Privacy Policy

Last updated: 5 July 2026

1. Who is responsible for your data

The controller of personal data processed through this website (prowny.com) is Miroslav Tichý, Žiar 144, 032 05 Žiar, Slovakia (“Prowny”, “we”, “us”).

For anything related to your personal data, contact us at [email protected]. We are a small operation — the person reading your message is the same person responsible for protecting your data.

2. What data we process, why, and on what legal basis

a) Project intake & contact (the “Start a project” form)

• Data: your name, work email, company name, and the information you choose to share about your project (industry, size, timeline, goals, stakeholders, notes).
• Purpose: to understand your inquiry, prepare for a discovery call, and respond with a proposal.
• Legal basis: taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
• Providing this data is voluntary — but without it we can't respond to your inquiry. There is no statutory obligation to provide it.

b) Email correspondence

• Data: your email address and the content of our correspondence.
• Purpose: answering your questions and communicating about a potential or ongoing engagement.
• Legal basis: pre-contractual steps (Art. 6(1)(b) GDPR) or our legitimate interest in business communication (Art. 6(1)(f) GDPR).

c) Technical operation of the website

• Data: IP address and technical request data processed transiently by our infrastructure provider (Cloudflare) to deliver the site, balance load and block attacks. We do not build visitor profiles from this data.
• Purpose: serving the website securely and reliably.
• Legal basis: our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR).

d) Anonymous traffic measurement

• We use Cloudflare Web Analytics, a privacy-first tool that works without cookies, without fingerprinting and without cross-site tracking, and does not collect personal data. It gives us aggregate numbers (page views, referrers, countries) — never individual visitor profiles.

3. Cookies and local storage

This website uses no tracking cookies and no advertising or analytics cookies — which is why you don't see a cookie banner. The only thing stored in your browser is a single technical flag in local storage (prowny_seen_intro) that prevents the homepage intro animation from replaying on every visit. It contains no personal data, is not shared with anyone, and never leaves your device. You can remove it at any time by clearing your browser's site data.

Should we ever introduce marketing or analytics cookies, we will ask for your consent first through a proper consent banner, as required by law.

4. Who has access to your data (recipients & processors)

We don't sell your data and we don't share it with anyone for marketing. Your data is handled by:

• Cloudflare, Inc. (USA/EU) — hosting, content delivery, security and cookieless analytics for this website, and routing of our email. Cloudflare processes data under the EU Standard Contractual Clauses and is certified under the EU–U.S. Data Privacy Framework.
• Cloudflare D1 database — storage of intake form submissions, on the same Cloudflare infrastructure as the website. For rate-limiting we store only a salted, irreversible hash — never your raw IP address.
• Anthropic PBC (USA) — AI-assisted analysis. We use Anthropic's Claude models via API to help analyse intake submissions and prepare project recommendations (see section 8). Anthropic acts as our processor under a Data Processing Addendum incorporating the EU Standard Contractual Clauses and does not use this data to train its models.
• Our own secure infrastructure (EU) — working documents, our project-knowledge systems and notification automation run on access-controlled systems operated directly by us in the EU.
• Google Ireland Ltd. (Google Workspace / Gmail) — our email provider and encrypted backup storage. Google is certified under the EU–U.S. Data Privacy Framework.

All processors are bound by data processing agreements and process your data only on our instructions.

5. Transfers outside the EU/EEA

We keep processing in the EU/EEA wherever possible. Where a provider (Cloudflare, Google) may process data in the United States, the transfer is safeguarded by an adequacy decision — the EU–U.S. Data Privacy Framework (Art. 45 GDPR) — and/or Standard Contractual Clauses (Art. 46 GDPR). Transfers to Anthropic are safeguarded by Standard Contractual Clauses incorporated in our data processing agreement.

6. How long we keep your data

• Intake submissions that don't lead to an engagement: deleted within 12 months of our last contact.
• Submissions that lead to an engagement: kept for the duration of the engagement and thereafter as required by statutory retention periods (accounting, tax and contract records).
• Email correspondence: kept as long as relevant for the business relationship, then deleted.

7. Your rights

Under the GDPR you have the right to:

• access your personal data and receive a copy (Art. 15),
• rectification of inaccurate or incomplete data (Art. 16),
• erasure (“right to be forgotten”, Art. 17),
• restriction of processing (Art. 18),
• data portability — receiving your data in a machine-readable format (Art. 20),
• object to processing based on our legitimate interest (Art. 21),
• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, email [email protected]. We respond within 30 days at the latest. We may ask you to verify your identity before acting on a request, to protect your data from unauthorised access.

You also have the right to lodge a complaint with a supervisory authority — in Slovakia, the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR, dataprotection.gov.sk), or the authority of your EU member state of residence.

If you are in the United Kingdom, the UK GDPR applies to our processing of your data and you may lodge a complaint with the Information Commissioner's Office ( ico.org.uk).

8. AI-assisted analysis — with a human in charge

To give you a fast, well-founded recommendation, we combine our own methodology engine — theProwny Recipe Engine — with AI tools (Anthropic's Claude). The engine scores your answers against established project-management frameworks using a rule-based model; AI assists with analysis and drafting. No decision about you or your project is made solely by automated means (Art. 22 GDPR) — every inquiry and every recommendation is reviewed and decided by your project partner, a human. Your data is never used to train AI models.

9. How we protect your data

All traffic to and from this website is encrypted (HTTPS/TLS). Form submissions are stored on access-controlled infrastructure, limited to the people who need them to respond to you. We collect only the data we actually need (data minimisation) and delete it when it's no longer needed.

10. Changes to this policy

If we change how we process personal data — for example by introducing new tools — we will update this policy and the “Last updated” date above before the change takes effect.