This policy explains how Gigabit Studio uses your personal data and the rights and choices you have.

Who is responsible

Jacek Kowalski, operating as Gigabit Studio in Brussels, Belgium, is responsible for your personal data. Contact contact@gigabit.studio with privacy questions or requests.

Information we collect and how we use it

We receive information from you, your browser and our providers' delivery, security and service records.

Your account

An email address and password are required for an account. We use your email address, verification status, password hash and security records to create and protect it. Enabling two-factor authentication or passkeys also involves processing their credentials.

You can add or remove your optional first name, last name, organisation and country in Account.

Your account email and completed profile details are also included when you send us a contact-form message.

Website operation and security

Our service providers process IP addresses, request times, page paths, browser and device details, and error or security records to deliver the website, maintain reliability and prevent abuse.

Optional website analytics

With your consent, PostHog measures use of signed-in content pages. It records a browser identifier, pages viewed, reading time and scroll depth, selected clicks, shares and video interactions. Records can include content details, browser and device information, country, referring website (domain only) and campaign labels from links you follow.

The identifier links visits without linking browsing events to your account. These records are pseudonymous personal data. PostHog derives country from your IP address and discards the address from stored events under our privacy settings. We use its EU service in Frankfurt.

With the same consent, Vercel Speed Insights records page addresses, performance measurements, related page elements, connection speed, browser, device, operating system and country. It uses no cookies or browser storage.

Newsletter

When you subscribe, we send the newsletter through Resend. We keep your email address, subscription choice, consent history, delivery status and unsubscribe details.

Subscribing also enables click measurement to understand engagement. Resend processes clicked links, IP addresses and browser and device information. We save the campaign, link, click count and first and last click times with your account in Convex.

Unsubscribe in Account or through any newsletter's unsubscribe link to stop delivery and further click recording against your account. Clicking links in old emails may still contact Resend. Delivery problems or complaints may also stop emails.

Service statistics

We use account information, website analytics and newsletter records to understand readership, operate the service and improve it.

Videos

Mux delivers video and preview images and measures playback quality. During playback, it processes network and device details, country and region inferred from your IP address, a random viewer identifier and playback-quality information.

LinkedIn posts

When you enable LinkedIn posts, we load them from LinkedIn, sharing your IP address, device and network details and potentially page information. LinkedIn may set cookies and uses this data for recognition, analytics and advertising.

LinkedIn Ireland Unlimited Company handles subsequent processing under LinkedIn's Privacy Policy.

Lawful basis for processing

We use personal data on the following legal bases:

  • Consent: to store optional profile details you provide, measure website use, send newsletters and measure their clicks, and load LinkedIn posts.
  • Contractual necessity: to provide your account and requested video playback, and to respond to consulting enquiries when you ask us to take steps before a contract.
  • Legitimate interests: to operate and protect the website, respond to general enquiries using your message and contact details, prepare account and newsletter service statistics, measure video playback quality, and establish or defend legal claims. We balance these interests against your rights and freedoms.
  • Legal obligations: to meet applicable legal requirements, including responding to valid requests from competent authorities.

Who we share information with

Service providers

We use these providers to operate the service:

  • Vercel: website hosting, delivery, operational logs and optional page performance measurement through Speed Insights
  • Sanity: editorial content management and delivery
  • Convex: account, authentication, newsletter and reporting data
  • Resend: account, newsletter and contact-form email delivery
  • home.pl and Microsoft: mailbox hosting, access, synchronisation and correspondence
  • PostHog EU: website analytics you enable
  • Mux: video delivery and playback-quality measurement
  • LinkedIn: embedded posts you enable

Providers may engage subprocessors to help deliver their services.

Partners and published statistics

We share aggregated statistics about accounts, newsletters and readership with authorised partners. We may publish overall service totals on our website or social media.

Organisation partnerships

For partnerships, we may share your name, work email address, account activation status and whether you actively use the service with your organisation. This applies only where your verified work email links your account to that organisation. Before sharing, we will explain what your organisation will receive, why, and your rights and choices.

Authorities

We disclose data to authorities where legally required or necessary for a legal claim.

International transfers

Provider operations and support can involve processing outside the European Economic Area, including the United States. This includes Resend, Mux, Microsoft and LinkedIn. Vercel processes Speed Insights data in the United States under Standard Contractual Clauses.

For international transfers, we use applicable adequacy decisions, including the EU–US Data Privacy Framework where the recipient and processing are covered, or appropriate safeguards such as the European Commission's Standard Contractual Clauses. Contact us for the safeguards applying to your data and how to obtain a copy.

How long we keep your information

Retention depends on the type of information and its purpose:

  • Accounts and profiles: for the life of the account, until deletion
  • Authentication: sessions expire after up to 60 days of inactivity; scheduled cleanup removes expired authentication and short-lived rate-limit records within about an hour
  • Local email delivery records: in our application database, account email records are kept for seven days once finalised and 28 days if abandoned, and newsletter email records for 30 days from their creation; provider records have separate retention rules
  • Correspondence: as long as needed to handle the enquiry, related follow-up and applicable legal requirements or claims
  • Newsletter records: preferences, consent history and send state until account deletion; detailed engagement for approximately 14 months after the last recorded click, or earlier on account deletion
  • Newsletter event records: delivery-event records, including message identifiers, for approximately 90 days; records preventing duplicate click processing for approximately 14 months. These records follow those periods after account deletion
  • Analytics choice: valid in your browser for 365 days from your explicit choice. Your account stores the latest recorded choice, when we received it and its source (banner or Account settings) until account deletion. It counts in reporting for 365 days after receipt
  • PostHog events: up to 36 months after collection, to compare readership trends. We then delete events and retain anonymised summaries for longer-term comparisons
  • Vercel Speed Insights: a 30-day dashboard reporting window; we do not export the records
  • Video playback records: Mux keeps pseudonymous video-view records for up to 100 days, then deletes them
  • LinkedIn choice: valid for 365 days; the stored browser record can remain until you switch it off, clear it or replace it with a new choice
  • Account and newsletter reports, campaign totals and deletion records: retained indefinitely under the current reporting model to compare periods and prepare yearly summaries. Deletion records contain the deletion time and whether the account was verified

Deleting your account removes its credentials, sessions, profile, newsletter preferences, consent history, send state, account-linked engagement and saved analytics choice. Newsletter event records, correspondence, provider records, browser-linked analytics and historical reports follow their respective retention periods and remain subject to applicable data protection rights. We may send a deletion confirmation.

Provider backups, security logs and suppression records can remain for their applicable operational or legal periods. You can request further erasure using the contact details below.

How we protect your information

We protect data through access controls, encrypted connections, authentication checks and rate limits. Two-factor secrets and recovery codes are encrypted at rest.

Your rights and choices

Subject to the applicable conditions, you can ask us to:

  • Provide access to your personal data
  • Correct inaccurate or incomplete data
  • Delete your data or restrict its processing
  • Provide a portable copy of eligible data

You can object to processing based on our legitimate interests. Contact us with your request and circumstances. We will stop that processing unless compelling legitimate grounds or legal claims justify continuing it. An objection to direct marketing ends that use.

Accept or reject analytics in the cookie banner. Change or withdraw analytics and LinkedIn choices in Account under Cookies; these choices apply to that browser.

You can withdraw consent at any time using the relevant controls or by contacting us. Withdrawal leaves earlier lawful processing unaffected. Profile details, website analytics, LinkedIn posts and the newsletter are optional; you can still access the website if you decline them. Our Cookie Policy explains browser storage and withdrawal.

Email contact@gigabit.studio to exercise your rights. We respond without undue delay, normally within one month. Complex or numerous requests may require two additional months; we explain any extension within the first month. Requests are normally free; we may ask for proportionate information to verify your identity.

You can complain to the Belgian Data Protection Authority or the competent authority where you live, work or believe an infringement occurred.

Changes to this Privacy Policy

Last updated: 23 September 2026. Version: 2026-09-23.

We publish updates here and announce significant changes by email or a prominent website notice.