Privacy Policy
What happens to your data when you visit this site or write to me: who looks after it, why, for how long, and what you can ask for.
Who I am
The controller of your personal data is Piotr Brzeziński, running the sole proprietorship Piotr Brzeziński - UX / UI Design (melon studio), ul. Kościelna 17 lok. 24, 60-536 Poznań, Poland, tax ID (NIP) 7812048851, REGON 524808073. This is a one-person studio: when this policy says "I", that is who it means.
For anything about your data, write to hello@melon.studio. I answer privacy questions within 30 days, usually much sooner.
What I collect and why
I collect as little as I can. Most visitors give me nothing but the technical data every website receives. I don't make automated decisions about you or build a profile of you.
- The contact form: your name, email, company (optional), what you tell me about the project, the budget and timing you choose. I use them to answer you and, if we decide to work together, to prepare an offer. Legal basis: steps taken at your request before a contract (Art. 6(1)(b) GDPR) and my legitimate interest in answering messages (Art. 6(1)(f)). Giving these details is voluntary, but without them I can't reply.
- Email you send me directly: the same, on the same basis.
- Analytics, only if you agree: how the site is used (pages, time, device type, rough location) through Google Analytics 4. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time in the cookie settings.
- Server logs: IP address, browser and time of a request, kept by the hosting provider for security and to keep the site running. Legal basis: legitimate interest (Art. 6(1)(f)).
Who else sees it
I don't sell your data or share it for advertising. A few providers process it on my behalf, under data processing agreements:
- Vercel Inc. (hosting, server logs and BotID, the spam check on the contact form).
- Resend, Inc. (delivery of contact form messages to my inbox).
- Google Ireland Ltd. (Google Analytics, only with your consent).
Services the site loads
A few services load straight into your browser and so receive your IP address and browser details: Adobe Systems Software Ireland Ltd. (Adobe Fonts, which serves the site's typefaces) and Spotify AB (the cover images of the footer's "Now playing" load from Spotify's servers). Neither sets cookies through this site. Legal basis: my legitimate interest in a site that reads well and shows what I'm listening to (Art. 6(1)(f) GDPR).
When you send the contact form, Vercel BotID analyses signals from your browser and the request to tell people from bots, and blocks the bots. Legal basis: my legitimate interest in a form free of spam (Art. 6(1)(f) GDPR).
Transfers outside the EEA
Some of these providers are based in the United States. Transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
How long I keep it
- Contact messages: up to 3 years after our last exchange, or until you ask me to delete them, unless they become part of a contract (then as long as tax and accounting law requires).
- Analytics data: 14 months, then Google deletes it.
- Server logs: up to 30 days.
Your rights
You can ask me for access to your data, a copy of it, its correction or deletion, to restrict its use, or to move it elsewhere. You can object to processing based on legitimate interest, and withdraw consent at any time without affecting what happened before.
If you think I handle your data unlawfully, you can complain to the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.
Changes
When this policy changes, the new version appears here with a new date at the top.