Privacy Policy

The controller of any personal data processed through this website is the company that operates the Smallcraft Labs brand:

Company

Midaz Group sp. z o.o.

Registered office

ul. Polna 10, 59-160 Radwanice, Poland

KRS

0000989140

NIP (VAT ID)

5020124096

Email

hello@smallcraftlabs.com

We have not appointed a Data Protection Officer, as we are not required to under Article 37 of the GDPR. Data protection questions go to the address above.

This policy covers the website at smallcraftlabs.com and the email addresses published on it. It does not cover any product, because we do not sell any product yet. When our first product launches it will have its own privacy policy describing the data that product processes.

This site is deliberately built without the machinery that usually collects personal data. It does not:

• offer accounts, logins or any authentication
• contain contact forms, sign-up forms, chat widgets or comment sections
• run a newsletter or a mailing list
• process payments or store any billing information
• serve advertising or use advertising or cross-site tracking technologies
• load fonts, scripts, images or styles from third-party CDNs, because everything is served from our own domain
• use any cookie or browser storage for tracking, profiling or advertising.

The site writes exactly one thing to your browser, and only if you ask it to: when you use the light/dark switch in the header, your choice is saved under the key theme in your browser’s local storage so the site does not reset it on the next page. It contains nothing but the word light or dark, it is never sent anywhere, and clearing your browser data removes it. Storage that carries out a preference you explicitly set does not require consent.

We measure how the website is used with PostHog, hosted on PostHog’s EU Cloud. Analytics requests are routed through our own domain, on the path /ph/, so no request goes directly from your browser to a third-party analytics domain.

PostHog is configured on this site to run without identifying visitors:

• No cookies and no persistent browser storage. The analytics client keeps its state in memory for the duration of the visit only, so nothing is written to your device. This is why you do not see a cookie banner here.
• No person profiles. Events are never attached to a stored profile of an individual.
• No session recording, no heatmaps, no autocapture of clicks or form input.

What is recorded is limited to page-level measurement:

• the page address you opened and the address that referred you
• the date and time of the visit
• browser type and version, operating system, device type and screen size
• browser language
• your IP address, which is transmitted as part of the network connection and may be used by PostHog to derive an approximate, coarse-grained location. We do not store your IP address ourselves and it is not shown to us as part of the analytics data.

Legal basis: our legitimate interest in understanding whether the website works and how people find it (Article 6(1)(f) GDPR). Because no information is stored on or read from your device, this measurement does not require consent under Article 173 of the Polish Telecommunications Law or the ePrivacy Directive.

You can block this measurement entirely with any content blocker or by enabling your browser’s “Do Not Track” setting, which our analytics client respects. Nothing on the site depends on analytics working.

The website runs on Cloudflare Workers and is delivered through Cloudflare’s network. To deliver a page and to protect the site against abuse, Cloudflare necessarily processes connection data such as your IP address, the requested address, the user agent string and the time of the request. This is standard technical processing that any web server performs.

Legal basis: our legitimate interest in operating a secure and available website (Article 6(1)(f) GDPR). Cloudflare acts as our processor under a data processing agreement.

The only way to contact us is by email, at hello@smallcraftlabs.com or support@smallcraftlabs.com. If you write to us, we process the content of your message, your email address and anything else you choose to include, for the purpose of answering you.

Our mailboxes are hosted by Fastmail, which acts as our processor.

Legal basis: our legitimate interest in responding to enquiries (Article 6(1)(f) GDPR), or the steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR) where your message concerns a possible business relationship.

We do not sell personal data and we do not share it for anyone else’s marketing. Data is disclosed only to the service providers we need in order to run the site, each bound by a data processing agreement:

• PostHog for product analytics, in the EU Cloud region
• Cloudflare for hosting, content delivery and security
• Fastmail for email hosting.

We may also disclose data where we are legally obliged to do so, for example to a competent public authority acting within its powers.

Analytics data is stored in the European Union, in PostHog’s EU Cloud region.

Cloudflare and Fastmail may process data outside the European Economic Area, including in the United States. Those transfers are covered by the European Commission’s Standard Contractual Clauses and, where applicable, by the providers’ certification under the EU-US Data Privacy Framework.

• Analytics events are retained in PostHog for as long as they remain useful for traffic analysis, and no longer than 24 months.
• Email correspondence is kept for as long as needed to handle the matter it concerns, and afterwards for up to 3 years, which corresponds to the general limitation period for business claims under Polish law. Correspondence that has to be kept for accounting or tax reasons is retained for 5 years from the end of the relevant year.
• Cloudflare connection logs are retained according to Cloudflare’s own retention schedule, which is short-term and measured in days.

Under the GDPR you have the right to:

• access your personal data and receive a copy of it
• have inaccurate data corrected
• have your data erased
• restrict how we process your data
• object to processing that we base on our legitimate interest, including the analytics described above
• receive your data in a portable format, where that right applies.

To exercise any of these, write to hello@smallcraftlabs.com. We answer within one month. Please note that because our analytics does not identify visitors, we are usually unable to connect analytics records to a specific person, and Article 11 of the GDPR applies: we cannot be required to acquire additional information solely in order to identify you.

You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw.

Providing personal data is entirely voluntary. You can read every page of this site without giving us anything. If you choose not to email us, the only consequence is that we cannot reply to you.

We do not make automated decisions about you and we do not carry out profiling within the meaning of Article 22 of the GDPR.

This website addresses businesses and professional users. It is not directed at children and we do not knowingly process the personal data of children.

We update this policy when the way we run the site changes, for example when we add or remove a service provider. The date at the top of this page always shows when the current version took effect. Material changes will be reflected here before they take effect.