Privacy Policy

weldmeld is the brand name of Curvix sp. z o.o., the data controller for everything described here: it decides what’s collected and why, and it’s who you take it up with if you’re not happy.

CURVIX SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ

Registered officeAleje Jerozolimskie 85, lok. 21, 02-001 Warszawa, PolandRegistry courtSąd Rejonowy dla m.st. Warszawy w Warszawie, XII Wydział Gospodarczy Krajowego Rejestru SądowegoKRS0001050281NIP5223266594REGON526045633

For anything about your data, write to hello@weldmeld.com. We’re not required to have a Data Protection Officer and we don’t have one, so that address reaches us directly.

This covers the personal data we handle through this website and our first contact with you: when you visit the site, send us a message, book a call, or when the analytics and advertising measurement on the site run with your permission. It’s written for the site as it actually works today, which is why it names specific fields and specific services rather than describing things in general.

If we wrote to you before you wrote to us, the data we used to do that came from somewhere else, and a separate page explains it: our Outreach Privacy Notice.

If we go on to work together, the data we handle as part of that project is also governed by our client agreement with you and any data processing terms in it. This page keeps applying wherever it’s relevant.

The contact form on the home page asks for:

• Your name and surname, and your email address, both required so we can reply.
• Your company name, if you give it.
• Whether you’ve run paid ads before.
• A budget range, if you pick one.
• Whatever you write in the message.

We use it to read your enquiry, reply to it, and work out whether we’re a good fit for each other. Where you’re approaching us about working together, we rely on taking steps at your request before entering into a contract (Article 6(1)(b) GDPR). Where you’re writing on behalf of a company, so the contract would be with them rather than with you personally, we rely on our legitimate interest in responding to people who contact our business (Article 6(1)(f)).

Giving us this data is voluntary, but without a name and an email we can’t answer you. Please only put in the message what you’re comfortable sending by email: it’s an enquiry form, not a secure channel for anything sensitive.

The calendar on our booking page is Cal.com, embedded in the page. When you book, Cal.com collects on our behalf:

• Your name and email address, and your company name.
• The email addresses of any guests you add.
• Your answers to the questions on the form: when you want to start, your budget range, your notes about the project, and how you found us.
• The time you picked, your time zone, and whether the call runs on Cal Video or Google Meet.

We use it to hold the call, to prepare for it, and to follow up afterwards, on the same legal bases described above for an enquiry. If you add a guest, please make sure you’re entitled to give us their address; we use guest details only to arrange and run the call. If you choose Google Meet, the meeting also runs through Google Workspace and Google Meet under our arrangement with Google, described below.

What Cal.com stores on your device while you’re on that page is listed in our Cookie Policy.

Hosting. The site runs on Vercel. Like any web host, their servers log requests, including your IP address, the page requested, and your browser’s user agent, so that the site can be delivered and kept secure. We rely on our legitimate interest in running a site that works and isn’t being attacked (Article 6(1)(f)).

Cookieless analytics. We use Vercel Web Analytics and Vercel Speed Insights to see how many people visit, which pages they read, and how fast the site is for them. Both are cookieless: they set nothing on your device and don’t follow you to other sites. Vercel identifies a visit through a hash of the incoming request, which it discards after 24 hours, and gives us aggregate numbers. We rely on our legitimate interest in understanding whether our own site works (Article 6(1)(f)).

Google Analytics. If you allow it, we use Google Analytics 4 to understand where visits come from, which pages get read, how people move through the site, and whether our marketing works. Google then processes information about your browser and device, the pages you view, what you interact with, your approximate location, and the ad you arrived from, if any. It runs only in line with the choice you make in our cookie card, and we rely on your consent (Article 6(1)(a)).

Advertising measurement. If you allow it, we use Google Ads conversion measurement to learn whether an ad we paid for led to something that matters to us: an enquiry sent, or a call booked. That’s measurement, not remarketing: we don’t build audiences from it and don’t follow you around other sites with ads. It runs only with your consent (Article 6(1)(a)).

How the choice is enforced. The Google tools run through Google Tag Manager, which loads on every page with everything switched off by default. Until you choose, no Google tag sets a cookie or reads an identifier from your device; Google receives only cookieless signals that don’t identify you. Your choice is passed to Google through Google Consent Mode, and you can change it at any time from the Cookie Settings link in the footer. The Cookie Policy names every item involved.

These are the tools we do our work in. Where a provider processes personal data on our behalf, it does so on our instructions and under the data processing terms that apply between us. Some of them also process limited data for their own purposes, such as security or meeting their legal duties, which their own privacy documentation describes.

Formspree, Inc.

Delivers the contact form. Your submission is stored in their system as well as sent to us.

RoleProcessorLocationUnited States (hosted on AWS in the US)

Cal.com, Inc.

Runs the booking calendar and stores the bookings made through it.

RoleProcessorLocationUnited States

Vercel Inc.

Hosts the site and provides the cookieless analytics described above.

RoleProcessorLocationUnited States

Google (Google Workspace and Google Meet)

Hosts our inbox, so every enquiry and booking notification lands there, and hosts a call when you pick Google Meet.

RoleProcessorLocationUnited States and the EU

Google (Google Tag Manager, Google Analytics 4 and Google Ads)

Loads and runs the measurement described above, only once you’ve allowed it. For Google Ads measurement, Google also uses the data for its own purposes as its advertising terms set out.

RoleProcessor for Tag Manager and Analytics; also an independent controller for Ads measurementLocationUnited States and the EU

Notion Labs, Inc. and Slack (Salesforce, Inc.)

The tools we work in. A conversation with you sometimes continues in one of them before you’re a client: notes from a call, or a thread we share with you.

RoleProcessorLocationUnited States

Cal.com also uses its own error-monitoring service inside the booking calendar, which receives technical data about faults in their software. That’s Cal.com’s sub-processor, under their agreement rather than ours.

Beyond these, we share personal data only where the law requires it, for example with our accountants, or with an authority that’s entitled to ask for it. We don’t sell it, rent it, or hand it to anyone for their own marketing.

Most of the services above are US companies, or may process data in the United States, so your data can leave the European Economic Area. Where it does, we rely on the safeguards the GDPR provides: an adequacy decision, including the EU-US Data Privacy Framework where a provider is certified under it, or the European Commission’s Standard Contractual Clauses. Each provider documents which one it uses:

• Vercel, who host the site and provide the cookieless analytics, is certified under the EU-US Data Privacy Framework.
• Cal.com states that it relies on Standard Contractual Clauses or an adequacy mechanism such as the EU-US Data Privacy Framework, and offers a data processing agreement.
• Formspree states that it relies on Standard Contractual Clauses as a data processor.
• Google, for Workspace, Meet, Tag Manager, Analytics and Ads, is certified under the EU-US Data Privacy Framework and offers Standard Contractual Clauses.
• Notion and Slack are both certified under the EU-US Data Privacy Framework and offer Standard Contractual Clauses.

We’re describing what each provider publishes, not making a promise of our own about their systems. If you’d like to know more about any of them before you send us anything, ask us and we’ll point you at their documentation.

Enquiries and bookings from people who don’t become clients: we keep them for up to 24 months from our last contact, then delete them. Long enough that if you come back next year we still know who you are, short enough to be a real limit.

If you become a client: your data is kept for as long as we’re working together and afterwards for the period our agreement with you and the law require. Invoices and accounting records are kept for five years from the end of the tax year they relate to, because Polish tax law requires it and that’s not something we can shorten.

Server logs and cookieless analytics: kept for the period Vercel applies to the product and plan we use. The analytics data is aggregated and isn’t linked to you.

Google Analytics: event-level data is kept for 14 months, the retention we’ve set on our Analytics property. Google Ads measurement data is kept by Google for the periods its advertising terms set out.

Depending on the situation and the legal basis we’re relying on, the GDPR lets you ask us to:

• tell you what data we hold about you, and give you a copy;
• correct it if it’s wrong or incomplete;
• delete it;
• restrict what we do with it while something is being sorted out;
• hand it to you, or to someone else, in a portable format, where we process it automatically on the basis of your consent or a contract;
• stop processing it where we rely on our legitimate interest. You can object at any time, and we’ll stop unless we have compelling grounds not to.

Where we rely on your consent, you can withdraw it at any time, including through the Cookie Settings link in the footer. Withdrawing it doesn’t undo what was lawfully done before.

Write to hello@weldmeld.com and we’ll answer without undue delay, normally within one month. Where the GDPR allows it, a complex or repeated request can take longer, and we’ll tell you if that happens. Exercising these rights is free.

If you think we’ve handled your data badly, we’d rather hear it from you first, but you always have the right to complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

• No automatic marketing sign-up. Sending us an enquiry or booking a call doesn’t add you to a newsletter or a mailing list. We reply to you, and we follow up about your enquiry. That’s all.
• No optional tracking without your choice. Google Analytics and Google Ads measurement only run in line with your choice. We don’t use a Meta pixel, LinkedIn tag or session recording.
• No remarketing. We don’t build advertising audiences from your visit and don’t follow you to other sites with ads.
• No profiling and no automated decisions. Nothing here decides anything about you automatically. A person reads every enquiry.
• No selling your data. Not to anyone, for any purpose.

We update this page when what we do with data materially changes, or when the law does, and the date it last changed is shown alongside it. Where a change materially affects people we already hold data about, we’ll give notice where that’s required or appropriate.