Privacy policy

Last updated: 19 September 2026

Who is responsible for your data

Mattlytics is my sole proprietorship, registered in Poland as Mateusz Koniuch, ul. Ignacego Jana Paderewskiego 6/25, 97-400 Bełchatów, tax ID (NIP) 7692258154. As its owner, I am the controller of the personal data described in this policy. You can reach me at contact@mattlytics.com.

What this policy covers

This policy covers mattlytics.com: the public pages and the password-protected client area, where I share project documents with the clients I work for.

Visiting the public pages

The public pages set no cookies and load no tracking or advertising scripts. Fonts are served from this site, not from an outside provider.

I count visits to the public pages on the server, from the page request itself. For each page view I keep the page address, the domain of the site that linked to it, the country and whether the visit came from a phone, a tablet or a computer. I do not keep your IP address, your full browser details or any identifier. Nothing is stored on or read from your device, and the client area is never counted. The counts are kept for three months in Cloudflare Workers Analytics Engine.

The site runs on Cloudflare. To deliver pages and protect them from abuse, Cloudflare processes technical data about each request, such as your IP address, your browser type and the page you asked for. Cloudflare acts as my processor. I do not keep request logs of my own.

The client area

The client area is only for clients I work with. It uses one cookie, mlt_session, which keeps you signed in. The cookie is strictly necessary for the area to work, applies only to your client folder, expires after 30 days and is removed when you sign out. It contains a signed session token and nothing else.

To stop password guessing, each sign-in attempt is counted per client folder and IP address for one minute, using Cloudflare's rate limiting. After that minute the count is gone, and I do not store it.

Documents in the client area are prepared for our project. They may include business contact details and other information you shared with me for that work.

Email

If you write to contact@mattlytics.com, Cloudflare Email Routing forwards the message to my mailbox. I use your address and your message to reply and to handle what you asked about.

Legal basis

• Steps before a contract and the contract itself (Article 6(1)(b) GDPR), when you ask about my services or we work together.
• My legitimate interest (Article 6(1)(f) GDPR) in keeping the site and the client area secure, knowing how the public pages are used, answering messages and keeping records of our cooperation in case of claims.
• Legal obligations (Article 6(1)(c) GDPR) for accounting and tax records when we work together.

How long I keep data

• Session cookie: up to 30 days, or until you sign out.
• Sign-in attempt counts: about one minute.
• Page view counts: three months.
• Messages: as long as I need them to handle your request. If we work together, as long as the law requires me to keep business records and until possible claims expire.
• Client area documents: while our cooperation lasts. When it ends, I remove them from the client area. You can ask me to remove them earlier.

Who receives data

Only the providers that run this service for me: Cloudflare (hosting, security and email forwarding) and my email provider. Some of them may process data outside the European Economic Area. Such transfers rely on the safeguards the GDPR provides, such as an adequacy decision of the European Commission or its standard contractual clauses.

Your rights

You can ask me for access to your data, for its correction or deletion, for restriction of processing and for a copy in a portable format. Where I rely on legitimate interest, you can object to the processing. Write to contact@mattlytics.com and I will answer within one month.

You can also lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl).

I do not use your data for automated decision-making or profiling, and I do not sell it.

Changes

When I change this policy, I update the date at the top of this page.