Privacy Policy

    Automorphic - Mateusz Grabiński
    Last updated: May 9, 2026

    1. General Information

    This Privacy Policy describes the principles of personal data processing by Automorphic Mateusz Grabiński, operating under the business name Automorphic, located at ul. Piekart 9, 62-800 Kalisz, Poland, Tax ID (NIP) 6182208300 (hereinafter "Automorphic", "Controller", or "we").

    The Controller ensures the security of users' personal data and processes it in accordance with applicable regulations, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).

    2. Controller's Contact Details

    For matters related to personal data protection, you can contact us:

    Email: kontakt@automorphic.pl

    Address: Automorphic Mateusz Grabiński, ul. Piekart 9, 62-800 Kalisz, Poland

    3. Scope and Purposes of Data Processing

    We process personal data for the following purposes:

    • Contact and inquiries: to respond to messages sent via the contact form or email.
    • Service delivery: for the purpose of concluding and performing a contract.
    • Direct marketing: sending information about new services, offers and educational materials by email and - where separate consent has been given - telephone contact (including via AI voice agents) in accordance with Art. 393 of the Polish Electronic Communications Act (PKE) and Art. 6(1)(a) GDPR.
    • Analysis and service development: improving the quality of service, maintenance, and customer communication.

    Providing personal data is voluntary but necessary to fulfill the above purposes.

    4. Legal Basis for Processing

    Data is processed based on:

    • Art. 6(1)(b) GDPR - performance of a contract or pre-contractual measures,
    • Art. 6(1)(c) GDPR - compliance with legal obligations,
    • Art. 6(1)(a) GDPR - user consent,
    • Art. 6(1)(f) GDPR - legitimate interests of the Controller (e.g., customer communication, protection against claims).

    5. Data Recipients

    Data may only be shared with entities cooperating with us in service delivery, in particular:

    • hosting and cloud infrastructure providers (Vercel, Netlify, Supabase),
    • providers of artificial intelligence models and speech synthesis (OpenAI, Anthropic, ElevenLabs, Google),
    • marketing and analytics tool providers (Meta Platforms, Google),
    • automation tool providers (n8n, Make, Zapier),
    • communication and project management tool providers (Google Workspace, Asana, Notion),
    • accounting, legal, postal and courier service providers.

    We have entered into a Data Processing Agreement (DPA) compliant with Art. 28 GDPR with each of the above entities. A list of specific providers located outside the European Economic Area and the legal basis for transfers is provided in Section 9.

    6. Data Retention Period

    • Contact form data: up to 12 months after the last contact.
    • Client data: for the duration of the contract and for the time necessary for accounting and tax purposes (up to 6 years).
    • Data processed based on consent: until consent is withdrawn.

    7. Rights of Data Subjects

    You have the right to:

    • access your data and obtain a copy,
    • rectification of data,
    • erasure ("right to be forgotten"),
    • restriction of processing,
    • data portability,
    • objection to data processing for marketing purposes,
    • withdrawal of consent at any time,
    • lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, if you believe the processing of your data violates the GDPR.

    To exercise these rights, write to: kontakt@automorphic.pl

    8. Cookies, Meta Pixel and Consent Mode v2

    The Automorphic website uses cookies and tracking technologies only after obtaining your freely given, informed and granular consent (Art. 6(1)(a) GDPR and Art. 398 of the Polish Electronic Communications Act of 12 July 2024 (PKE), implementing Art. 5(3) of the ePrivacy Directive 2002/58/EC). Cookies strictly necessary for the website to function are an exception, based on Art. 6(1)(f) GDPR (legitimate interest of the Controller).

    We use the following categories of cookies, which you can accept or reject separately in the cookie banner:

    • Strictly necessary (always active): enable basic website functionality, remember your privacy choices and language preferences.
    • Analytics: Google Analytics 4 (with anonymized IP) - help us understand how users interact with the site.
    • Marketing: Meta Pixel (Facebook/Instagram), Conversions API (CAPI), Google Ads - used to measure ad effectiveness and for remarketing.

    Google Consent Mode v2. We have implemented Google Consent Mode v2 in accordance with Google's requirement applicable to EEA traffic since March 6, 2024. We set the ad_user_data and ad_personalization signals to "granted" only after your marketing consent. Without consent, Google receives only basic, anonymous signals (cookieless pings) that do not allow user identification.

    Meta Pixel and Conversions API (CAPI). If you grant marketing consent, we load Meta Pixel and also forward conversion events to Meta Platforms Ireland Ltd. / Meta Platforms Inc. via the Conversions API (server-to-server). Meta then receives: IP address, device identifier, pages you visit, conversion events and - in the case of Lead Ads forms and Custom Audiences lists - hashed (SHA-256) contact details (email, phone number). We do not transmit sensitive data (health, financial) to Meta in line with Meta's updated sensitive ad category rules. For ad performance measurement, Meta and Automorphic act as joint controllers within the meaning of the Meta Controller Addendum. Meta privacy policy: https://www.facebook.com/privacy/policy/.

    Managing consent. You may change your preferences at any time by clicking the "Cookie settings" icon in the website footer or by clearing site data in your browser settings. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

    9. Transfers of Data Outside the European Economic Area (EEA)

    We use providers headquartered outside the EEA (mainly in the United States). In every case we ensure that transfers take place on the basis of appropriate safeguards under Art. 46 GDPR and, where applicable, the European Commission's implementing decision (EU) 2023/1795 of 10 July 2023 establishing the EU-U.S. Data Privacy Framework (DPF). Where a provider does not hold DPF certification, transfers are carried out on the basis of Standard Contractual Clauses (SCC) approved by the European Commission together with a Transfer Impact Assessment in line with EDPB Recommendations 01/2020.

    Current list of key providers and the basis for transfers:

    • Vercel Inc. (USA) - website hosting. Basis: DPF (active) + SCC.
    • Netlify, Inc. (USA) - website hosting. Basis: DPF (active) + SCC.
    • ElevenLabs Inc. (USA) - speech synthesis (TTS) and transcription (STT) for voice agents. Basis: DPF (active) + SCC. Data is processed in accordance with ElevenLabs' privacy policy and Data Processing Agreement (DPA).
    • OpenAI, L.L.C. (USA) - large language models (GPT). Basis: SCC under the OpenAI Data Processing Addendum (OpenAI is not currently DPF-certified). Content sent via the API is not used to train models.
    • Anthropic, PBC (USA) - large language models (Claude). Basis: SCC under the Anthropic Data Processing Addendum. Anthropic holds ISO 27001:2022, ISO/IEC 42001:2023 (AI Management) and SOC 2 Type II certifications. Content sent via the API is not used to train models.
    • Google LLC / Google Ireland Ltd. (USA / Ireland) - Google Workspace, Google Analytics 4, Google Ads. Basis: DPF (active) + SCC.
    • Meta Platforms, Inc. / Meta Platforms Ireland Ltd. (USA / Ireland) - Facebook and Instagram ads, Meta Pixel, Conversions API, Custom Audiences, Lead Ads. Basis: DPF (active) + SCC + Meta Controller Addendum (joint controllership for ad measurement).
    • Supabase Inc. (USA) - database. Basis: SCC + DPA. Processing region: EU (Frankfurt).
    • Asana, Inc. and Notion Labs, Inc. (USA) - project management and documentation tools. Basis: DPF / SCC + DPA.

    We verify the DPF status of each provider against the list maintained by the U.S. Department of Commerce: https://www.dataprivacyframework.gov/list. If the DPF is invalidated (e.g., following a court ruling against decision 2023/1795), we rely solely on SCC and an updated Transfer Impact Assessment. We have entered into a Data Processing Agreement (DPA) with each provider. You may request a copy of the Standard Contractual Clauses or information on the safeguards by emailing kontakt@automorphic.pl.

    10. Data Security

    We apply appropriate technical and organizational measures to protect data against loss, disclosure, or unauthorized access.

    11. Use of Artificial Intelligence (AI) Systems

    We provide services based on artificial intelligence systems, including voice agents (voice AI), chatbots and automations using large language models. In accordance with Art. 50 of Regulation (EU) 2024/1689 (the AI Act), we inform you that:

    • When interacting with a voice assistant, chat or AI-powered form provided by Automorphic or our clients, the user is interacting with an AI system. For phone calls, this information is provided audibly at the start of the conversation; for text interfaces, it is provided visually.
    • To deliver our services we use large language models and speech synthesis provided by third parties, in particular OpenAI L.L.C., Anthropic PBC, ElevenLabs Inc. and Google LLC (see Section 9).
    • Content sent to AI models through these providers' APIs is not used to train them. This follows from the default API terms of the providers we use (OpenAI API, Anthropic API, Google AI / Vertex AI), under which customer data is not used to train models without explicit consent.
    • We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR. If an AI system qualifies a lead or classifies an inquiry, the result is reviewed by a human before any decision affecting the user is made.
    • For services provided to our clients, with respect to their end-users' data Automorphic acts as a processor within the meaning of Art. 28 GDPR; the controller of that data is the Client.

    12. Voice AI - Phone Call Recordings and Transcripts

    When we provide a voice agent (voice AI) service to a Client, the following data is processed as part of the service:

    • phone call recordings (audio),
    • call transcripts (text),
    • call metadata (phone number, date, duration, end status, language of the conversation).

    Role of Automorphic. With respect to this data, Automorphic acts as a processor within the meaning of Art. 28 GDPR. The controller is the Client (company) for which we deployed the agent. Purposes, legal bases and retention periods are set by the Client in its own privacy policy.

    AI disclosure to the caller. Every call begins with a notice informing the caller that they are speaking with an AI system (in line with Art. 50(1) of the AI Act, which applies from August 2, 2026).

    Where the data goes. Audio is transcribed by ElevenLabs Inc. The transcript may be processed by one of the large language model (LLM) providers we use: OpenAI L.L.C., Anthropic PBC or Google LLC - in order to generate a response, which is then synthesized back to speech by ElevenLabs Inc. Content sent through these providers' APIs is not used to train their models.

    Retention. By default, recordings and transcripts are retained for up to 30 days. The Client can configure a shorter period or immediate deletion after processing.

    Outbound calls for direct marketing purposes. When we use a voice agent (or contact you in person by phone) for direct marketing - including contacting people acquired through booking forms (TidyCal) or Meta Lead Ads campaigns - this is only carried out toward persons who have previously given consent to such contact in accordance with Art. 393 of the Polish Electronic Communications Act and Art. 6(1)(a) GDPR. You may withdraw consent at any time by contacting kontakt@automorphic.pl. Calls initiated by you (e.g., after booking a meeting via TidyCal) are conducted as pre-contractual measures on the basis of Art. 6(1)(b) GDPR and do not require separate marketing consent.

    13. Changes to the Privacy Policy

    We reserve the right to amend this policy in the event of changes to applicable law, changes to the services we provide, or changes to the providers we use. We will give appropriate notice of any material changes. The current version of the document is always available at: automorphic.pl/en/privacy-policy.