Personal data processing policy

Revision of 02.10.2026

1. Who processes the data

Operator: Automation Factory LLC (Sp. z o.o.) · tax id PL5253077478 · ul. Nowy Świat 33/13, 00-029 Warszawa, Poland

Contact for requests: contact@automationfactory.dev

This policy covers the data of our clients — the business owners who use the platform. Data of their own customers inside an installation is a different processing: there the operator is the business itself, we act on its instruction, and the policy is generated by that installation.

2. What we process and why

Data	Purpose
name, phone, e-mail, messenger of the business owner and their employees	sign up, grant access to the platform, support and notifications about the service
company details, contracts, invoices, payment history	billing and statutory accounting
logins and access log entries of our staff to a client installation	support, incident investigation and the access record required of a processor
installation telemetry: versions, error counts and samples with contacts stripped	see that a client installation is alive and fix breakage before the client notices
correspondence with us: e-mail, messengers, support requests	answer questions and keep the history of requests

We do not use the data for other purposes and we do not take automated decisions about you.

3. Legal basis

• Performance of the contract with you (GDPR Art. 6(1)(b)): access to the platform, support, billing.
• Your consent (Art. 6(1)(a)) where processing is not needed for the contract — a request left in a form on the site or a message sent to us in a messenger. Consent can be withdrawn at any time.
• Statutory obligations (Art. 6(1)(c)): accounting and tax records, and the access record a processor is required to keep.
• Our legitimate interest (Art. 6(1)(f)): installation telemetry (versions, error counts and samples with contacts stripped) so that breakage is fixed before the client notices it, and protection against abuse. You may object to this processing.

4. Whom we share it with

Recipient	Purpose
Hosting provider in the United States	hosting the site, its mailbox and the enquiries sent through it
Payment service	accepting subscription payments
AI providers (OpenAI, ElevenLabs)	only where a client has enabled AI features themselves
Messengers (Telegram, WhatsApp)	only where a client has connected them for customer conversations

The data is never sold and never shared for someone else’s advertising. Disclosure to state authorities happens only on lawful demand.

5. Where the data is stored and transferred

The operator named in section 1 is established in Poland, inside the European Union, and this is where the processing is controlled from.

This site, its mailbox and the enquiries sent through it are hosted in the United States (see the table above). That transfer relies on the European Commission's adequacy decision for the EU–US Data Privacy Framework where the provider is certified under it, and on standard contractual clauses with the provider otherwise.

Where you turn on an external service yourself — a messenger, a payment provider, an AI provider — the data goes to that service on the basis of standard contractual clauses or of your own instruction. Nothing is sent to such a service until it is switched on.

6. How long we keep it

While the contract is in force and for the statutory retention periods for accounting documents. After that the data is deleted or anonymised.

7. Your rights

• know what data we hold about you and get a copy of it (access);
• have inaccurate data corrected (rectification);
• have the data deleted (erasure), unless the law requires us to keep it;
• have the processing restricted while a dispute about the data is settled;
• object to processing based on our legitimate interest;
• receive the data in a machine-readable form or have it transferred to another provider (portability);
• withdraw your consent at any time — this does not affect what was lawfully processed before the withdrawal;
• lodge a complaint with the supervisory authority for data protection of your country of residence.

Write to the contact above. We answer within 30 days (one month under the GDPR) and we do not charge for an answer. We may ask you to confirm your identity — so that a request about your data is not answered to someone else.

8. How we protect it

Access by login and password with roles; traffic between your browser and the server is encrypted; access to a client installation by our staff is recorded in a journal on that installation; backups live next to the installation they belong to.

9. What is stored in your browser

The site itself does not use advertising cookies and does not share visits with ad networks. It stores two things, and both stay in your browser:

• the campaign tags of the link you arrived by (utm_*), for the length of the tab session — so that a request can be matched with the ad it came from;
• the mark that you have agreed to data processing before going to a messenger — so that the window is not shown again on the next click.

10. If you are in the European Union

The operator named in section 1 is established in the European Union, so the GDPR applies to this processing directly and all the rights in section 7 apply to you in full — including a complaint to the data protection authority of your country.

Outside the EEA the data goes only to our hosting and mail providers in the United States (section 5) and to the external services a client switches on themselves. We take no automated decisions about you and do not profile you.