Privacy policy
1. Who is responsible for your data
The controller of personal data processed in the flexibilitymarket.eu service (the Service) is Krzysztof Ulicki, correspondence address: Plac Trzech KrzyĹĽy 10/14, 00-499 Warsaw, Poland. For matters concerning personal data, write to [email protected] or to the correspondence address.
2. The essentials
- The Service does not need your personal data. There are no accounts, forms or newsletter. The assistant answers questions about publicly available documents: the report, the draft NC DR network code and legal acts.
- Do not enter personal data into the assistant. Before your first question you accept this rule and the Terms by ticking the box below the question field; without it the question is not sent.
- Your conversations with the assistant are stored only in your browser. The server does not store the text of questions or answers.
- We pass the text of the question to AI service providers (sections 4 and 7) to prepare the answer. Before that, the system automatically removes typical personal data from it.
- We use no advertising cookies and do not profile users. Google Analytics statistics cookies are stored only with your consent; without consent the Service works the same.
3. AI assistant: information under the AI Act
You are talking to an artificial intelligence system, not a human. Answers and files are prepared by the Claude language model (Anthropic) based on the report of Centrum Transformacji Energetycznej, the text of the draft NC DR network code and the documents in the report's bibliography. Answers may contain errors; check the sources given. Files prepared by the assistant are marked as AI-generated with a visible label and in the file's metadata. (Legal basis: Article 50 of Regulation 2024/1689, the AI Act.)
4. How data flows
- Browser. You write a question. The conversation is stored in your browser's storage (localStorage).
- Cloudflare. Traffic to the Service passes through the Cloudflare network, which protects the Service against attacks. Cloudflare sees the IP address of the connection and passes it to the server.
- The Service's server (OVH, Switzerland). The server counts the question limit (section 5.3), automatically removes typical personal data from the question and records technical data on the call without its content (section 5.2).
- Voyage AI. The question, after removal of personal data, is turned into a vector to find matching fragments of the documents.
- Anthropic. The question, the conversation so far and the fragments found go to the Claude model, which prepares the answer.
- Browser. The answer comes back to you and is stored in your browser. The server does not keep the text of the question or the answer.
Separately from the conversation: if you consent, Google Analytics collects visit statistics (section 5.4).
5. What data we process, why and on what basis
5.1 The text of questions to the assistant
- What: the text of the question and of the conversation so far, which you send to get an answer. Questions should concern the documents and should not contain personal data.
- Why: to answer and to prepare the file you ask for.
- How we protect it: before sending to the AI providers, the system automatically removes e-mail addresses, phone numbers, PESEL numbers, account numbers and first and last names from the question, and tells you so. The filter works by patterns, so it may miss data written in an unusual way and other information about a person (e.g. a description of a situation, a job title, an address). If you enter such data despite the rule, it will reach the AI providers under the terms in section 7.
- Legal basis: performance of the service you request under the Terms (Article 6(1)(b) GDPR). Using the assistant is voluntary.
- How long: the server does not keep the text of the conversation after answering. The conversation stays in your browser until you delete it. Retention by the AI providers is described in section 7.
5.2 Technical data on model calls
- What: date and time, type of operation, model used, number of tokens, cost, duration, result (success or error). No text of questions or answers, no IP address and no user identifier.
- Why: controlling the costs and the operation of the service.
- This data does not show who asked a question, so it is not personal data.
- Question statistics: for each question (in the chat, after clicking a ready answer and on a call to an MCP server tool) we store the date and time, the language and the channel. No text of the question and no user identifier.
5.3 IP address and protection against abuse
- What: the IP address of your connection.
- Why: limits on the number of requests, protection against attacks and bots, and counting how many different people asked questions on a given day.
- How: for the limit of questions to the assistant we store only a hash of the address with a key changed every day (after a day the hash cannot be linked to anything) and a question counter, deleted after 48 hours. The same daily hash is used to count the people asking questions on a given day: after the day ends only the number remains and the hash is deleted. For the limit of MCP server calls the address is held only in the memory of the running program, for at most one day, and is not stored. Traffic passes through the Cloudflare network (sections 4 and 7).
- Legal basis: the controller's legitimate interest: network and service security (Article 6(1)(f) and recital 49 GDPR).
5.4 Visit statistics
Cloudflare Web Analytics (always): we measure the number of visits and page load speed without cookies or browser storage; we only see aggregate figures (e.g. page views, countries, device types).
Google Analytics 4 (only with your consent):
- What: a random browser identifier stored in the
_gaand_ga_<identifier>cookies, the pages visited and the page you came from, visit time, scrolls and clicks on external links, actions in the Service (sending a question to the assistant, opening a ready answer with the question number from the list, preparing a file, downloading the report or supplement PDF, copying the MCP server address) without the text of questions, device and browser type, approximate location (country, city) derived from the IP address. Google Analytics 4 does not store the IP address. We do not link this data with the content of your questions to the assistant. - Why: to know how many people use the Service, which pages they read, where they come from and whether they use the assistant.
- Legal basis: your consent (Article 6(1)(a) GDPR and Article 399(1) of the Polish Electronic Communications Law). You give consent with the “Accept” button in the banner and withdraw it at any time with the “Cookie settings” link in the footer. Withdrawal does not affect the lawfulness of measurement before withdrawal (Article 7(3) GDPR).
- How long: these are two different periods. The
_gacookies in your browser expire 2 years after your last visit (or earlier, if you withdraw consent or delete them). Google keeps the data collected by Google Analytics for a shorter time: event data for 2 months, data linked to the browser identifier for 14 months from the last visit; after that only aggregate reports remain.
5.5 Contacting us
If you write to us, we process your e-mail address and the content of your message to reply (Article 6(1)(f) GDPR). We delete the message after replying, at the latest 30 days after receiving it. Exception: a complaint or a request concerning personal data is kept until it is handled and then until any claims become time-barred.
6. Cookies and browser storage
| what | why | how long |
|---|---|---|
NEXT_LOCALE cookie | remembering the chosen site language | until you close the browser |
fm_sid cookie | random session identifier for the limit of questions to the assistant (20 per day); the server stores only its hash with a counter, no content and no IP address | 30 days |
_ga, _ga_<identifier> cookies | Google Analytics 4: telling visits and visitors apart (section 5.4); only with consent | 2 years (data at Google: section 5.4) |
browser storage (fm-consent) | remembering your choice in the consent banner | until you delete it |
browser storage (fm-ai-terms) | remembering that the consent box below the question field was ticked before the first question | until you delete it |
site_gate cookie | access to the password-protected test version (only before the public launch) | 30 days |
| browser storage (localStorage) | your conversations and files from the chat, so you can return to them | until you delete them (delete conversation button or clearing browser data) |
Apart from the Google Analytics cookies, the cookies and browser storage are necessary for the functions you request and therefore do not require consent (Article 399(3) of the Polish Electronic Communications Law). Google Analytics cookies are stored only after your consent; when you withdraw it, we delete them from your browser. The content of browser storage is not sent to our server, except for the conversation you send when asking the next question.
7. Who we share data with
We use providers that process data on our behalf (processors, Article 28 GDPR). With each of them we have a data processing agreement that is part of the terms of its service.
| provider | role | where | basis for transfer outside the EEA |
|---|---|---|---|
| Anthropic (Anthropic Ireland Ltd.) | Claude AI model: answers and files | USA | standard contractual clauses (SCC) |
| Voyage AI (Voyage AI Innovations Inc., MongoDB group) | search: turning the question into a vector | USA | standard contractual clauses (SCC); the company is also covered by the MongoDB group's EU-US Data Privacy Framework certification |
| Cloudflare (Cloudflare, Inc.) | content delivery network, attack protection, visit statistics, mail to the contact address | USA and Cloudflare network servers worldwide, usually those closest to the user | EU-US Data Privacy Framework and standard contractual clauses (SCC) |
| Google (Google Ireland Ltd.) | Google Analytics 4 visit statistics, only with your consent | USA | EU-US Data Privacy Framework and standard contractual clauses (SCC) |
| OVH (OVH SAS) | the Service's server and database | Switzerland (Zurich) | European Commission adequacy decision |
Anthropic does not use data sent through the API to train models. In Voyage AI we have disabled the use of data for training. Providers may keep data for a limited time under their agreements (e.g. Anthropic up to 30 days, longer for content flagged as violating its policies).
MCP server: if you connect the Service to your own AI application (e.g. Claude, ChatGPT), your questions are processed by that application's provider under your agreement with it. We only receive tool calls (e.g. a search phrase); we do not store their content. We pass the search phrase to Voyage AI to find fragments by meaning (as in the chat).
8. Your rights
You have the right to access your data, to rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest (Articles 15–18, 20 and 21 GDPR), as well as the right to withdraw consent at any time (Article 7(3) GDPR).
- How to make a request: write to [email protected] or to the correspondence address.
- Deadline: we reply within one month of receiving the request; where necessary this may be extended by two further months, and we will tell you so (Article 12(3) GDPR).
- Identity verification: if the request concerns correspondence with us, we reply to the address the message came from. If we have reasonable doubts about who you are, we may ask for additional information, only to the extent needed to confirm your identity.
- Limits in practice: we do not collect identifying data, so we usually cannot tell which records concern you (Article 11 GDPR); if you provide information that makes this possible, we will handle the request. For the same reason, the right to data portability in practice applies only to correspondence with us. Conversations with the assistant are in your browser: you can delete them yourself at any time.
You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO, ul. Stanisława Moniuszki 1A, 00-014 Warsaw, uodo.gov.pl).
9. Changes to this policy
We announce changes on this page, giving the date of the new version.