Privacy policy

1. Who is responsible for your data

The controller of your personal data is Józef Batko, trading as Orpheline, a sole proprietorship registered in Poland at ul. Czarnowiejska 48/6, 30-054 Kraków, Poland, NIP 6772544217, REGON 545112955. Splot is the trading name under which that business operates. Full registration details are in the legal notice.

You can reach us about anything in this policy at hello@usesplot.com, or in writing at the address above. We have not appointed a data protection officer; requests go straight to the controller.

2. What data we collect

Depending on how you reach us, we may hold:

• Data you give us in the enquiry form, by email or over WhatsApp: your name, work email, company or website, a phone number if you choose to give one, country, a description of the product or order, quantity, timing, links, attachments, and the content of our correspondence.
• Technical data when you visit the site: IP address, date and time, device and browser information, security logs, the address of the page you view, referral or UTM source, and your cookie choice.
• Analytics data, only after you consent: identifiers and information about how the site is used, processed by Google Analytics and PostHog. We do not send Google Analytics the content of your enquiry or your email address.
• Advertising data, only after you consent: the Meta Pixel records that you opened a page on this site, together with your IP address, browser information and Meta cookie identifiers, and reports it to Meta.
• Conversion data, after you send an enquiry: we report that the enquiry was delivered to Meta (Conversions API), Google Analytics (Measurement Protocol) and PostHog, so we can tell which ads and pages produced it. Meta receives a hashed email address, plus the IP address and browser information of the request. Google Analytics and PostHog receive the event with a visit identifier if you had already consented to analytics cookies, otherwise without one. We do not send any of them the content of the enquiry.
• For business-to-business outreach: a name, job title, company, a public work email address, and the source of that data, such as a public company website, LinkedIn, or a lawful data provider.

3. Why we use your data and on what legal basis

• To answer your enquiry, prepare a quote and take steps before a contract — Article 6(1)(b) GDPR.
• To carry on business correspondence, organise leads, protect against and pursue claims, keep the site secure, and run basic operational statistics — our legitimate interest, Article 6(1)(f) GDPR.
• To meet legal obligations, if any arise — Article 6(1)(c) GDPR.
• For Google Analytics and PostHog, for the Meta Pixel and the advertising we run with it, and for any future newsletter: only with your consent, Article 6(1)(a) GDPR. Analytics and marketing are separate choices and you can give one without the other. You can withdraw either at any time, without affecting processing that already took place.
• To measure which advertising and pages produced a submitted enquiry, by sending a conversion event to Meta, Google Analytics and PostHog after the enquiry is delivered: our legitimate interest, Article 6(1)(f) GDPR. Cookie identifiers are included only when they already exist.

Our legitimate interest means: replying to businesses that contact us, developing our service, keeping the site secure, documenting our contact, and presenting a relevant offer to potential clients. You have an unconditional right to object to direct marketing.

4. Where outreach data comes from

When we contact a business first, the data comes from public company websites and professional profiles, from earlier correspondence, and from lawful business data providers where used. You will receive this information no later than in our first message, and every message gives you a simple way to opt out.

5. Who we share your data with

We share data only with providers who help us run the service, each acting under our instructions and in their real role:

• Hosting, content delivery and security: Vercel, which serves the site and keeps infrastructure and security logs.
• Enquiry delivery and correspondence: an email provider (Resend) and, where used, an automation webhook, to deliver and route what you send us; and the tools we use to store correspondence and keep a lead tracker (for example Google Workspace).
• Analytics: Google Analytics and PostHog, after you consent, and a conversion event after you send an enquiry.
• Advertising: Meta (Facebook and Instagram), through the Meta Pixel on this site after you consent to the marketing category, and through the Conversions API after you send an enquiry. Meta uses the data as a controller in its own right for measuring and targeting the ads we buy.
• Messaging: WhatsApp (Meta), only if you choose to contact us that way.
• Automation and AI tools that help us read, classify and organise enquiries and keep our lead tracker up to date, acting on our instructions.
• Advisers, accounting and public authorities, where this is necessary.

We do not name any tool as a controller or processor beyond its actual role and configuration.

6. AI and automation

We use AI tools to help read correspondence, classify enquiries, extract details and update our lead tracker, acting under Splot's instructions. These tools do not make decisions that produce legal or similarly significant effects; significant decisions stay with a person. We do not use your data to train AI models unless a provider's terms and settings clearly provide for it.

7. Transfers outside the EEA

Some providers may process data outside the European Economic Area. Where that happens, transfers are protected in line with the actual arrangements with the provider: an adequacy decision, the EU-US Data Privacy Framework where the provider and service are covered, or standard contractual clauses.

8. How long we keep your data

• Enquiries, correspondence and the lead tracker: up to 24 months from our last meaningful contact, unless cooperation is ongoing, you have asked us to delete the data earlier, or we need it for claims or legal obligations.
• Outreach contacts: until you object, or up to 24 months from the last meaningful contact. A minimal suppression-list entry (email and date of objection) may be kept for 3 years solely so we do not contact you again.
• Google Analytics: event data is set to 14 months.
• PostHog: event data is kept for the retention period set on the project.
• Meta Pixel: the data sits in Meta's advertising systems and is kept for the periods Meta sets, which we do not control.
• Technical and security logs: for the period set by our hosting provider's configuration.
• Billing and contract documents: for the period required by law.

9. Your rights

You have the right to access your data and get a copy, to rectify it, to erase it, to restrict processing, to data portability where it applies, to object, to withdraw consent, and to lodge a complaint with the data protection authority in your country of residence, work, or of the alleged infringement.

To exercise any of these, write to hello@usesplot.com. As a rule we respond within one month.

10. Providing data is voluntary

Giving us your data is voluntary, but the fields marked as required are necessary for us to reply or prepare a quote. We do not collect special categories of data.

11. Cookies, analytics and advertising

Before you make a choice, only strictly necessary elements run. We do not load Google Analytics or the Meta Pixel, and send no advertising requests, until you give active consent. PostHog's library initialises with the page, but it writes no cookie and sends no events until you accept the analytical category.

Our cookie banner gives you equally easy options: accept all, reject optional, or customise. There are no pre-ticked boxes. Cookies fall into three categories: necessary, always active, and analytical and marketing, both optional and both chosen separately. We remember your choice for up to 6 months, and you can change or withdraw it at any time through the “Cookie settings” link in the footer, just as easily as you gave it.

Analytics uses Google Analytics 4 (measurement ID G-KL2BXEVQ69) and PostHog. We run Google Consent Mode with analytics storage denied by default, and Google Analytics is only loaded once you accept the analytical category. PostHog is initialised on load with capturing and cookies off; accepting analytics is what writes its first-party cookie and starts sending events.

Marketing uses the Meta Pixel (ID 1788394908988472). We advertise on Instagram and Facebook, and the pixel tells Meta that a visit to this site followed, so we can see which ads bring enquiries and reach people like the ones who already write to us. It is loaded only once you accept the marketing category, and withdrawing that consent revokes it. WhatsApp is a plain outbound link; it loads nothing until you choose to open it.

After you send an enquiry, the server reports that conversion to Meta's Conversions API, Google Analytics' Measurement Protocol and PostHog's capture API. That report does not load a script in your browser. It exists so we can measure which ads produced an enquiry even when a browser blocks the pixel. You can object by writing to the address in section 1.

12. Security and changes to this policy

We take reasonable measures to keep your data secure, though no method of transmission or storage can be guaranteed absolutely secure. We may update this policy; the date below shows when it last changed. This is an operational document and does not replace individual legal advice.