Privacy Policy
Last updated: May 5, 2026 - English courtesy translation. The Polish version is legally binding.
At a glance
This site sets no tracking cookies and embeds no advertising or fingerprinting scripts. The only browser storage we use is your light/dark theme preference, saved locally on your device when you toggle it. Our single third-party service on this page is Plausible Analytics for anonymous traffic statistics, which is cookieless by design. Bot protection runs locally in your browser using ALTCHA and is verified on our own EU servers - no third party is involved. Full details on every processor, retention period, and lawful basis are below.
1. Data controller
Your data controller is:
Tsunami Engineering Andrzej Krupiński
NIP: 8531463234
Data protection contact: privacy@tsunami-engineering.eu
No Data Protection Officer has been appointed.
2. What data we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Email address | Sending Project Aurora research updates and notifying you about the launch of the upcoming product from Tsunami Engineering | Art. 6(1)(a) GDPR (consent) and Art. 398 of the Polish Electronic Communications Act (PKE) |
| Research responses (region, plan interest, motivations, willingness-to-pay rating, the campaign link you arrived from, free-text reason for signing up) | Analyzing user needs and price sensitivity for product development. Stored separately from your identity so structured fields can be retained in de-identified form after you exercise the right to erasure; the free-text reason is permanently deleted at that point because it can incidentally contain personal data. | Art. 6(1)(a) GDPR (consent) |
| Email address | Sending a one-time double opt-in confirmation message | Art. 6(1)(f) GDPR (legitimate interest - verifying the identity of the person signing up) |
| IP address (at the moment of giving consent) | Keeping a record that consent was actually given, in case we ever need to demonstrate it | Art. 6(1)(f) GDPR (legitimate interest - proof of consent under Art. 7(1) GDPR) |
| Interview availability (optional checkbox) | Inviting you to a short voluntary research interview if you opt in | Art. 6(1)(a) GDPR (consent) |
Sharing additional research input (region, plan interest, motivations) is voluntary and independent of receiving the launch notification.
3. Data recipients
Your data may be shared with the following processors, with whom we have signed data processing agreements:
| Processor | Purpose | Headquarters | Data location |
|---|---|---|---|
| OVH SAS | Server and database hosting | France (EU) | EU (France) |
| Lettermint B.V. | Email delivery | Netherlands (EU) | EU (Netherlands) |
| Plausible Analytics OÜ | Anonymous website usage statistics | Estonia (EU) | EU |
Plausible Analytics does not use cookies, does not collect personally identifiable data, and processes data exclusively on EU servers. Our use of Plausible is based on Art. 6(1)(f) GDPR (legitimate interest - anonymous website traffic analysis).
Bot protection runs locally in your browser using ALTCHA (open-source, MIT-licensed). The widget computes a proof-of-work puzzle on your device; no data is sent to any third party. Verification happens on our own EU servers. Our use of ALTCHA is based on Art. 6(1)(f) GDPR (legitimate interest - preventing automated abuse of our forms).
We do not sell, share, or transfer your data to any parties other than those listed above.
4. International data transfers
Your personal data is processed exclusively within the European Economic Area (EEA). We do not transfer personal data to third countries.
All of our processors are headquartered in the European Union, and their infrastructure is located entirely within the EU.
5. Data retention periods
| Data | Retention period |
|---|---|
| Email address (research list) | Until you withdraw consent, exercise the right to erasure, or 12 months after the product launch - whichever comes first |
| Data of users who never complete double opt-in | Automatically deleted shortly after the 24-hour confirmation window expires - including the email address, the IP captured at signup, and any research responses entered during signup |
| Research responses (de-identified) | Retained for product research. When you exercise the right to erasure, the link between your identity and these responses is permanently severed and the free-text reason is deleted; the structured responses (region, plan interest, motivations, willingness-to-pay rating, the campaign link you arrived from) remain in our database in de-identified form. |
| Consent proof data (IP address at signup, consent text, form version, confirmation timestamp) | Retained as proof of consent for the duration of processing + 3 years (statute of limitations); deleted immediately if you exercise the right to erasure |
Data is permanently deleted after the retention period expires.
6. Your rights
Under the GDPR, you have the following rights:
- Right of access (Art. 15) - obtain information about and a copy of your data
- Right to rectification (Art. 16) - correct inaccurate data
- Right to erasure (Art. 17) - request deletion of your data (“right to be forgotten”)
- Right to restriction (Art. 18) - request that processing be restricted in certain situations
- Right to data portability (Art. 20) - receive your data in a machine-readable format
- Right to object (Art. 21) - object to processing based on legitimate interest
You can exercise two of these rights yourself at any time: /export-data for access and portability (Art. 15 + 20), and /delete-data for erasure (Art. 17). For any other request, contact us at: privacy@tsunami-engineering.eu. We will respond within 30 days.
7. Withdrawing consent
You have the right to withdraw your consent at any time. You can do this by:
- clicking the “unsubscribe” link in any email you receive from us, or
- sending a message to privacy@tsunami-engineering.eu.
Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
8. Is providing your data required?
Providing your email address is voluntary. If you choose not to provide it, you will not be added to the Project Aurora research list and will not receive a launch notification. Sharing additional research input is fully optional.
9. Automated decision-making
We do not make any decisions about you based solely on automated processing, including profiling.
10. Right to complain
You have the right to lodge a complaint with:
President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych)
ul. Stanisława Moniuszki 1A
00-014 Warsaw, Poland
https://uodo.gov.pl
11. Changes to this policy
We will inform you by email of any material changes to this policy. The current version is always available on this page.