Privacy policy

1. Who is responsible for your data

The controller of your personal data is Józef Batko, trading as Orpheline, a sole proprietorship registered in Poland at ul. Czarnowiejska 48/6, 30-054 Kraków, Poland, NIP 6772544217, REGON 545112955. Splot is the trading name under which that business operates. Full registration details are in the legal notice.

You can reach us about anything in this policy at hello@usesplot.com, or in writing at the address above. We have not appointed a data protection officer; requests go straight to the controller.

2. What data we collect

Depending on how you reach us, we may hold:

• Data you give us in the enquiry form, by email or over WhatsApp: your name, work email, company or website, a phone number if you choose to give one, country, a description of the product or order, quantity, timing, links, attachments, and the content of our correspondence.
• Technical data when you visit the site: IP address, date and time, device and browser information, security logs, the address of the page you view, referral or UTM source, and your cookie choice.
• Analytics data, only after you consent: identifiers and information about how the site is used. We do not knowingly send personal data to Google Analytics.
• For business-to-business outreach: a name, job title, company, a public work email address, and the source of that data, such as a public company website, LinkedIn, or a lawful data provider.

3. Why we use your data and on what legal basis

• To answer your enquiry, prepare a quote and take steps before a contract — Article 6(1)(b) GDPR.
• To carry on business correspondence, organise leads, protect against and pursue claims, keep the site secure, and run basic operational statistics — our legitimate interest, Article 6(1)(f) GDPR.
• To meet legal obligations, if any arise — Article 6(1)(c) GDPR.
• For Google Analytics and any future marketing or newsletter — only with your consent, Article 6(1)(a) GDPR. You can withdraw consent at any time, without affecting processing that already took place.

Our legitimate interest means: replying to businesses that contact us, developing our service, keeping the site secure, documenting our contact, and presenting a relevant offer to potential clients. You have an unconditional right to object to direct marketing.

4. Where outreach data comes from

When we contact a business first, the data comes from public company websites and professional profiles, from earlier correspondence, and from lawful business data providers where used. You will receive this information no later than in our first message, and every message gives you a simple way to opt out.

5. Who we share your data with

We share data only with providers who help us run the service, each acting under our instructions and in their real role:

• Hosting, content delivery and security: Vercel, which serves the site and keeps infrastructure and security logs.
• Enquiry delivery and correspondence: an email provider (Resend) and, where used, an automation webhook, to deliver and route what you send us; and the tools we use to store correspondence and keep a lead tracker (for example Google Workspace).
• Analytics: Google Analytics, only after you consent.
• Messaging: WhatsApp (Meta), only if you choose to contact us that way.
• Automation and AI tools that help us read, classify and organise enquiries and keep our lead tracker up to date, acting on our instructions.
• Advisers, accounting and public authorities, where this is necessary.

We do not name any tool as a controller or processor beyond its actual role and configuration.

6. AI and automation

We use AI tools to help read correspondence, classify enquiries, extract details and update our lead tracker, acting under Splot's instructions. These tools do not make decisions that produce legal or similarly significant effects; significant decisions stay with a person. We do not use your data to train AI models unless a provider's terms and settings clearly provide for it.

7. Transfers outside the EEA

Some providers may process data outside the European Economic Area. Where that happens, transfers are protected in line with the actual arrangements with the provider: an adequacy decision, the EU-US Data Privacy Framework where the provider and service are genuinely covered, or standard contractual clauses. We do not claim that a given provider is certified without checking.

8. How long we keep your data

• Enquiries, correspondence and the lead tracker: up to 24 months from our last meaningful contact, unless cooperation is ongoing, you have asked us to delete the data earlier, or we need it for claims or legal obligations.
• Outreach contacts: until you object, or up to 24 months from the last meaningful contact. A minimal suppression-list entry (email and date of objection) may be kept for 3 years solely so we do not contact you again.
• Google Analytics: event data is set to 14 months.
• Technical and security logs: for the period set by our hosting provider's configuration.
• Billing and contract documents: for the period required by law.

9. Your rights

You have the right to access your data and get a copy, to rectify it, to erase it, to restrict processing, to data portability where it applies, to object, to withdraw consent, and to lodge a complaint with the data protection authority in your country of residence, work, or of the alleged infringement.

To exercise any of these, write to hello@usesplot.com. As a rule we respond within one month.

10. Providing data is voluntary

Giving us your data is voluntary, but the fields marked as required are necessary for us to reply or prepare a quote. We do not collect special categories of data.

11. Cookies and analytics

Before you make a choice, only strictly necessary elements run. We do not load Google Analytics or send any analytics requests until you give active consent.

Our cookie banner gives you equally easy options: accept all, reject optional, or customise. There are no pre-ticked boxes. Cookies fall into two categories: necessary, always active, and analytical, optional. We remember your choice for up to 6 months, and you can change or withdraw it at any time through the “Cookie settings” link in the footer, just as easily as you gave it.

Analytics uses Google Analytics 4 (measurement ID G-KL2BXEVQ69). We run Google Consent Mode with analytics storage denied by default, and Google Analytics is only loaded once you accept the analytical category. WhatsApp is a plain outbound link; it loads nothing until you choose to open it.

12. Security and changes to this policy

We take reasonable measures to keep your data secure, though no method of transmission or storage can be guaranteed absolutely secure. We may update this policy; the date below shows when it last changed. This is an operational document and does not replace individual legal advice.