Privacy Policy

This Privacy Policy explains how personal data is handled when you visit https://get-automated.ai, use the optional workflow assessment, send an enquiry or access the private owner area. It covers the website and the initial enquiry process. Any later client engagement may need a separate privacy notice and data-processing agreement.

1. Who is responsible for your data

The controller is Stepan Vasylevskyi - InfoTech Consulting, operating as Get Automated, with a postal address at [POSTAL_ADDRESS], Poland. Registration details, where applicable: [REGISTRATION_DETAILS].

For privacy questions or requests, contact [PRIVACY_CONTACT_EMAIL] or write to the postal address above. These placeholders must be completed before this draft is used as the final notice.

2. Data you choose to provide

When you send an enquiry, we receive your name, email address, optional company name, workflow category, team size and message. If you attach an assessment, we also receive the task description you supplied, current tools, task frequency, main difficulty, desired outcome, timing and the recommendation shown to you.

We record the submission time and the version of the short enquiry data-use explanation you acknowledged. The owner may add private notes, a status, a next action and a follow-up date to manage the conversation. We keep an activity history of status changes, scheduled, changed, cleared or completed actions, note-update times, and email attempts and outcomes. Previous private-note text is not copied into that history. Confirmation-email wording is saved with the enquiry so retries use the same receipt. Please share only information needed to understand your enquiry. Do not include passwords, access credentials, special-category personal data or confidential information about clients or other people.

Name and email are needed to receive and reply to an enquiry. A direct enquiry needs a short message; a complete attached assessment can supply that context instead. Company details and the optional free-text assessment fields are not required. If you do not supply the required fields, the form cannot be submitted. You can still browse the website and view an assessment result without identifying yourself.

3. The browser-based assessment

The assessment uses predefined rules to suggest a possible starting point. Answers remain in the current page's memory until you choose to attach them and send an enquiry. They are not put into the address bar, browser local storage or browser session storage. Reloading or leaving the page clears the unsent assessment.

Selecting a recommendation or attaching it to the form does not send the answers to us. The enquiry form requests a short-lived security token separately, without the assessment answers. The guide does not send your answers to an external AI provider.

The result is general orientation for a conversation. It does not approve or reject you, set a price or make a decision with legal or similarly significant effects. A person reviews submitted enquiries.

4. Technical and security information

Our hosting systems receive information needed to deliver the website, such as the request time, requested address, IP address and browser/request information. Operational and security logs may record this information according to the hosting configuration. We use short-lived, cryptographically derived identifiers based on client addresses and email addresses to limit abusive submissions, rather than storing those values directly in the form's rate-limit keys.

The private owner account has authentication records, a password hash and session information. Plain-text passwords are not stored. The owner area is not open for public registration.

The public website does not currently use advertising trackers or analytics cookies. The assessment does not require a tracking cookie. Necessary authentication cookies are used for the private owner area; sessions are configured for up to 12 hours and may be renewed through continued use. Your browser may cache ordinary website assets. An external service you choose to visit may use its own cookies under its own notice.

5. Why we process data and the legal bases

Enquiry handling includes acknowledging receipt, reviewing your request and following up with you. Where you ask us to take steps towards a possible contract with you personally, necessary enquiry handling is based on Article 6(1)(b) GDPR. Where you represent a business or make a general enquiry, we rely on Article 6(1)(f): our legitimate interest in understanding requests, communicating with business contacts and managing potential work, balanced against your rights.

Website delivery, access control and abuse prevention rely on our legitimate interest in operating a secure, reliable service. Keeping necessary records for establishing, exercising or defending legal claims may also rely on legitimate interests. Where a specific legal obligation requires retention or disclosure, Article 6(1)(c) applies to that obligation.

The form's “I’ve read how my enquiry details will be used” checkbox records acknowledgement of the explanation. It is not marketing consent or a blanket permission for unrelated processing. Sending an enquiry does not subscribe you to a mailing list. If we later introduce processing that relies on consent, we will explain it separately and allow that consent to be withdrawn.

6. Who can receive the data

The agency owner accesses enquiries in the protected inbox. Hosting and infrastructure suppliers may process website data on our instructions to run, secure and back up the service. The current test site is hosted with Hetzner; the final supplier and data-location details are [HOSTING_ENTITY_AND_LOCATION].

Owner notifications contain a private inbox link, not your message, assessment or contact details. We also send a short automatic confirmation to the email address supplied with a new enquiry. It may greet you by the name you supplied and contains general next steps and an optional booking link, without copying your message or assessment. The mail service processes the recipient address and delivery metadata to handle that email. In the current test environment, both types of email are captured locally on the server. The provider used for live confirmations and direct correspondence must be identified before live use: [CORRESPONDENCE_PROVIDER_AND_LOCATION].

Professional advisers or public authorities may receive limited information where necessary for advice, a legal obligation or a legal claim. We do not sell enquiry data. Any future access by additional personnel or suppliers must be limited to the work they are authorised to perform.

7. International transfers and external services

The production supplier arrangements and any access from outside the European Economic Area must be confirmed before launch: [INTERNATIONAL_TRANSFER_DETAILS]. If a transfer outside the EEA is required, we will identify its destination and the relevant adequacy decision or other valid safeguards, and explain how you can obtain information about those safeguards.

If you follow an optional booking link or email us using your own email application, the external provider processes information under its own terms and privacy notice. The booking service is not embedded or loaded merely by visiting this website. You can use the website enquiry form without using a booking provider.

8. How long data is kept

We keep data only for a defined purpose and review whether it is still needed. The final operating retention schedule must be confirmed and implemented before this draft is marked ready:

• Unsuccessful or completed enquiries, follow-up notes, actions, activity history and email-attempt records: [ENQUIRY_RETENTION_PERIOD_OR_CRITERIA], measured from the last meaningful contact or closure of the enquiry.
• If an enquiry becomes client work, necessary records move into the retention arrangements for that engagement. Statutory records and information required for active legal claims are kept for the applicable legal period or while the claim requires them.
• Hosting and security logs: [LOG_RETENTION_PERIOD_OR_CRITERIA]. Form rate-limit entries expire after their short protection windows and are removed by scheduled maintenance; expired owner sessions are also cleaned up.
• Backups and recovery copies: [BACKUP_RETENTION_PERIOD_OR_CRITERIA]. A record deleted from the active inbox may remain in a protected backup until that backup expires. If a backup is restored, relevant deletion requests must be reapplied.

The current test build supports manual enquiry deletion but does not automatically delete old enquiries or rotate database backups. Setting a period in this notice does not by itself configure deletion. The owner must align the operational process with the final retention schedule.

9. Your rights and how to use them

Depending on the processing and the applicable legal conditions, you can request access to your data, correction, erasure, restriction and portability. You may object to processing based on legitimate interests, explaining your particular situation. If processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing.

Send your request to [PRIVACY_CONTACT_EMAIL]. We may ask for proportionate information to confirm your identity before disclosing or changing personal data. We normally respond within one month. Where the law permits an extension because of complexity or the number of requests, we will explain the reason and revised timing within that month. Some rights are limited where retaining or using data is necessary for a legal obligation or claim.

You may complain to the President of the Personal Data Protection Office in Poland (Prezes Urzędu Ochrony Danych Osobowych, UODO), or another competent supervisory authority. UODO provides current procedures at https://uodo.gov.pl. You do not have to obtain our permission to complain.

10. Security, intended audience and changes

We use measures appropriate to the website, including HTTPS, restricted owner access, password hashing, form validation and abuse controls. No online system can guarantee absolute security. If you believe information was submitted in error or there is a security problem, contact [CONTACT_EMAIL].

The website is intended for business-related enquiries and is not directed at children. Please avoid sending personal data about children. If you believe such data was supplied unnecessarily, contact us so we can assess and remove it where appropriate.

The date and revision shown on this page identify the current notice. We will update it when the service or processing arrangements change and provide additional information when required. A change to this notice does not authorise an unrelated new purpose or remove rights concerning data already collected.