Privacy Policy

Mateusz Podeszwa, sole trader operating as podeszwa.dev (the “Studio”, “we”, or “us”), is committed to protecting your personal data. This Privacy Policy explains what information we collect, why we collect it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Controller: Mateusz Podeszwa — sole trader, podeszwa.dev, England and Wales.

1. Data we collect

We collect and process the following categories of personal data:

• Account data — your name, email address, company name (optional), and a hashed password, provided when you create an account via the /hire form or by invitation.
• Gig data — project briefs, messages exchanged through the client portal, milestone notes, and invoice records relating to your engagement with the Studio.
• Payment data — billing references (Stripe Customer ID, Payment Intent identifiers) sufficient to process invoices and refunds. We do not store card numbers or full payment credentials; those remain solely with our payment processor.
• Newsletter data — your email address and subscription status, collected only if you opt in to the Studio’s newsletter.
• Usage data — anonymised page-view counts (URL path and timestamp) collected by on-site middleware. These are not linked to individual user accounts and are used solely for traffic analytics internal to the Studio.

2. Legal bases for processing

3. Retention periods

• Account data — retained for the duration of the account and deleted within 30 days of a written deletion request (see clause 5), unless a legal obligation requires longer retention.
• Financial records — retained for six years from the end of the relevant tax year, as required by HMRC.
• Newsletter subscriptions — retained until you unsubscribe. Removed from our systems within 90 days of unsubscription.
• Usage analytics — anonymised page-view records are retained for up to 24 months and then deleted.

4. Third-party processors

We share your data with the following sub-processors only to the extent necessary to deliver our services. Each is bound by a data-processing agreement or equivalent contractual safeguard:

• Stripe, Inc. (payment processing) — processes payment card data and billing references. Stripe is certified to PCI-DSS Level 1. International transfers are covered by Standard Contractual Clauses. See stripe.com/gb/privacy.
• Mailchimp / Intuit, Inc. (newsletter delivery) — stores and processes newsletter subscriber email addresses. International transfers to the USA are covered by the UK–US Data Bridge. See intuit.com/privacy.
• Resend, Inc. (transactional email) — delivers account-critical and notification emails on our behalf. Data processed in the USA under Standard Contractual Clauses. See resend.com/legal/privacy-policy.
• Cloudflare, Inc. (CDN and bot protection) — request IP addresses and browser signals are processed for security and performance. Cloudflare operates under adequacy decisions applicable to the UK. See cloudflare.com/privacypolicy.
• Railway Corporation (hosting and database) — all application data, including account and gig data, is stored on Railway’s infrastructure in the United States. Transfers are covered by Standard Contractual Clauses. See railway.com/legal/privacy.

We do not sell, rent, or share your personal data with any third party for their own marketing or commercial purposes.

5. Your rights under UK GDPR

You have the following rights in relation to your personal data. Requests should be submitted via the contact form or email to hello@podeszwa.dev. We will respond within one calendar month.

• Right of access — obtain a copy of the personal data we hold about you.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure — request deletion of your data where there is no overriding legal obligation to retain it.
• Right to restrict processing — pause processing while a dispute is resolved.
• Right to data portability — receive your account data in a structured, machine-readable format.
• Right to object — object to processing carried out on the basis of legitimate interest.
• Right to withdraw consent — for any processing based on consent (newsletter), exercisable at any time without affecting the lawfulness of prior processing.

6. Cookies

This site uses session cookies (for login state) and anti-CSRF tokens (for form security). No third-party advertising or cross-site tracking cookies are set. The Cloudflare Turnstile widget used on the contact form may set a short-lived cookie for bot-detection purposes; this is cleared when your browser session ends.

7. Security

We implement appropriate technical and organisational measures to protect your personal data, including HTTPS-only transport, encrypted database storage, hashed password storage (never readable in plain text), and access controls restricting data to authorised systems and personnel.

8. Automated decision-making

We do not make decisions about you using solely automated means that produce legal or similarly significant effects.

9. Supervisory authority

You have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office (ICO), at ico.org.uk or by telephone on 0303 123 1113.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be noted in the footer of transactional emails sent to active account holders. Continued use of the service after the effective date constitutes acceptance of the revised policy.

11. Contact

Mateusz Podeszwa (Data Controller)
Email: hello@podeszwa.dev
Contact form: /contact