Privacy Policy

This policy explains how ercoding.pl processes data for contact, website comparisons and detailed reports. Version: 13 September 2026, report and individual contact form v3.

1. Controller and contact

The controller is Ercoding Eryk Kryszewski, ul. Strońska 14/2b, 50-540 Wrocław, Poland, NIP 9282095883, REGON 385386389. Contact: kontakt@ercoding.pl or the postal address above. We have not appointed a data protection officer.

2. Contact and cooperation

We process contact details, messages, brief answers and any attachments to respond and prepare or perform cooperation. The legal basis is GDPR Article 6(1)(b) for pre-contractual steps and contracts; otherwise Article 6(1)(f), our legitimate interest in correspondence, handling requests and legal claims. Accounting records are processed under Article 6(1)(c).

We retain correspondence for handling the matter and thereafter only as needed for legal obligations or applicable limitation periods. Tax records follow the statutory retention period. Sending us an enquiry does not subscribe you to unsolicited email marketing.

3. Website comparison and report delivery

The tool processes the public homepage URL, measurement time, measured results and selected public content. The URL comes from the person requesting a comparison, and evidence comes from the public website. Do not submit passwords, private pages, access tokens or customer data.

Google PageSpeed Insights receives the public URL. Our measurement browser may open the public page, check visible elements and a sample of links, and capture mobile and desktop screenshots. OpenAI API receives selected evidence, public text and available screenshots. The report requester’s email, IP and browser identifier are not sent to OpenAI. Screenshots are held temporarily for up to 30 minutes and cleared after the AI step; they are not stored permanently with the report.

Requested analysis and report delivery rely on GDPR Article 6(1)(b). To the extent public page evidence contains other people’s personal data, we rely on Article 6(1)(f), our legitimate interest in a limited, requested assessment of a public website. We do not use that evidence to build contact lists of its staff or customers.

To receive the detailed report, provide your own email and tick the required checkbox requesting the report, accepting the terms and allowing individual email contact about the analysis and an offer to improve the website. We record your email, report identifiers, language, exact declaration and its version, submission time, mail submission status and first use of the access link. The emailed link opens the report directly, without another confirmation screen, and can be reused for 72 hours. Neither submission nor opening the link verifies ownership of the email address. Without an email and the checkbox, detailed access is not provided.

The public summary is available without an email. Detailed access uses a private emailed link and a necessary signed browser cookie. Public report URLs alone do not unlock details; administrators can review reports in the restricted admin area.

Scores assess selected website features, not its owner. AI observations can be wrong. We do not use this tool for decisions producing legal or similarly significant effects on individuals under GDPR Article 22, or to automatically set the price of our services.

4. Individual email contact, withdrawal and deletion

The checkbox includes permission for Ercoding Eryk Kryszewski to use your email for individual contact about the analysis and an offer to improve the website. No spam or newsletter. A personalised offer is still direct marketing; calling it individual contact does not change that classification. We use the submitted declaration for this purpose and record its exact wording. We do not treat an analysis without this declaration, or acceptance of an earlier report-only form, as permission for sales contact. Withdrawing permission does not remove existing report access.

The restricted admin history links websites, scores, dates, request IP addresses within their retention period and report recipients. Search and score sorting support report handling, quality reviews and selecting relevant individual improvement offers for addresses with a current recorded contact declaration. Delivery and report handling rely on GDPR Article 6(1)(b), operational records on Article 6(1)(f); the intended basis for promotional contact is consent under Article 6(1)(a) and Article 398 of Polish Electronic Communications Law. An email recipient need not be the scan requester or website owner.

You can withdraw permission for further contact or request deletion at any time by emailing kontakt@ercoding.pl, including by replying to the report email. Indicate the relevant email and report URL. You can also object to legitimate-interest processing. We may verify identity proportionately and respond without undue delay, normally within one month, subject to GDPR exceptions. Withdrawal stops future promotional contact without removing report access and does not affect any earlier processing that was lawful. We explain any limited retention needed for legal obligations or justified claims. Withdrawal also remains effective if an unverified new form is submitted for the same email.

5. Abuse prevention and retention

The public allowance is 3 distinct homepages per rolling 24 hours, checked using an IP HMAC and a signed browser identifier. Authorised team test networks can receive a higher allowance, shown by the tool. We also retain the validated request IP for up to 30 days to investigate reported failures and abuse, under GDPR Article 6(1)(f). IP identifies a network, not reliably a person. IP and email are not disclosed in public reports or sent to OpenAI.

Public report access lasts up to 30 days after analysis. The restricted admin history retains report data, scores and dates for up to 365 days (12 months) to handle questions and quality reviews. Quota IP/browser HMAC identifiers are cleared after 48 hours, request-form abuse fingerprints after 7 days and raw request IP addresses after 30 days. Temporary screenshots are removed after AI processing and otherwise expire within 30 minutes.

Current report requests, email addresses and contact declarations are kept for up to 365 days from submission, unless an earlier justified deletion request applies. They do not require a separate email confirmation. Unconfirmed requests from the older form are deleted after 7 days; older confirmed marketing permissions expire after at most 24 months. Following withdrawal, we retain the email and declaration/withdrawal record for up to 3 years to honour the withdrawal and document it; report associations and access tokens are cleared after 365 days from submission. Backups follow security rotation and are not active contact lists.

6. Cookies and browser storage

CookieYes provides accept, reject and category choices. Necessary technologies provide requested functions and security. We load Google Analytics only after an active analytics consent; Google advertising features also require the advertising category. Rejecting optional cookies does not block comparisons or reports. Use the CookieYes revisit button to change your choice, or clear site data in your browser. Continued browsing is not consent, and cookie choices are independent of email marketing.

cookieyes-consent: preferences and consent identifier, up to 1 year. pll_language: selected language, up to 1 year. ercoding_analysis_device: signed quota identifier, 24 hours. ercoding_report_access: confirmed report access, up to 30 days. WordPress login cookies concern account users.

_ga and _ga_*: Google Analytics after consent, configured for up to 60 days since last use. Google may use additional advertising identifiers with advertising consent; the CookieYes preference centre lists provider cookies. The current configuration does not run the Meta Pixel.

Brief forms use localStorage keys beginning ercodingBrief: to save unfinished answers for up to 30 days. sessionStorage may hold current analysis state and a short-lived form completion signal within a browser tab. These are not marketing consents. Clearing browser data can remove draft answers and require report access to be verified again.

Cookie rules follow Article 399 of the Polish Electronic Communications Law, including the exception for technology necessary to provide a requested service. Where optional statistics or advertising identifiers are personal data, processing relies on GDPR Article 6(1)(a).

7. Recipients and international transfers

Hosting, backups, email, technical support and cooperation providers may process necessary data, as may authorised public bodies. Report emails use our configured SMTP service, not an AI model. Named tool providers include Google (PageSpeed Insights), OpenAI Ireland Ltd. and its subprocessors (AI evidence review), and CookieYes Limited (cookie preferences and records). Google analytics and advertising processing occurs only with the corresponding consent. We do not sell email lists or collect contacts from compared websites for sales messages.

Providers may process data outside the EEA, including in the USA. Depending on the specific recipient and service, transfers rely on an applicable European Commission adequacy decision or standard contractual clauses and required safeguards. Use of these services does not mean all processing takes place in the EU.

OpenAI processing is governed by its Data Processing Addendum, including transfer safeguards. We request store: false. This does not remove every provider log: API content is not used for training by default, but abuse-monitoring logs can be retained for up to 30 days, subject to legal and security exceptions. See also Google and CookieYes. Ask kontakt@ercoding.pl for applicable recipient and safeguard information or a copy of safeguards.

8. Your rights and choices

Subject to the GDPR, you can request access and a copy, correction, erasure, restriction and portability. You can object to legitimate-interest processing and to direct marketing at any time, and withdraw consent without affecting earlier lawful processing. You may complain to the President of the Polish Personal Data Protection Office.

You can use the analysis and view the public summary without an email. Detailed access is conditional on providing an email and selecting the combined report and individual-contact checkbox. The box is initially unchecked. You may withdraw permission for future contact later without losing existing report access. A policy change does not create or expand a contact permission.

9. Updates

The current policy is available at Privacy Policy. We announce material changes on the website and directly when required. Updating this policy does not automatically extend an earlier consent to new purposes.