Privacy policy

Last updated: . This is an English translation of the Polish privacy policy; if the two versions differ, the Polish version applies.

1. Data controller

The controller of your personal data is Konrad Bajsarowicz, running a sole proprietorship under the business name Konrad Bajsarowicz Consulting, registered in the Polish Central Register and Information on Economic Activity (CEIDG) (the “Controller”):

  • address: ul. Stanisława Staszica 10 lok. 51, 05-800 Pruszków, Poland
  • Tax ID (NIP): 8581816953 (EU VAT: PL8581816953)
  • REGON (business registry number): 147074059
  • email: konrad@bajsarowicz.pl

2. Contact details

For any matter related to personal data protection, you can contact the Controller directly:

3. What data I collect and why

3.1 Contact form

When you fill out the form on the contact page, I process your full name, email address and the content of your message.

Purpose: replying to your inquiry and, if we start working together, performing the contract or taking steps before entering into it.
Legal basis: Article 6(1)(b) GDPR (steps taken at your request before entering into a contract) and Article 6(1)(f) GDPR (the Controller’s legitimate interest in handling correspondence).
Retention period: until the correspondence ends; if we sign a contract, for the duration of the contract and until the limitation period for claims expires (6 years at most).

3.2 Newsletter

When you sign up for the newsletter, I process only your email address.

Purpose: sending a newsletter about SEO and AI.
Legal basis: Article 6(1)(a) GDPR (consent). Consent is voluntary and you can withdraw it at any time by writing to konrad@bajsarowicz.pl. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
Retention period: until you withdraw consent or unsubscribe.

3.3 Comments under blog posts

If you comment on a blog post, I process your name (or nickname), email address, IP address and the content of the comment. A comment appears on the website after I approve it. Only the name (or nickname) and the content are public; only I can see the email address and IP address. The comment form is protected against spam by an anti-spam plugin running on the website’s server.

Purpose: publishing the comment and moderating content.
Legal basis: Article 6(1)(f) GDPR (legitimate interest in enabling discussion under published content).
Retention period: for as long as the comment is visible on the website; you can ask for its removal at any time.

3.4 Technical data (server logs)

The server that runs the website automatically records standard access logs: IP address, date and time of the request, requested resource, HTTP response code and browser information (User-Agent).

Purpose: keeping the website secure and stable.
Legal basis: Article 6(1)(f) GDPR (legitimate interest in IT security).
Retention period: up to 30 days, unless security requirements or the law require longer storage.

3.5 SEO tools

The character counter, UTM generator, regex generator for Search Console, Polish diacritics remover, the robots.txt generator in the robots.txt tester and the log analyzer run entirely in your browser (the tools are available in Polish). The text, URLs, parameters and log files you enter do not reach the server. The log analyzer downloads only the public lists of crawler IP addresses from the server and keeps them in the browser for one day. The browser stores the text from the character counter and from the diacritics remover, as well as the UTM link history, in its local storage, and deletes them with the “Wyczyść” (Clear) and “Wyczyść historię” (Clear history) buttons.

The page SEO analysis, AI readiness audit, sitemap checker, broken link finder, robots.txt tester, “What AI sees” preview, Open Graph and structured data preview, llms.txt generator and validator and redirect checker send the address of the page you want to check to the server. The server fetches that address and sends the result back to your browser. The sitemap checker and the broken link finder also fetch, in the same way, the addresses found in the sitemap or on the page. I do not store the addresses or the results. The content of an llms.txt file pasted into the validator stays in your browser. The Open Graph preview loads the og:image directly from the server of the checked page, like any website that displays it. To prevent one person from blocking the tools for others, the server stores a count of your requests for 10 minutes, linked to a hash (MD5) of your IP address. An address passed in a link to a tool (the ?url= parameter) ends up in the server logs (section 3.4) and in Google Analytics (section 5), like the address of any page you visit. Google Analytics also receives information about which tool was used.

Purpose: running the tools and protecting the server from abuse.
Legal basis: Article 6(1)(f) GDPR (the Controller’s legitimate interest in providing the tools and keeping the website secure).
Retention period: the request counter for 10 minutes after the last request; the text in the character counter and in the diacritics remover, and the UTM link history, until you clear them in your browser.

Under each tool and on the Tools page there is a form for comments and ideas. It sends to the server the type of submission, the message, the tool name and your email address, if you provide it. The message goes to my mailbox and to the website’s database, without your IP address. I will use your email address only to reply. To limit spam, the server stores a count of messages sent for one hour, linked to a hash of your IP address.

Purpose: replying to your submission and improving the tools.
Legal basis: Article 6(1)(f) GDPR (the Controller’s legitimate interest in replying to the sender and improving the tools).
Retention period: messages for up to 2 years after sending, the message counter for one hour.

The AI brand visibility test sends the brand name, domain, category and city you enter to OpenRouter, Inc. (USA), which passes the questions to model providers: OpenAI, Anthropic, Google and Perplexity. These companies process them on their servers, including outside the European Economic Area, under their own terms. I keep the test result on the bajsarowicz.pl server for 7 days, so that the same test does not have to be paid for twice. To limit costs, the server stores a count of tests for one day, linked to a hash of your IP address. Do not enter other people’s personal data into the test.

4. Recipients of data

Your data may be shared only with providers of services needed to run the website:

  • Hosting / server provider: storage of the website files and database
  • Email service provider: sending replies to inquiries and the newsletter
  • OpenRouter, Inc. and OpenAI, Anthropic, Google and Perplexity: model answers in the AI brand visibility test (section 3.5), only for the data entered into that test
  • Google LLC: the Google Analytics service (website traffic analytics); data is transferred to the USA on the basis of standard contractual clauses approved by the European Commission

5. Cookies and Google Analytics

The website uses cookies for two purposes:

  • Technical cookies (WordPress session): needed for the website to work properly; they are not used for tracking or profiling.
  • Google Analytics 4: an analytics tool by Google LLC that collects anonymous data about website traffic (number of visits, traffic sources, pages viewed, session duration). It uses its own cookies (_ga, _ga_*). Google processes the data in the USA. IP anonymization is enabled, so the full IP address is not sent to Google.
    Legal basis: Article 6(1)(f) GDPR (legitimate interest in analyzing traffic to improve the website).

You can block Google Analytics cookies by installing the official browser add-on: tools.google.com/dlpage/gaoptout. You can also disable all cookies in your browser settings, but this may limit how the website works.

6. Your rights

Under the GDPR, you have the following rights:

  • Right of access (Article 15): you can get confirmation of whether I process your data and receive a copy of it.
  • Right to rectification (Article 16): you can request the correction of inaccurate data or the completion of incomplete data.
  • Right to erasure (Article 17): you can request the deletion of your data in the cases provided for in the GDPR.
  • Right to restriction of processing (Article 18): you can request that the processing of your data be restricted in certain situations.
  • Right to data portability (Article 20): you can receive your data in a structured format and transfer it to another controller.
  • Right to object (Article 21): you can object to processing based on legitimate interest.
  • Right to withdraw consent: at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise these rights, write to konrad@bajsarowicz.pl. I will reply without undue delay and no later than within one month.

7. Right to lodge a complaint

If you believe that the processing of your data violates the GDPR, you have the right to lodge a complaint with a supervisory authority. In Poland, this is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl. You can also contact the data protection authority in the EU country where you live or work.

8. Changes to this privacy policy

I reserve the right to change this privacy policy. The current version is always available at https://bajsarowicz.pl/en/privacy-policy/. I will inform newsletter subscribers about significant changes.