# Privacy ## Controller The controller of personal data processed in connection with ai-waw.com is **AC STEEL Sp. z o.o.**, registered office in Warsaw, ul. Syta 114Z lok. 1, 02-987 Warszawa, Poland, entered in the register of entrepreneurs of the National Court Register (KRS) under number 0000268003, tax ID (NIP) 9512199831 – the publisher of the site. For data protection matters, write to **office@ai-waw.com** or by post to the registered office. The controller has not appointed a data protection officer. ## Principle Public pages of ai-waw.com use no cookies and no tracking tools, and load no scripts or content from third-party servers. Page views are counted in aggregate, without identifying anyone (see "Page-view measurement"). The site makes no decisions based solely on automated processing and does not profile visitors. ## What data, for what purpose and on what legal basis - **Server logs** – IP address, time and requested URL, browser or client name (User-Agent). Purpose: security and proper operation of the site. Legal basis: the controller's legitimate interest (Art. 6(1)(f) GDPR). The logs are kept by the hosting provider and deleted within the periods set by its policy. - **Machine-access log** – for the API, MCP and .md/.json versions: channel, resource, response code, time and client name (User-Agent), **without IP address**. Purpose: statistics of use by agents and protection against abuse (Art. 6(1)(f) GDPR). Retention: up to 13 months. - **Page-view measurement** – after a page is displayed, the browser sends to the ai-waw.com server (no intermediaries) the page address without parameters, its language, the name of the site the visitor came from (domain only, e.g. google.com; no page address) and the device type (phone or computer). The server stores only the daily total of views in these categories – **no IP address, browser name (User-Agent), cookies or identifiers of any kind**; no single visit can be reconstructed and no person recognised. Abuse protection limits the number of reports from one address – a counter in the server cache expires after one minute and is not part of the statistics. Purpose: knowing which content is read and where readers come from (Art. 6(1)(f) GDPR). Retention: up to 13 months. No measurement takes place when the browser sends a Global Privacy Control or Do Not Track signal, nor for pages preloaded but never shown. - **Correspondence and topic requests** – e-mail address, signature and message content. Purpose: replying and handling the matter (Art. 6(1)(f) GDPR). Retention: until the matter is closed, then up to 3 years in case of claims. - **API keys** (for users who were issued one) – name, plan and usage statistics of the key. Purpose: performance of the access agreement (Art. 6(1)(b) GDPR). Retention: while the key is in use and 3 years after it is revoked. - **Editorial panel accounts** – editors' data and the panel event log. Purpose: security and accountability of changes to publications (Art. 6(1)(f) GDPR). Retention: while the role is held and 3 years after it ends. - **Newsletter** (once launched) – e-mail address and language, only after confirmed opt-in; one-click unsubscribe. Legal basis: consent (Art. 6(1)(a) GDPR), which can be withdrawn at any time without affecting the lawfulness of processing before withdrawal. The controller's legitimate interests are the security of the site, replying to messages and establishing, exercising or defending legal claims. Providing an e-mail address in correspondence is voluntary, but without it no reply is possible. ## Recipients Data are processed on the controller's behalf by the provider of hosting, e-mail and site infrastructure – Hostinger – as a processor under a data processing agreement. Data may be disclosed to public authorities where required by law. The controller does not sell data or pass it on for marketing. ## Browser storage The choice of the light or dark theme is stored in the browser (localStorage, key "aiwaw-motyw") only after the reader clicks it. It stays on the device and is not sent to the server. The editorial panel uses a strictly necessary session cookie only after login and stores an "aiwaw-redakcja" marker in the editor's browser that excludes their views from measurement. For readers the measurement script stores nothing on the device. ## Your rights Every data subject has the right of access, rectification, erasure, restriction of processing and data portability (where processing is based on a contract or consent), and the right to object to processing based on legitimate interest (Art. 21 GDPR). You may also lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warszawa, Poland). ## Changes Changes to this notice are published on this page. As of 13 October 2026.