Privacy Policy

1. Data controller

The controller of your personal data is Damian Walicki, trading as Damian Walicki Consulting, based in Rzeszów (Zbyszewskiego 9 lok. 42, 35-119 Rzeszów), registered in CEIDG (Polish business register), NIP (tax ID) 8133428095, REGON 388123012 (the “Controller”). We have not appointed a data protection officer. For matters concerning the protection of personal data, write to privacy@qerify.com; for other matters: support@qerify.com

2. What data we collect

• Account data: email address, password (stored as a hash), user role.
• Freelancer profile data: first name and surname, photo, bio, skills, tools, hourly rates.
• Freelancer identity document (KYC identity verification): we keep the scan of your document in secure storage only until the administrator makes a decision. After verification is complete, the file is permanently deleted and only the verification status remains in the system.
• Transaction data: information about contracts, work stages (milestones) and payments (processed through Stripe).
• Communication data: messages exchanged within contracts.
• Technical data: IP address, browser type, session cookies.
• AI data: the content of conversations with the AI Concierge and any brief you paste or upload as a file (PDF, DOCX, TXT). We delete them together with the conversation after 90 days. If the conversation includes a brief, in the last 5 days before deletion we will send you an email (if we know your address) and you can then extend the storage of the conversation by another 90 days, as many times as you need. A brief attached to an order with a Partner is kept together with the contract. When you ask for help with your profile or project description (“Write it for me”), the text you enter is sent to OpenAI only to prepare suggestions; we do not store it — only the text you insert into your profile and save yourself is stored. When you publish a project, its text (title, descriptions, tags, links and the client name, if you provide it) is checked automatically by the OpenAI moderation service; photos and screenshots are not sent there. If the check flags a possible problem or the service does not respond, a moderator reviews the project before it is published.
• Projects in your profile: the title, description, results, tools, links, photos and screenshots of the projects you publish in an expert, agency or team profile, as well as the cover, tagline and links in the header of an agency or team profile. Published content is visible to anyone, including visitors without an account, and may be indexed by search engines; only you can see drafts. We show a client name only if you enter it yourself and confirm that you may show it. On your first publication we record your declaration that you have the right to show the project (who, when, in which version). We also count views of project pages, without any data about the people viewing them. We delete a project and its files when you delete it or delete your account. Projects of an agency or team belong to it and remain after one member deletes their account, unless that person was its only member — then we delete them and anonymise the agency or team data (name, description, logo, cover, links).
• Content reports: when you report a project, we record the category and description of the report (if you add one), your email address (if you provide it) and your account identifier or — for a report without an account — a hash of your IP address, which lets us count different reporters and limit abuse. The author of the project does not receive your data. We delete the email address and the hash when a moderator makes a decision, and 24 months after the decision the report loses all data about the reporter.
• Response time: when a client sends an inquiry addressed to you by name as a provider (an invitation to a project, a trial task, a training inquiry, an implementation brief), we record the date of the inquiry and of your first reply — without the content of messages and without client data. From the last 90 days we calculate the median and, once there are at least 5 inquiries, we show an approximate indicator in your public profile (“Usually responds within…”). For agencies and teams we record the same data but do not show the indicator for now. We delete data older than 90 days every day, and when you delete your account the indicator and all events are removed as well.
• Reports and votes: when you send an error report, idea, initiative or question from the panel, we store its type, title and text, your account identifier, role and plan, the address of the page (without parameters) and a shortened browser name, and for an idea or initiative also the version and a hash of the text of the terms you saw next to the form (the hash makes it possible to show which text was displayed). We notify our support team of a new report by an e-mail containing only its type and number, a plan or role marker and a link to the panel, without the title, the text or your e-mail address. A message sent through the partner support form in the panel (/partner/support) goes to the e-mail inbox of our support team in full, together with the partner profile name and your account e-mail address; the retention period for such a message is 24 months. We show the reply and the case status only in the panel, as a notification; we do not send them by e-mail. We close a case that we have not published in “New features” automatically after 12 months without any activity (a vote does not count), and the retention period stated in section 5 runs from its closure. Do not enter passwords or your clients’ data in a report; if you enter data of another person, it is stored with the report. A report is visible to you and our team. Other users see only a description written by us, without your data and without the text of the report. When you vote for an item on the “New features” list, we store your account, role and the date of the vote; others see only the total number of votes. You can withdraw your vote; otherwise we keep it until the item or your account is deleted. A vote is neither an order nor a promise, and the controller decides the order of work. We handle error reports and questions because this is part of the service (Article 6(1)(b) GDPR). We analyse ideas, initiatives and votes, notify about the start and release of items in the panel, and keep a report after its case is closed on the basis of our legitimate interest, which is developing the service, setting the order of work, keeping voters informed of progress and accountability for handling cases (Article 6(1)(f) GDPR). You can object at any time: privacy@qerify.com.
• Data mentioned in another user’s report: if another user has mentioned your data in a report, we process it to the extent they provided it, in order to handle the case, on the basis of our legitimate interest (Article 6(1)(f) GDPR), for the period stated in section 5. We do not inform each such person separately, because we usually do not have their contact details (Article 14(5)(b) GDPR). You have the rights described in section 6; write to privacy@qerify.com.

Providing data is voluntary, but without account data you cannot create an account, and without the data needed for a contract you cannot conclude it through the Platform. You must provide invoice data because tax law requires it, and identity verification (KYC) is a condition for paying out funds.

3. Purposes and legal basis of processing

4. Data recipients

Your data may be disclosed to the following entities:

• Supabase Inc. — database hosting and authentication service (European Union (EU region)).
• Vercel Inc. — application hosting (United States).
• MXRoute LLC — sending transactional email (United States).
• OpenAI, L.L.C. — natural language processing and generation of vector representations (United States).
• Stripe, Inc. / Stripe Payments Europe Ltd. — processing of payments, payouts and identity verification (KYC) (Ireland and the United States).
• Cloudflare, Inc. — protection against automated traffic (bot protection) (United States).
• Hostinger International Ltd. — hosting of the server running the controller’s CRM system (Twenty, self-hosted instance) - handling of sales enquiries left in conversations with the AI Concierge and of B2B contacts (Germany (according to the RIPE address registry for the server)).
• Partners matched to the inquiry — separate controllers; they receive the description of the inquiry and, once the lead is unlocked, also the client’s brief, in order to prepare an offer (Poland).
• Polish National Revenue Administration (KSeF, JPK) — recipient of tax records under statutory provisions (Poland).
• The Controller’s accounting office — accounting and tax services (Poland).
• PostHog, Inc. — product analytics (United States).
• Functional Software, Inc. (Sentry) — application error monitoring (United States).
• Anthropic, PBC — AI tool supporting developers in maintaining and developing the Platform (access to data only when diagnosing and fixing errors) and analysing replies and preparing messages in B2B contact with company representatives (United States).
• Training providers publishing offers on the Platform — separate controllers: they receive the contact details and the text of a training inquiry in order to reply to it and prepare an offer (Poland).
• Platform visitors and internet search engines — content published in a public profile (projects, photos, response-time indicator) is visible to any visitor, including those without an account, and may be indexed by search engines (internet access, not limited to any country).
• Google Ireland Limited / Google LLC — e-mail of the controller (Google Workspace), used to send and receive B2B messages (Ireland and the United States).
• Apollo.io, Inc. — business data provider, the source of business contact details of company representatives and a tool for searching them (United States).
• Google Ireland Limited / Google LLC (Google Analytics) — visit statistics and measuring the effectiveness of marketing (Google Analytics 4), only after consent to analytics cookies; event data kept for 14 months (Ireland and the United States).
• Providers chosen by the client in an inquiry — separate controllers; they receive the name of the client, the inquiry text and the messages in the thread in order to respond and prepare a quote (Poland).

Data is transferred to the United States on the basis of the European Commission decision finding an adequate level of protection (EU-US Data Privacy Framework) for providers covered by it, and otherwise on the basis of standard contractual clauses; we will provide a copy of the safeguards on request: privacy@qerify.com. Exception: we are confirming the safeguard for the transfer of data to MXRoute LLC (e-mail) with the provider and will complete this information once it replies.

5. Data retention periods

The periods in the table below apply to data in the Platform database and are enforced automatically by a daily system task. When a period expires, the data is either permanently deleted or irreversibly anonymised. Once properly anonymised, a record is no longer personal data and may be kept as statistical or evidential material (e.g. the mere fact and outcome of a dispute, without the parties’ data). Data stored outside the Platform database is described below the table.

We delete raw page-view data in our own analytics after 90 days and keep only anonymous statistical aggregates. We do not delete invoices and accounting records on request: Article 17(3)(b) and (e) GDPR excludes the right to erasure because of tax obligations.

Data stored outside the Platform database (periods applied manually or by providers):

• We keep the data of the account you use (e-mail address, profile, settings) until the account is deleted. After deletion, only the data from the table above that we keep longer remains (e.g. invoices, contracts, messages in a contract), and it is deleted or anonymised within the periods stated there.
• Messages from the partner support form (/partner/support) are kept in our support team’s e-mail inbox at the e-mail provider; we keep them for 24 months from sending. The daily system task does not reach the inbox, so the messages are deleted manually by the administrator; from July 2028 the system reminds the administrator of this review every quarter.
• Technical logs containing IP addresses kept by the hosting provider (Vercel) and the form protection service (Cloudflare Turnstile) are stored by the provider for the period set in its service.
• Event data in Google Analytics 4 (only with consent to analytics files): 14 months, in line with the data retention setting in the service; the lifetime of the cookies is given on the Cookie Policy page.
• Error monitoring (Sentry) is currently disabled and does not receive your data.
• Product analytics (PostHog) is currently disabled and does not receive your data.

6. Your rights

Under the GDPR, you have the following rights:

• Right of access to your data (Article 15 GDPR)
• Right to rectification of your data (Article 16 GDPR)
• Right to erasure of your data (the “right to be forgotten”, Article 17 GDPR)
• Right to restriction of processing (Article 18 GDPR)
• Right to data portability (Article 20 GDPR)
• Right to withdraw consent at any time, without affecting the lawfulness of processing before its withdrawal (Article 7(3) GDPR); you can withdraw consent to cookies with the “Cookie preferences” button in the page footer, and other consents at privacy@qerify.com
• Right to lodge a complaint with the President of the Personal Data Protection Office (www.uodo.gov.pl)

Right to object (Article 21 GDPR): where we process your data on the basis of our legitimate interest (Article 6(1)(f) GDPR; we named the interest for each such purpose in section 3), you may object at any time on grounds relating to your particular situation. We will then stop processing that data unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims. We always honour an objection to processing for direct marketing. You can send your objection to privacy@qerify.com.

7. Cookies and similar technologies

We use cookies and browser storage (localStorage, sessionStorage) in three categories: necessary (e.g. the login session, the record of your choice in the cookie banner), functional (e.g. the selected language, the panel theme, an unfinished form) and analytics (Google Analytics, PostHog and the code from a referral link, which links you to the person who referred you when you register), which we store only with your consent given in the banner. We do not use advertising cookies. We also count visits without cookies, with Vercel Web Analytics and our own page view counter. The only complete list of these files, their providers and lifetimes is the Cookie Policy page. You can change or withdraw your consent to analytics files with the “Cookie preferences” button in the page footer.

8. Security

We apply appropriate technical and organisational measures: encrypted connections (TLS), passwords stored only as a cryptographic hash (bcrypt), database access control for each row separately (Row-Level Security), access to data only for people who need it, and regular security reviews.

9. Profiling and automated matching

Profiling is the automated evaluation of certain personal aspects of a person on the basis of their data (Article 4(4) GDPR). We use it in two places: when matching providers to a client’s project and when evaluating providers on the basis of their work on the Platform.

Matching providers to a project:

• The algorithm proposes up to 3 candidates from among freelancers, agencies and ready teams. We convert the project description and the profile descriptions into sequences of numbers that capture their meaning (a so-called embedding).
• The system compares these sequences and calculates how similar the project description is to the profile description (cosine similarity), and then combines this result with a fit score.
• The fit score takes into account the project category and tools, the budget compared with the rate, the provider’s availability and their Outcome Score (when they have at least 3 reviews). The order is also affected by: the provider’s Pro plan (a small boost), a new profile without reviews (at most one place in the top three) and a probation period after verification (a lowering).
• The result is a list of recommended candidates, not a hiring decision. The final choice of builder is always yours.

Evaluation of providers:

• Outcome Score: from the ratings given by clients after completed jobs we calculate an indicator of the quality of a provider’s work. It affects the order of proposals in matching (where newer ratings weigh more), the place in the public ranking of providers and the order in the catalogue when a client chooses to sort by Outcome Score.
• Response time: from the dates of inquiries and first replies we calculate the median for the last 90 days and show it in the expert’s profile (details in section 2). This indicator does not change the order of proposals in matching or the place in the ranking.

None of these evaluations is a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you: the matching result and the indicators are information for the client, and a provider is always chosen by a human. Therefore Article 22 GDPR does not apply here.

Your rights: You can opt out of automated matching at any time and ask our team to review candidates manually: write to privacy@qerify.com. You also have the right to an explanation of why the algorithm proposed particular candidates. As a provider, you can ask how we calculated your Outcome Score and object to profiling (section 6).

10. Trainings

Division of roles: Qerify is the controller of account, inquiry and booking data within the platform. The training provider processes contact data as a separate controller in order to deliver the service.

Scope of data: the training participant's first name, surname and email address; the contact details submitted in the enquiry or reservation request form (company name, contact person's first name and surname, email address, phone number); the content of the conversation thread with the Training Provider.

We send messages about an inquiry and booking to the contact address given in the form, not to your account address. This lets you reach a dedicated person at the company directly.

The training provider can see only the inquiries and participant lists of bookings it has confirmed itself - it has no access to other organizers' data.

The data of training participants is entered by the client, not by the participants themselves. When saving the list, the client declares that they have informed the persons concerned that their first name, last name and e-mail address will be passed to the training provider and how long the list is kept, and we record the version of this declaration. For this reason we do not send participants a separate message (Article 14(5)(a) GDPR). If you are a participant: we process your data to organise the training for which the client registered you, on the basis of our legitimate interest (Article 6(1)(f) GDPR), for the period stated in section 5, and you have the rights described in section 6.

The retention periods for enquiries, reservations, the participant list and abuse reports are in the table in Section 5 above.

11. Kontakt w sprawie współpracy B2B (art. 14 RODO)

Ta sekcja dotyczy osób, których służbowe dane kontaktowe pozyskaliśmy nie od nich samych: przedstawicieli firm, do których piszemy z propozycją współpracy (wykonawców automatyzacji, agencji, producentów, partnerów). Spełniamy w ten sposób obowiązek informacyjny z art. 14 RODO.

• Administrator: Damian Walicki, prowadzący działalność gospodarczą pod firmą Damian Walicki Consulting z siedzibą w Rzeszowie (Zbyszewskiego 9 lok. 42, 35-119 Rzeszów), wpisaną do Centralnej Ewidencji i Informacji o Działalności Gospodarczej (CEIDG), NIP 8133428095, REGON 388123012. Kontakt: privacy@qerify.com.
• Kategorie danych: imię, nazwisko, stanowisko, służbowy adres e-mail, służbowy telefon, nazwa i strona internetowa firmy, profil firmy lub osoby w serwisach biznesowych oraz informacje o działalności firmy opublikowane na jej stronie.
• Źródła danych: publicznie dostępne strony internetowe firm, publiczne rejestry (CEIDG, KRS) oraz baza danych biznesowych Apollo.io.
• Cel i podstawa prawna: przesłanie propozycji współpracy B2B i prowadzenie dalszej korespondencji, na podstawie prawnie uzasadnionego interesu administratora (art. 6 ust. 1 lit. f RODO), którym jest pozyskiwanie klientów i wykonawców dla platformy Qerify. Dodatkowo ustalenie, dochodzenie i obrona roszczeń (art. 6 ust. 1 lit. f RODO).
• Odbiorcy danych: dostawcy usług, którzy przetwarzają dane w naszym imieniu: Google (poczta Google Workspace), Apollo.io (baza danych biznesowych), Anthropic (analiza treści odpowiedzi i przygotowanie spersonalizowanej wiadomości) oraz Hostinger International Ltd. (serwer w Niemczech, na którym działa nasz system CRM).
• Przekazywanie poza EOG: Apollo.io, Anthropic i Google mogą przetwarzać dane w Stanach Zjednoczonych, na podstawie EU-US Data Privacy Framework albo standardowych klauzul umownych Komisji Europejskiej.
• Okres przechowywania: do czasu Twojego sprzeciwu, a jeśli nie odpowiesz na naszą wiadomość, nie dłużej niż 24 miesiące od ostatniego kontaktu z naszej strony. Po sprzeciwie zachowujemy wyłącznie adres e-mail na liście wykluczeń, żeby nie napisać do Ciebie ponownie.
• Twoje prawa: dostęp do danych, sprostowanie, usunięcie, ograniczenie przetwarzania oraz skarga do Prezesa Urzędu Ochrony Danych Osobowych (www.uodo.gov.pl).
• Sprzeciw i wypisanie się: w każdej chwili możesz sprzeciwić się przetwarzaniu swoich danych (art. 21 RODO); po sprzeciwie przestajemy do Ciebie pisać. Aby się wypisać, odpowiedz „wypisz” na otrzymaną wiadomość albo napisz na privacy@qerify.com.
• Automatyczna ocena: firmy klasyfikujemy automatycznie pod kątem dopasowania do oferty (np. branża, profil działalności). Nie podejmujemy na tej podstawie decyzji wywołujących skutki prawne wobec osób, więc art. 22 RODO nie ma zastosowania.