As of 18 October 2026
Security and data protection
The chat talks to the visitors of your website, so it processes their data. Here we explain where that data is, who processes it, how long we keep it and how we protect it. The same is written in the data processing agreement you conclude in the client panel.
The path of one message
What happens along the way.
Pick a stage: what we record here, who sees it, how we protect it.
Stage 1 · Chat window on your site
No cookies, with a visible “AI” label
The chat window loads only after the “Chat” button is clicked — before that it sends nothing.
- The chat window does not use cookies. The conversation number goes into the browser tab's memory only after the window is opened and disappears when the tab is closed.
- Connections are encrypted (HTTPS, HSTS); the conversation is available only with a one-time key held in the visitor's browser.
- Throughout the conversation, the window header says that AI is answering: the “AI” mark, a name containing “AI assistant” and the caption “AI answers · may make mistakes” (AI Act, Article 50). The assistant does not pretend to be a human.
- The assistant does not ask about health, and the chat window asks visitors not to give health data, passwords or card numbers.
Stage 2 · Server
Server in the European Union
The service and the conversation database run on a server in a data centre in the European Union.
- We store the content of the conversation, its time and language, and the rating of an answer if the visitor clicks one. With “Write to us” — also the name and email address given by the visitor.
- We do not store the IP address — only its hash created with a secret key (protection against abuse). The chat server logs contain neither IP addresses nor conversation content.
- Outbound firewall: the chat server connects only to public addresses. It reads your website like an ordinary visitor — without logging in and without submitting forms.
- We keep access keys outside the database, we log in to the server only with an SSH key, and every software change goes through a deployment with checks.
Stage 3 · AI model
AI model — you teach it
Answers are prepared by a language model through an API. Its provider does not train models on conversation data — you teach the assistant, with the rulebook.
- The model provider does not train models on data sent through the API and deletes it within 30 days (longer only in case of a breach of the terms of use or a legal obligation).
- You teach the assistant with the rulebook: words it must not use, and the improvements you approve in the panel. Nothing changes without your decision.
- Transfer of data outside the European Economic Area is based on standard contractual clauses (Commission Decision (EU) 2021/914) included in the data processing agreement with the model provider.
- We checked the model provider's terms on 17 October 2026.
Stage 4 · Before the visitor sees it
Answer safeguard
A sentence with a number, email address or domain that is not in your website's knowledge does not reach the visitor.
safeguard withdraws the sentence
Where do I send a complaint?
We accept complaints through the form on the “Returns” page. Or write to reklamacje@sklep-przyklad.pl.
The address is not on your website — this sentence will not reach the visitor.
- It answers only from the content of your website and the agreed rules. When it does not know, it says so and offers to send a message to you.
Stage 5 · Client panel
You decide
You are the controller of the data of your website's visitors. We — Iwaszka Jacek Iwaszkiewicz — process it on your behalf, under the data processing agreement.
- Client panel: login with a code sent by email (attempt limit, lockout), protection against forged requests; you see only your own websites.
- In the panel you see conversations with email addresses and phone numbers masked. Changes to knowledge and rules take effect only after your decision.
- Google Workspace — sending emails (messages, login codes) and storing encrypted backups, under Google's standard contractual clauses.
- We report a personal data breach to you without undue delay — at the latest within 36 hours of establishing it.
- We inform you by email at least 14 days in advance about the addition or change of a sub-processor.
How long
How long we keep the data.
- Conversations are deleted by a daily automatic job.
- Backups are encrypted (AES-256) before they leave the server and are checked by a trial decryption.
- After the contract ends — on your request, an export of conversations, then deletion of the data within 30 days.
Documents
Everything in writing.
- Article 28 GDPRData processing agreementYou conclude it in the panel together with the Terms of Service; the panel records the version of the document and the date. Security measures (§ 5), sub-processors (§ 4), deletion periods (§ 7).
- TermsTerms of ServiceLiability for AI answers (§ 8), personal data (§ 9), retention (§ 10).
- In the panelA paragraph about the chat for your privacy policyReady-made text to copy in the panel (Settings).
Questions about data?
Write to us — we will answer a security questionnaire or send you the data processing agreement to read before you order.