Write to me

§Document

Privacy Policy

Effective 21 October 2026

In short: this website uses no cookies, analytics or third-party scripts and does not log visitors’ IP addresses. I process personal data when you write to me, when you become a client and when you use the AI agent. Details below.

1. Controller

  1. The controller is Paweł Borkowski, trading as Neurabs, ul. Dywizjonu 303 149/17, 01-470 Warsaw, Poland, EU VAT ID PL1181788652, REGON 147161841. For anything concerning your personal data, write to hello@neurabs.com.
  2. I have not appointed a data protection officer, as I am not required to.

2. Visiting neurabs.com

  1. This website uses no cookies or similar technologies, analytics tools, advertising pixels or third-party scripts. Fonts and images are served from my server, so your browser does not connect to other companies.
  2. To send the page to your browser, the server has to use your IP address briefly. I do not record it in access logs. Legal basis: my legitimate interest in making the website available (Article 6(1)(f) GDPR).

3. E-mail contact

  1. When you write to me, I process your e-mail address, name, the content of your message and any other data you provide – to reply and prepare an offer.
  2. Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) or my legitimate interest in answering correspondence (Article 6(1)(f) GDPR).
  3. If we do not conclude a contract, I keep the correspondence for up to 12 months after the last message, and longer only where needed to establish, exercise or defend legal claims.

4. Clients and contracts

  1. I process the data needed to conclude and perform a contract: name, company name, address, tax/VAT ID, e-mail address, phone number (if you give it), invoicing and payment data, and correspondence.
  2. Purposes and legal bases:
    1. concluding and performing the contract (Article 6(1)(b) GDPR),
    2. accounting and tax obligations, including invoices (Article 6(1)(c) GDPR),
    3. establishing, exercising and defending legal claims and keeping the services secure – my legitimate interest (Article 6(1)(f) GDPR).
  3. Retention: for the duration of the contract, then until the limitation periods for claims expire (under Polish law generally 6 years, and 3 years for claims related to business activity and periodic payments, counted to the end of the calendar year). Accounting records are kept for 5 years from the end of the calendar year in which the tax payment deadline passed.

5. AI agent and monitoring of conversations

  1. If you use the AI agent, I process: the content of your messages and the agent’s replies, uploaded files, your Telegram account ID and name, timestamps and the changes made to the website.
  2. Purposes and legal bases:
    1. carrying out your instructions, i.e. providing the service (Article 6(1)(b) GDPR),
    2. monitoring conversations – personally and with automated filters – to keep the service secure and compliant with the terms, detect abuse and illegal content, fix errors, improve the agent and establish, exercise or defend legal claims – my legitimate interest (Article 6(1)(f) GDPR).
  3. Retention: 90 days from the message or, where it relates to a reported violation, dispute or proceedings, until it is resolved.
  4. I do not use these conversations to train AI models. Please do not send the agent health data or other special categories of data, passwords, card numbers or identity documents.
  5. Automated filters may stop an instruction; blocking an account or ending a contract is decided by a human. The AI agent does not take decisions about you that produce legal effects.

6. Domains

  1. In plans with a domain I register the domain in your name, so I pass your data to the registrar and the domain registry – to perform the contract (Article 6(1)(b) GDPR). Registries may publish some registrant data in WHOIS under their own rules; data of individuals is usually redacted.

7. My clients’ websites

  1. Data of visitors to the websites I host for clients, and data placed on those websites, are processed on my clients’ behalf under a data processing agreement (section 16 of the Terms). The controller is the owner of the website – see its privacy policy.

8. Recipients

  1. Data may be received – only as needed for the purpose in question – by:
    1. my server provider (OVHcloud – servers in the European Union),
    2. my code repository and deployment automation provider (GitLab),
    3. my e-mail provider,
    4. the AI-model provider – for the AI agent,
    5. Telegram – when you write to the AI agent; Telegram processes data as a separate controller under its own privacy policy,
    6. domain registrars and registries, my bank and the people handling my accounting,
    7. public authorities – where required by law.

9. Transfers outside the EEA

  1. Some providers (e.g. GitLab, the AI-model provider, Telegram) may process data outside the European Economic Area, including in the USA. This is based on a European Commission adequacy decision (e.g. the EU-US Data Privacy Framework) or standard contractual clauses adopted by the Commission. You can get a copy of the safeguards by writing to me.

10. Your rights

  1. You have the right to access, rectify and erase your data, to restrict its processing and to data portability, and – where I rely on legitimate interest – to object on grounds relating to your particular situation.
  2. You may lodge a complaint with a supervisory authority – in Poland the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) – or with the authority in the EU country where you live or work.
  3. Providing data is voluntary, but without it I cannot answer your message or conclude and perform a contract; invoicing data is required by tax law.

11. Security

  1. I use encrypted connections (HTTPS), limit server access to myself over an authenticated connection, install security updates and keep backups. I never ask for passwords to Telegram, e-mail or banking.

12. Changes

  1. If the way I process data changes, I will update this policy and, if you are a client, tell you by e-mail. This policy is effective from 21 October 2026.