Privacy Policy

Effective date: 22 April 2026  ·  Version: 1.0

This Privacy Policy explains how Antoni Łącki, trading as Geneza Antoni Łącki, collects, uses, stores, and shares personal data in connection with the websites luckytoni.com and antonilacki.com and the "AI with Toni" email newsletter (together, the "Services").

At this stage, the Services are limited to free content: the newsletter, any free lessons or guides delivered by email, and the public pages of the websites. No paid products, courses, or consulting are offered yet. This Policy will be updated before any paid offering goes live.

This Policy is written to comply with the EU General Data Protection Regulation 2016/679 ("GDPR"), the Polish Act on Personal Data Protection of 10 May 2018, and the Polish Act on Providing Services by Electronic Means of 18 July 2002.

1. Who is the Data Controller

The Data Controller of your personal data is:

For any privacy-related request, including access, rectification, deletion, or questions about this Policy, write to the email above. There is no separate Data Protection Officer. The Controller handles all requests directly.

2. What personal data we collect

We only collect data that is necessary to deliver the newsletter, run the websites, and comply with the law. The categories are:

2.1 Data you give us directly

• Newsletter signup: email address, first name (optional), and any interest tags you select on opt-in forms.
• Replies and messages: the content of any email you send to us, including any information you voluntarily share in surveys or feedback forms.

2.2 Data collected automatically

• Email engagement: opens, clicks, unsubscribes, bounces, and delivery timestamps, processed through Kit (see Section 4).
• Website analytics: IP address (truncated or anonymized where possible), browser type, device type, operating system, pages visited, referring URL, and session duration.
• Cookies and similar technologies: see Section 7.

2.3 Data we do not collect

We do not collect billing, payment, or tax data because no paid products are offered yet. We do not ask for phone numbers, postal addresses, date of birth, or any special category of data under Art. 9 GDPR.

3. Why we process your data and the legal basis

Purpose	Legal basis under GDPR Article 6
Sending the newsletter and free lessons you subscribed to	Art. 6(1)(a) — your consent, given through double opt-in
Analytics, improving the content and the websites, preventing abuse	Art. 6(1)(f) — legitimate interest
Responding to messages you send us	Art. 6(1)(f) — legitimate interest in replying to inquiries
Defending or pursuing legal claims, if ever needed	Art. 6(1)(f) — legitimate interest

Because the primary legal basis is consent, you can withdraw it at any time by clicking "unsubscribe" at the bottom of any email or by replying to any email with the word "remove". Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

4. Who we share data with

We share data only with a small, trusted set of vendors who help us operate the newsletter and the websites. Each one acts as a data processor, is bound by a written Data Processing Agreement, and may only use your data on our instructions.

Processor	What they do	Data location
Kit (Kit Labs, Inc., formerly ConvertKit)	Email marketing platform. Stores your email, name, tags, and engagement events. Sends newsletters and automated welcome sequences.	USA. Transfer under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.
Google (Google Ireland Ltd.)	Google Workspace for our email inbox and internal documents. Google Analytics, where enabled, for website traffic reports.	EU and USA under EU-U.S. DPF.
Hosting and CDN provider	Serves the websites, caches static assets, mitigates attacks.	EU and USA under EU-U.S. DPF.

We do not sell, rent, or trade your personal data to anyone. We do not share the email list with third parties for their own marketing. We may disclose data only when required by a lawfully issued order from a Polish or EU authority, or when strictly necessary to defend our legal rights.

5. International transfers

Some of our processors, notably Kit, are based in the United States. In every case, transfers outside the European Economic Area are protected by at least one of the mechanisms required by Chapter V of the GDPR:

• The EU-U.S. Data Privacy Framework, for certified recipients;
• Standard Contractual Clauses approved by the European Commission;
• Your explicit consent, where applicable.

A copy of the relevant safeguards can be requested by email at any time.

6. How long we keep your data

• Active subscribers: for as long as you remain subscribed to the newsletter.
• Unsubscribed emails: kept on a suppression list for up to 24 months, so we do not accidentally contact you again, then deleted.
• Email conversations: up to 3 years after the last reply, unless a longer period is needed for legal reasons.
• Website analytics: up to 26 months, then deleted or aggregated.

7. Cookies and tracking

Our websites use a minimal number of cookies and similar technologies:

• Strictly necessary cookies that keep the site working (session state, security, consent record). These do not require your consent.
• Analytics cookies that help us understand which articles are useful. Loaded only after you accept the cookie banner.
• Marketing pixels from LinkedIn, Meta, or YouTube, loaded only when you accept marketing cookies, used to measure reach and find similar audiences for future content.

You can change your choice at any time through the "Cookie Settings" link in the website footer, or by clearing cookies in your browser.

8. Your rights under GDPR

As a data subject in the EEA, you have the following rights, free of charge, in relation to your personal data:

• Right of access (Art. 15) to obtain a copy of your personal data and information about how it is processed.
• Right to rectification (Art. 16) of inaccurate or incomplete data.
• Right to erasure (Art. 17), known as "the right to be forgotten".
• Right to restriction of processing (Art. 18) in specified circumstances.
• Right to data portability (Art. 20) to receive your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21) to processing based on legitimate interest, including direct marketing, which we will always honour.
• Right to withdraw consent at any time, without affecting past lawful processing.
• Right not to be subject to fully automated decisions producing legal effects (Art. 22). We do not make such decisions.

To exercise any of these rights, email al@antonilacki.com. We will respond within one month, as required by Art. 12(3) GDPR. If your request is complex, we may extend the deadline by two additional months and will notify you of the extension.

9. Right to lodge a complaint

If you believe your data has been processed unlawfully, you have the right to lodge a complaint with the Polish supervisory authority:

We would, however, appreciate the chance to address your concerns before you go to UODO. Please write to us first.

10. Children

The Services are not directed to children. We do not knowingly collect personal data from anyone under the age of 16. If you believe that a child has provided us with personal data, please contact us and we will delete it promptly.

11. Security

We take reasonable technical and organizational measures to protect your data: encrypted transport (TLS), strong passwords, two-factor authentication on every critical vendor, and written contracts that require equivalent safeguards from our processors. No system is ever perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the UODO within 72 hours, as required by Art. 33 GDPR, and, where required, notify you directly.

12. Profiling and automated decision-making

We use Kit's segmentation and tagging features to send more relevant content based on topics you have clicked on. This is basic marketing segmentation, not profiling with legal effects. You can opt out at any time by unsubscribing, or by replying to any email asking us to remove your tags.

13. Changes to this Policy

We may update this Policy from time to time. The "Effective date" at the top of the page always reflects the latest version. For material changes, we will notify active subscribers by email at least 14 days before the change takes effect. When paid products launch, this Policy will be expanded and you will be notified in advance.

14. Contact

Questions, requests, or complaints about this Policy or about how we handle your data: