Last updated: 12 August 2026

This policy explains how Gigabit Studio handles personal data when you visit the website, create an account, watch videos, or join the newsletter. It also explains your rights under the General Data Protection Regulation (GDPR).

Who controls your data

Gigabit Studio is an independent publishing platform built and operated by Jacek Kowalski in Brussels, Belgium. Jacek Kowalski is the data controller for the processing described in this policy.

Data we collect

We collect only the data needed for the website and the services you choose.

When you visit, we may process:

  • Internet Protocol (IP) address and request details
  • Browser, device, and operating-system details
  • Page path, time, and basic error or security logs
  • Cookie and browser-storage choices
  • Video playback details when a page contains a video

When you create or use an account, we process:

  • Email address and email-verification status
  • Password hash, never your readable password
  • Session, security, recovery, and rate-limit records
  • Optional first name, last name, organisation, and country if you provide them
  • Two-factor secrets and recovery codes if you enable two-factor authentication
  • Passkey public keys, names, and credential details if you add a passkey

When you join the newsletter, we process:

  • Your account ID and current email address for delivery
  • Your subscription status and the version of the consent text you accepted
  • A record of subscribe and unsubscribe events
  • Bounce, complaint, suppression, and delivery status
  • A private unsubscribe token for links in emails
  • Campaign details and clicks on newsletter content while you are subscribed

When you contact us, we process the information you provide. Messages sent through the contact form reach us as email, together with your account email address and any optional profile fields, so we can reply.

What you need to provide

An email address and password are required to create an account. Without them, we cannot provide account-only content or controls.

Profile fields, optional analytics, and the newsletter are voluntary. Refusing them does not prevent you from using the account service.

Why we use data

We use account data to provide the service you request. The legal basis is performance of a contract or steps you ask us to take before a contract.

When you use our contact form, we use your message and the attached account details to identify you, understand the enquiry’s context, and reply.

Where an enquiry concerns possible consulting work, the legal basis is steps taken at your request before a contract. Otherwise, the legal basis is our legitimate interest in responding to enquiries and managing the related correspondence.

When you turn LinkedIn posts on, your browser stores your choice together with the time it was given, and posts load only while that record is present; turning LinkedIn posts off removes it. The record stays in your browser — we keep no copy on our servers. The legal basis for loading LinkedIn posts and sending data to LinkedIn is your consent.

We use technical and security data to:

  • Deliver pages and media
  • Keep accounts and systems secure
  • Prevent abuse and apply rate limits
  • Diagnose faults and maintain the service
  • Establish, exercise, or defend legal claims

The legal basis is our legitimate interest in operating a secure and reliable service. We balance that interest against your rights and minimise the data we keep.

We may process or disclose data when required by law, including responding to authorities or courts.

Website analytics

We use PostHog only after you consent to optional analytics. The legal basis is your consent.

Analytics may include page paths, page views, selected clicks, video events, campaign attribution, country-level location, referring domain, and technical device details. PostHog receives your IP address to derive your country and then discards it; your IP address, city, coordinates, and postcode are not stored with the analytics events. We do not use session recording or automatic click capture.

We do not send your account ID, email address, profile fields, raw referrer, raw user-agent value, advertising click IDs, query strings, or URL fragments to PostHog. Analytics remains separate from your account.

PostHog uses its European Union service in Frankfurt.

Newsletter and email analytics

We send the newsletter only after you turn it on in your account. The legal basis for delivery and newsletter click measurement is your consent.

Each newsletter contains an unsubscribe link. You can also turn the newsletter off in Account settings.

Resend handles email delivery and may process your email address, message content, delivery events, and raw click diagnostics. Open tracking is disabled.

When click measurement is active, Resend may receive an IP address, user agent, device details, and the clicked link. Gigabit Studio does not copy those raw technical fields into the Convex database.

Convex keeps only accepted content-link engagement linked to your account. It stores the campaign, link label, cleaned destination, first and last click times, and click count.

We stop accepting newsletter clicks after you unsubscribe, become delivery-ineligible, delete your account, or reach the engagement-retention limit. Non-identifying campaign totals may remain after the detailed records are removed.

Service statistics

We use limited account and newsletter data to create statistics about account activity, profile completion, country, email-domain category, newsletter status, and delivery health.

The results do not include account IDs, email addresses, or profile values. Country and email-domain results are stored as aggregate values.

We use these statistics to operate and improve the service based on our legitimate interests.

We may publish general aggregate service statistics on our website or social media accounts, or share them with partners. These statistics do not identify individuals or include account-level data.

Video

For video services, we use Mux. It processes IP address, approximate location, device and browser details, a random viewer identifier, and video playback information.

We do not send account IDs, email addresses, or profile data to Mux. Mux cookies are disabled, and pseudonymised viewership data is kept for up to 100 days.

The legal basis for video delivery is the service you request. Our legitimate interest in reliable video delivery is the basis for quality measurement.

Where data comes from

Most data comes directly from you or your browser. We also receive delivery events from Resend, video delivery and quality events from Mux, and security or service events from our hosting and database providers. We do not buy personal data or obtain it from data brokers.

Who receives data

We use the following providers only where needed to operate the service:

  • Vercel: website hosting, delivery, and operational logs
  • Sanity: editorial content management and content delivery
  • Convex: account, authentication, newsletter, and application data
  • Resend: transactional, marketing, and contact-form email delivery
  • home.pl: hosts our contact@gigabit.studio mailbox and stores the resulting correspondence
  • Microsoft: Outlook and the Microsoft cloud are used to access, synchronise, and reply to mailbox correspondence
  • PostHog EU: consented website analytics
  • Mux: video hosting, delivery, and playback-quality data

These providers may use approved subprocessors.

If you turn on LinkedIn posts, embedded LinkedIn posts load directly from LinkedIn when you view an article that contains one. LinkedIn then receives your IP address, device and network details, and the address of the page, and sets its own cookies. For visitors in the European Economic Area, LinkedIn Ireland Unlimited Company acts as an independent controller for this processing, and data may subsequently be shared within its corporate group, including its parent company Microsoft. LinkedIn posts are off by default, and our Cookie Policy describes the cookies involved and how to withdraw the choice.

We do not sell personal data. Apart from LinkedIn's own processing described above, which happens only if you turn LinkedIn posts on, we do not share personal data for behavioural advertising.

International transfers

The website is operated from Belgium.

Resend processes email addresses and message content in the United States. Mux may process video delivery and playback-quality data in the United States.

For transfers covered by Resend’s and Mux’s active certifications, we rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework. Their Data Processing Addendums also include the European Commission’s Standard Contractual Clauses for transfers not covered by an adequacy decision. We check that their certifications remain active and reassess the transfer if coverage changes.

home.pl stores our mailbox correspondence in data centres in Poland, inside the European Economic Area. Microsoft may process that correspondence in the United States when we access, synchronise, or reply to it through Outlook and the Microsoft cloud. Microsoft is certified under the EU–US Data Privacy Framework, and we rely on the same adequacy decision for that processing.

If you turn on LinkedIn posts, LinkedIn Ireland Unlimited Company may transfer the resulting data to LinkedIn group companies in the United States. LinkedIn relies on the same adequacy decision for transfers covered by its active Data Privacy Framework certification, with the European Commission's Standard Contractual Clauses in its data transfer terms as a fallback. This processing happens under LinkedIn's own responsibility as an independent controller; see LinkedIn's Privacy Policy for its transfer details.

You can ask us for information about the safeguard that applies to your data, including how to obtain a copy.

How long we keep data

We use the following retention rules:

  • Account and profile: retained until you delete your account. We do not delete accounts automatically for inactivity
  • Authentication and security: active sessions expire after up to 60 days of inactivity. Expired authentication and rate-limit records are removed within about one hour
  • Email delivery: finalised records are removed after 7 days and abandoned records after 28 days
  • Contact messages: delivered to our mailbox and kept as ordinary correspondence for as long as needed to handle the enquiry and any follow-up. Deleting your account does not automatically remove messages you already sent
  • Newsletter: preferences, consent history, unsubscribe tokens, and send state are deleted with the account. Per-account engagement is deleted earlier on account deletion or otherwise after about 14 months
  • LinkedIn posts choice: stored in your browser for up to 365 days from your choice, unless you turn LinkedIn posts off or clear browser storage earlier
  • Optional analytics: the analytics choice and PostHog browser storage last up to 365 days from the last explicit choice, unless you withdraw or clear them earlier
  • Analytics events: PostHog retains the consented, anonymous analytics events for a provider-set period of up to seven years, which cannot be shortened on PostHog Cloud. These events contain no IP address, precise location, account ID, or email address
  • Aggregates: non-identifying daily and campaign records are kept without a fixed end date because they do not contain account IDs, email addresses, or per-person timestamps

Our infrastructure providers may keep security logs, backups, or legally required records for their own limited retention periods. We keep personal data longer only when law or a legal claim requires it.

Deleting your account removes the account, sessions, credentials, two-factor data, passkeys, and user-linked newsletter data. We may send a deletion confirmation after removal.

Resend may retain delivery records or a suppression entry under its own retention and compliance rules. Gigabit Studio cannot remove every provider suppression entry through the application.

How we protect data

We use access controls, encrypted connections, authentication checks, short-lived tokens, rate limits, and data minimisation. Two-factor secrets and recovery codes are encrypted at rest.

Session records do not store IP addresses or user-agent values. Security rate limiting still processes the request IP for a short period.

No internet service can guarantee absolute security. Contact us promptly if you believe your account or data is at risk.

Your GDPR rights

Depending on the circumstances, you can:

  • Ask for access to your personal data
  • Ask us to correct inaccurate or incomplete data
  • Ask us to delete personal data
  • Ask us to restrict processing
  • Receive eligible data in a portable format
  • Object to processing based on legitimate interests
  • Withdraw consent at any time
  • Complain to a data protection authority

Withdrawing consent does not affect earlier lawful processing. Some rights have legal limits, and we may need to verify your identity before responding.

You can edit optional profile fields, change cookie choices, unsubscribe, or delete the account in Account settings. Contact us to object to processing based on our legitimate interests or make another rights request. We will stop the relevant processing unless we have compelling legal grounds to continue.

Children

The account service is not directed at children under 13. Contact us if you believe a child provided personal data without valid permission.

Changes to this policy

We may update this policy when our services, providers, or legal duties change. We will update the date at the top and give additional notice when the change materially affects you.

Contact

Email contact@gigabit.studio with privacy questions or rights requests.