— LEGAL

Privacy Policy.

What data we collect, why, for how long, and who we share it with. No legal jargon.

This is an English translation provided for convenience. The legally binding version is the Polish one, available at /polityka-prywatnosci.

1. Who is the data controller

The yesfor.ai site is operated jointly by two entities: (1) Custom Service, ul. Bielska 107, 32-652 Bulowice, Poland, NIP 5492373228 and (2) YES FOR spółka z ograniczoną odpowiedzialnością, ul. Świętokrzyska 61, 32-650 Kęty, Poland, entered in the register of entrepreneurs of the National Court Register kept by the District Court for Kraków-Śródmieście in Kraków, 12th Commercial Division, KRS 0001181754, NIP 5492485016, REGON 542135795, share capital PLN 100,000.00. Together: the Service Providers. Which of them controls your data depends on the stage at which we are in contact, as described in sections 2 and 3.

2. Joint controllership, forms only

Data submitted through the contact form and through the form in the AI Act test reaches a shared contact channel used by both entities, and both jointly decide on the purpose and means of using it at that stage. In that scope, and only in that scope, the Service Providers are joint controllers within the meaning of art. 26 GDPR. Essence of the arrangement: whichever entity receives a request handles the information duty and the data subject request, and the other supplies it with the information it needs. The contact point for both entities is kontakt@yesfor.ai. Under art. 26(3) GDPR you may exercise your rights against each of the joint controllers independently.

3. Sole controllership and how to identify the right entity

From the moment an agreement is concluded, the controller of data relating to that agreement and its performance, including billing data, is solely the Service Provider that is a party to it. No joint controllership arises at that point. The relevant entity is always identified in the specific offer, agreement or invoice, and you receive that information before the agreement is concluded. If you are unsure which entity to approach, write to kontakt@yesfor.ai and we will identify the relevant controller.

4. What data we collect

Contact form: first name, company name, phone number and the content of your enquiry. AI Act test (downloadable guide): email address, test result (risk level and score), confirmation of consent, and a source tag. Technical data: IP address, browser type and traffic source, collected for statistics only through Vercel Analytics and only if you have not turned analytics off (see the cookie policy). We do not collect special categories of data and no form asks for them.

5. Purposes and legal bases

Replying to a form enquiry and business contact: art. 6(1)(b) GDPR (steps prior to entering into a contract) and art. 6(1)(f) GDPR (legitimate interest in conducting business communication). Sending the AI Act guide and subsequent email contact: art. 6(1)(a) GDPR (your consent), with the consent additionally required under electronic communications law for the messages themselves. Visit statistics: art. 6(1)(f) GDPR. Performance of an agreement and settlements: art. 6(1)(b) GDPR and art. 6(1)(c) GDPR (accounting and tax obligations). Defence against claims: art. 6(1)(f) GDPR.

6. Consent and how to withdraw it

Consent to receive the guide and email contact is voluntary; withholding it only means we will not send the guide. You may withdraw it at any time, using the unsubscribe link in the footer of every message or by writing to kontakt@yesfor.ai. Withdrawal does not affect the lawfulness of processing carried out before it.

7. How long we keep data

Contact form data: up to 24 months from the last contact, unless an agreement requires longer. Email address stored on the mailing list after the AI Act test: until consent is withdrawn. Technical data: up to 12 months. Contract and billing data: for the period required by tax and accounting law, counted from the end of the year in which the document was issued. Data needed to defend against claims: until the limitation periods expire.

8. Who we share data with

Data may be shared with processors acting on behalf of the Service Providers: Resend, Inc. (sending emails and storing the list of addresses collected after the AI Act test) and Vercel, Inc. (site hosting and visit statistics through Vercel Analytics and Speed Insights). Beyond that, data may reach the accounting and law firms serving the given entity, and public authorities where the law requires it. The site uses no CRM, no booking system and no external database. We do not sell data and do not share it with data brokers.

9. Transfers outside the EEA

Vercel, Inc. (hosting, analytics) and Resend, Inc. (email, mailing list) are based in the United States. Transfers rely on Standard Contractual Clauses approved by the European Commission and on the Data Privacy Framework. Processor privacy policies: vercel.com/legal/privacy-policy, resend.com/legal/privacy-policy.

10. Your rights

You have the right to: access your data, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interest, and withdrawal of consent. Within the scope covered by joint controllership (section 2) you may approach either entity, including through the shared address kontakt@yesfor.ai; beyond that scope, approach the entity named in the agreement. We respond without undue delay and within one month at the latest. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.

11. Cookies and similar technologies

The site sets no cookies. Vercel Analytics and Vercel Speed Insights run cookieless and are not used for profiling. We do store your choice about analytics, so that we can honour it. Full inventory and the option to change your decision: yesfor.ai/en/cookie-policy.

12. Partner links

The site may contain marked partner links. Following such a link takes you to an external site governed by that site owner’s privacy policy. We do not share your personal data with partners in this context, and commission settlement does not identify you to the Service Providers.

13. Automated decision-making

We do not use automated decision-making or profiling producing legal effects within the meaning of art. 22 GDPR. The AI Act test result is calculated automatically but is purely indicative and informational, produces no legal effects for you, and does not determine the terms of any cooperation. All decisions about cooperation are made by a human.

14. Security

The site is served over HTTPS only, with HSTS enforced and a Content Security Policy restricting script and connection sources. Forms limit the number of submissions from a single IP address and include bot protection.

15. Changes to this policy

This policy may be updated. The current version is always available at yesfor.ai/polityka-prywatnosci. Last updated: August 2026.