsubscribe or withdraw consent. After you unsubscribe, your address is marked as unsubscribed so I don’t email you again by mistake. If you’d like, I’ll delete it completely.
- Instagram conversations in ManyChat — up to 12 months from the last message.
- Proof of consent (date, time, IP) — up to 3 years after you withdraw consent, only in case of a dispute.
7. Your rights
You have the right to:
- access your data and get a copy of it,
- correct your data,
- have your data deleted,
- restrict processing,
- transfer your data to another controller,
- object to processing based on my legitimate interest,
- withdraw your consent at any time — with the “Unsubscribe” link in every email or by writing to the address in section 1. Withdrawing consent doesn’t affect the lawfulness of what happened before.
If you believe I process your data unlawfully, you can lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl), or with the data protection authority in the EU country where you live or work.
8. Automated decisions
I don’t make decisions about you based solely on automated processing that would have legal effects. I segment the list by your answers (e.g. photo or video) to send more relevant content — that’s all.
9. Cookies
The shootos.app/en/projekty page doesn’t use cookies or analytics tools. It only stores your chosen theme (light or dark) in your browser — not for tracking.
10. Changes
If I change these rules, I’ll update this page and the date at the top. I’ll email people on the list about significant changes.
Marcin Bykowski · Tax ID (NIP) 8461620704 · REGON 540093437 · ul. Turystyczna 3/6, 16-300 Augustów, Poland ·
bykowskim@gmail.com