This privacy policy explains what data Studio AP processes when you use the website and the AI assistant, and how we use cookies, browser storage and external content (Google map, Booksy). In case of any discrepancy, the Polish version is binding.
1. Data controller
The controller of your personal data is STUDIO AP Anna Przetaczek, whose registered office is at Bolesława Limanowskiego 28, 32-020 Wieliczka, Poland, Tax ID (NIP) 6832104598, REGON 382939238 (“Studio AP”, “we”).
For matters regarding personal data you can reach us:
- by e-mail: anna.przetaczek@gmail.com,
- by phone: +48 789 128 680,
- by post at the registered address above.
We have not appointed a data protection officer - for all matters regarding your personal data you can use the contact details above.
2. What data we process on the website
- Technical server data - our hosting provider may automatically keep technical data in server logs (e.g. IP address, browser type, request time) so the website can be delivered and kept secure. We do not use this data to identify you or to profile you. Basis: Art. 6(1)(f) GDPR.
- AI assistant - chat messages, a technical conversation identifier and current-session history stored in the browser. This is needed so the assistant can answer, keep conversation context and limit abuse. Basis: Art. 6(1)(f) GDPR.
- Assistant voice features - only when you activate them. The browser will ask for microphone access, and speech recognition and synthesis are handled by the voice services (Web Speech API) - either in the browser or by an external provider, to which the audio is then sent. The chat receives the recognised text, and our service does not store raw voice recordings. Basis: Art. 6(1)(a) GDPR for microphone use and Art. 6(1)(f) GDPR for technical operation of the service.
- Cookies and browser storage - saving privacy settings, language, the current chat session and site preferences. Details are in section 6.
Health data. The AI assistant is informational. It does not diagnose, qualify users for treatments or assess health. Please do not enter information about illnesses, medication, pregnancy, breastfeeding, test results or other sensitive data in the chat. If, despite this request, you voluntarily send such information, it may be processed only technically, to the extent needed to handle that message, based on your explicit consent (Art. 9(2)(a) GDPR).
3. Booking via Booksy
The booking buttons take you to the external Booksy system. Booksy is a separate data controller operating under its own privacy policy - that is where you enter your data, and our website neither collects nor stores it.
4. AI assistant
The site features a virtual AI assistant that helps you find information about Studio AP’s offer. The user is informed that they are interacting with an AI system, not a human. The assistant does not make binding decisions, does not qualify users for treatments and does not replace contact with salon staff.
To generate a reply, the content of your message may be sent to the actively configured AI providers: Google Gemini. This covers models generating replies and auxiliary tools, if used to handle the conversation, such as knowledge-base search. We transfer the content solely to generate the reply, and each provider processes it in accordance with its own data processing terms.
If you use voice features, speech is converted to text (and, in read-aloud mode, text to speech) by the voice services (Web Speech API). Depending on the settings, this happens in the browser or at an external provider to which the audio is sent. The chat interface shows the recognised text, and our service does not permanently store the raw voice recording.
The transcript becomes part of the chat message only if you send it. Conversation history in the browser is session-based and disappears after the session ends. The rules of using the assistant are described in a separate “AI assistant terms of use” document.
5. Technology providers and data transfers
Depending on which features you use, data may be disclosed or entrusted to:
- the hosting provider whose servers run the website,
- actively configured AI providers: Google Gemini,
- the voice services - when you use the assistant’s voice features: Web Speech API,
- Google - when you consent to loading the Google map or go to Google Maps.
Some AI providers may process data outside the European Economic Area, including in the USA. In such cases, safeguards required by the GDPR are used (e.g. an adequacy decision or standard contractual clauses); on request we will indicate the safeguards applied.
6. Cookies and browser storage
We use cookies and browser storage so the website works correctly, remembers your choices and can safely operate the AI assistant. Necessary technologies work without consent. External content, such as the Google map, is launched only after your consent. You can change settings in the footer via the “Privacy settings” link.
Necessary website operation
- Privacy settings - remembering your choice about external content so we do not ask on every visit. Technical name:
sap_consent. Duration: up to 1 year. - Site language - displaying the site in the selected language. Technical name:
pll_language. Duration: usually up to 1 year.
AI assistant
- Conversation identifier - request limits and abuse protection. Technical name:
chatbot_user_id. Duration: up to 1 year. - Current conversation history - keeping context during one session. Technical name:
chatbot_historyin browser session storage. Duration: until the session ends. - Widget state - remembering whether the assistant was open or full screen. Technical names:
chatbot_open,chatbot_fullscreen. Duration: until the session ends. - Assistant preferences - e.g. sound mute or dismissed assistant notice. Duration: until changed in the browser.
- Consent to voice features - remembering confirmation of microphone use. Technical name:
chatbot_voice_consent. Duration: until changed in the browser.
Site preferences and external content
- Site appearance preferences - e.g. list display mode or collapsed quick-contact bar. Duration: until changed in the browser.
- Google map - loaded only after consent to external content. Once launched, Google may use its own cookies and similar technologies under its privacy policy.
7. How long we keep data
- Server logs at the hosting provider - for the period the provider applies for technical and security purposes.
- Assistant error logs - without the content of questions and answers; deleted automatically after 30 days.
- Conversation history in the browser - only until the end of the session.
- Voice data - our service does not permanently store raw recordings; speech recognition and synthesis are handled by the voice services (Web Speech API) under their own rules, and only the text you send in the chat becomes part of the message.
- Cookies and browser storage - for the periods indicated in section 6 or until removed in browser settings.
8. Your rights
You have the right to: access your data, rectify it, erase it, restrict processing, object, data portability and - where processing is based on consent - withdraw that consent at any time without affecting the lawfulness of prior processing.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland.
9. Voluntariness and no profiling
Using the website and the assistant is voluntary. We do not make decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you. We do not use the assistant for biometric identification, emotion recognition or health assessment.
10. Changes to this policy and contact
We may update this policy when the law, AI assistant configuration, technology providers or the way the site operates changes. The current version is always available on this page.
For data protection matters, contact us at anna.przetaczek@gmail.com.