Privacy Policy
This is an English translation. In the event of any discrepancies, the Polish version prevails.
Effective from 3 November 2026. This policy explains what data we collect, why, who we share it with and how long we keep it.
Data controller
The data controller is Janusz Ciosek, P.P.H.U. Janusz Ciosek WIELKA REKLAMA, ul. Popiełuszki 13, 98-300 Wieluń, NIP 8320002720. For data protection matters, write to kontakt@wielkareklama.eu or call +48 455 455 460.
What data we collect and why
| Data | Purpose | Legal basis (GDPR) | Retention period |
|---|---|---|---|
| Brief, e-mail address, logo, finished designs | Preparing and delivering the design | Contract, Art. 6(1)(b) | 12 months from completion |
| Brief, e-mail address and logo without a paid order | Saving the draft | Steps taken prior to entering into a contract, Art. 6(1)(b) | 14 days |
| Full name or company name, address, NIP (tax identification number), order details | Invoicing and accounting | Legal obligation, Art. 6(1)(c) | The period required by tax law |
| Correspondence and complaints | Customer service and defence against claims | Legitimate interest, Art. 6(1)(f) | 3 years |
| IP address hash | Usage limits and protection against abuse | Legitimate interest, Art. 6(1)(f) | Up to 2 days |
| Visit statistics without identifying data | Developing the website | Legitimate interest, Art. 6(1)(f) | Aggregated data, no time limit |
You enter your card details directly with Stripe; we do not receive them. Providing your data is voluntary, but without it we cannot fulfil your order or issue an invoice.
Who we share data with
| Recipient | What they receive | Purpose |
|---|---|---|
| Stripe Payments Europe, Ltd. (Ireland) | E-mail address, amount, payment details | Payment and refunds |
| Higgsfield Inc. (USA) | The content of the brief in the AI prompt: brand, text, description, target audience. No e-mail address or billing details | Generating the graphic |
| Anthropic Ireland, Limited (Ireland), with processing also taking place in the USA | The generated image and the text from the brief | Comparing the text on the design with the brief |
| Fakturownia and the National e-Invoicing System (KSeF) | Buyer and order details | Issuing the invoice |
| cyber_Folks S.A. (Poland) | Data stored on the website, backups, e-mail messages | Server and e-mail hosting |
The customer's logo is not sent to Higgsfield or Anthropic; we apply it to the finished image on our own server. Please do not include in the brief any personal data that is not needed for the design.
We instruct Higgsfield to delete the files and the prompt 24 hours after the job is completed, and we have disabled the use of outputs for model training on our account. Under its terms, Anthropic does not train models on API data and usually deletes such data within 30 days.
Transfers outside the European Economic Area
Higgsfield and Anthropic may process data in the USA. Such transfers are based on a European Commission adequacy decision, where the recipient is covered by one, or on standard contractual clauses. Where neither of these bases applies, the transfer is based on its necessity for the performance of the contract with you (Art. 49(1)(b) GDPR). We will provide information about the safeguards on request.
Automated processing
The design is created automatically and the text is checked by software. These operations do not produce legal effects concerning you and are not used to evaluate you personally. We do not profile customers for marketing purposes and we do not send advertising.
Your rights
You have the right to access your data and to have it rectified, erased, restricted or transferred (data portability). You may object to processing based on legitimate interest. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa.
Browser storage, cookies and statistics
Your browser stores the form draft and the access keys to your designs locally so that you can return to them. You can delete them in your browser settings. You will retain access to a paid design via the link in your e-mail.
We collect visit statistics on our own server using Umami, without cookies and without storing IP addresses. The admin panel uses a technical cookie only after a staff member logs in. We do not use advertising cookies. Stripe may use its own cookies on the payment page.
Security and backups
Connections are encrypted, and access to a design requires an individual key. We keep backups for up to 12 months, so deleted data may remain in them for that period. Backups are not used for any other purpose.
Changes
We will announce any changes to this policy on this page.