Privacy policy

Who we are

The controller of your personal data is MOUNTS.AI spółka z ograniczoną odpowiedzialnością, ul. Jarosława Dąbrowskiego 86 lok. 91, 02-571 Warszawa, Poland, entered in the Register of Entrepreneurs of the National Court Register (KRS) under number 0001149648, NIP 5214101764, REGON 540666749.

For anything about your data, write to hello@mounts.ai. We have not appointed a data protection officer (the law does not require it for a company of our size and activity).

In short

• We collect only what you give us in the contact form or the chat, plus the technical minimum needed to run and protect the site.
• We use it to reply to you and to talk about a possible project. We don’t sell it and don’t use it for advertising.
• Conversations and messages are deleted automatically after 12 months.
• The site has one strictly necessary cookie (for the chat) and no analytics or marketing cookies.

Contact form

What: name, email, and, if you add them, company and phone; the message; the page language; the date; a salted hash of your IP address (we do not keep the IP itself).

Why and on what basis:

• to reply to you and, if you want, prepare an offer: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR);
• to protect the form against spam and abuse (rate limits, the IP hash): our legitimate interest (Art. 6(1)(f) GDPR).

How long: 12 months from sending, then deleted automatically. If we start working together, the data needed for the contract is kept for as long as the contract and the law (e.g. accounting rules) require.

AI chat

What: your email address; the content of the conversation (your questions and the assistant’s answers); an automatically generated summary of the conversation; the language; session times; a salted hash of your IP address. To enforce the question limit we keep a hash of your email address with a counter.

Why and on what basis:

• to answer your questions and pass the conversation to our team, so that we can get back to you: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR);
• to protect the chat against abuse and to limit costs (question limits per email and per IP address, temporary blocks): our legitimate interest (Art. 6(1)(f) GDPR).

How long: the conversation and its summary 12 months, then deleted automatically. Question counters until the end of their 48-hour window, temporary blocks for up to 24 hours.

About the assistant: you are talking to an AI system (Google Gemini on Vertex AI, run in the European Union). Its answers are generated automatically, may contain mistakes and are not an offer; a person from our team reads the conversation before getting back to you. Google does not use the content of the conversations to train its models. Please don’t share sensitive personal data (e.g. health data) in the chat: describe the business problem in general terms and we’ll take the details by email.

Emails

• Confirmations we send (after the form or the chat) always use fixed templates and go out through Brevo. A record of each email (recipient and delivery status) is kept for up to 30 days.
• Emails you send us (e.g. to hello@mounts.ai) are delivered to our team’s mailbox at Google (Gmail). We keep them for as long as the conversation or the cooperation needs, on the same legal bases as above.

Visiting the site

The site is served and protected by Cloudflare. To deliver the pages and keep them safe, Cloudflare processes technical data such as your IP address, browser type and the addresses you open (our legitimate interest, Art. 6(1)(f) GDPR). Before the chat or a form sends anything, Cloudflare Turnstile checks that you are a person and not a bot, without a puzzle in most cases.

If we measure traffic, we use Cloudflare Web Analytics, which does not use cookies and does not identify individual visitors.

Links to LinkedIn lead to a service with its own privacy policy.

Cookies and browser storage

• Chat session cookie: set only when you start the chat; it keeps your conversation going, is available only to the chat (it is not readable by scripts on the page) and expires after 24 hours. It is strictly necessary for the chat to work, so it does not need consent.
• Theme preference: if you switch between the light and the dark theme, your browser remembers the choice in its local storage. It never leaves your device.
• No analytics, advertising or tracking cookies.

Who processes the data for us

We use these providers, each under a data processing agreement:

• Google Cloud (Google Cloud EMEA Limited): the backend servers in Warsaw, the database in the European Union and the AI model on Vertex AI in the European Union.
• Cloudflare, Inc.: hosting and delivery of the site, DNS, bot protection (Turnstile), email routing and traffic statistics.
• Brevo (Sendinblue SAS, France): sending confirmation emails.

Personal data may also be disclosed to authorities when the law requires it.

Transfers outside the European Economic Area

We keep the data we store in the European Union. Cloudflare operates a global network and is a US company, and Google belongs to a US group, so data may be processed outside the EEA. Such transfers rely on the EU-US Data Privacy Framework (both companies are certified) or on the Standard Contractual Clauses approved by the European Commission.

Automated decisions

We do not make decisions about you based solely on automated processing and we do not profile you. The chat answers questions automatically, but every decision about cooperation is made by people.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to object to processing based on our legitimate interest, and to receive your data in a portable format. Write to hello@mounts.ai; we reply within one month.

You also have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

Is giving the data required?

No. But without an email address we can’t reply to your message or start the chat.

Security

The connection to the site is encrypted, the database is accessible only to our backend, we keep IP addresses only as salted hashes, and we do not write email addresses or message content to technical logs.

Changes

When we change how we process data, we update this page and the date at the top.