Privacy policy

Who is responsible

MTeam operates mteam.org and processes the personal data you leave on it. For privacy requests write to [email protected].

A project contract is concluded with a company in the United States or a company in Poland. That company’s name is in the contract and on the invoice. This policy describes the website. The terms of a particular contract do not replace it.

What this policy covers

It covers mteam.org and the “Start a project” form. It does not describe products we build for clients. Those products have their own rules.

What we process

From the form we keep what you type, plus a few technical fields we need to protect the form and tie a request to a visit. Phone and comment are optional. We cannot accept a request without a name and an email address. We do not ask for a card number on this site.

• Project name, selected categories, name, phone if you give one, email address and comment.
• The time you gave consent, and the language of the form.
• The landing page, the page you came from, and UTM tags if the link had them.
• Your IP address. It limits how many requests one source can send.
• The time zone, browser identifier (User-Agent) and language header sent by your browser. The time zone lets the confirmation email show the request time in your zone. These are stored with the request and deleted with it.
• A hash of the email-confirmation link. The link itself is not stored. The hash lasts 7 days.

Why, and the legal basis

We process the request so we can reply and prepare for a contract. The basis is GDPR Article 6(1)(b) (steps you asked for before a contract) and Article 6(1)(a) (the consent you tick in the form). You can withdraw consent at any time. Withdrawal does not affect processing that was lawful before the withdrawal.

The IP address, the limit on how often the form can be sent, and the Cloudflare Turnstile check stop automated submissions. Source tags show which page a request came from. The basis is Article 6(1)(f), our legitimate interest. We do not build advertising profiles, and we do not make decisions about you by automated means alone.

If a contract is signed and the law requires us to keep invoices and accounting records, the basis is Article 6(1)(c).

Cookies

The site sets one first-party cookie, hub_attr, for 30 days, and only on the first visit. It stores the landing page, the referrer, UTM tags and the time of that first visit. It is not used for advertising. You can delete or block it in your browser. The form still sends. We then cannot see where the visit came from. The site sets no other cookies.

Who receives the data

The MTeam team that handles requests sees the submission. Beyond that, data goes only to the services we need to deliver email, stop spam or take payment on an invoice. We do not sell personal data and we do not share it for behavioral advertising.

• Resend delivers the address-confirmation email to you and the notice to [email protected].
• Cloudflare Turnstile checks that a person sent the form. Cloudflare may process the IP address and browser signals under its own rules. We keep the result of the check, not the token.
• Stripe processes a payment only if you pay an invoice by card. The card number stays with Stripe. We see the payment status, the amount and the currency.

Transfers outside the EEA

Resend, Cloudflare and Stripe may process data outside the European Economic Area. Such a transfer relies on GDPR Chapter V: a European Commission adequacy decision, or standard contractual clauses.

How long we keep it

We keep the request while the project conversation is open, and for no longer than three years after the last contact. We delete it sooner if you ask and the law does not require us to keep the record — for example invoices after a signed contract. The cookie expires after 30 days. We delete the confirmation-link hash after 7 days. The IP address is stored with the request and deleted with it.

Your rights

If the GDPR applies to you, you can ask for access, correction, deletion, restriction or portability, object to processing based on legitimate interest, and withdraw consent. Write to [email protected]. We may ask you to confirm that the request is yours. Using these rights does not worsen the service.

You may lodge a complaint with the supervisory authority in your country of residence in the EEA. If the contract is with the company in Poland, that authority is the President of the Personal Data Protection Office (UODO).

If you live in California, the California Consumer Privacy Act, as amended by the CPRA, gives you the right to know what we process, to ask us to delete or correct it, and to know that we do not sell personal information or share it for cross-context behavioral advertising as those terms are used in that law. Send the request to [email protected]. We do not deny the service because you use these rights.

Children

The site is for companies. We do not knowingly collect data from children under 16. If such a request reaches us, we delete it.

Changes

When this policy changes, we update the date at the top of the page. The version published on the site is the one that applies.