Privacy policy

1. Who is the controller

The controller of the data is Krzysztof Głuszczyk (Creatiwi AI), NIP (tax id) 9542715800. I state my business address and phone number in the quote, before the contract is concluded. For anything about personal data, write to orders@bipsclub.com.

2. What data I process and why

For both kinds of inquiry, I process the contact person's first and last name, e-mail address, kind of inquiry, selected animal and its description if another animal was selected, confirmation of having read the privacy policy, and the language of the page from which the form was sent. You can also provide the name of an institution or company and a comment. For a film inquiry, I also process the selected language and its description if another language was selected, the age group or the information that you are asking for help choosing it, the kind of voice, and an optional group name. If you choose your own voice, I also process your confirmation that you know the written consent of the owner of the voice must be obtained before work starts. For an inquiry about stickers only, you can also provide the number of stickers. The form also contains a hidden field used to detect automated submissions; if it is filled in, an inquiry sent through the site is not passed on to me. This applies to sending through the site: a message prepared in a mail program (the fallback option) bypasses these protections.

I use it to answer the inquiry and, if an order follows, to carry it out. I also use it to handle correspondence, to protect the site against abuse, and to defend against claims or pursue them.

If you inquire about an order for yourself, I process the data necessary to prepare an offer at your request and perform the contract concluded with you under Article 6(1)(b) GDPR. If you contact me on behalf of an institution, company or another person, the legal basis for processing your contact details is Article 6(1)(f) GDPR, and my legitimate interest is handling correspondence and that entity's order. On the same basis, I process the data necessary to protect the site against abuse and to establish, pursue or defend claims. I process the data necessary to meet tax and accounting obligations under Article 6(1)(c) GDPR. The field confirming that you have read the privacy policy confirms that you have read it; it is neither consent to data processing nor the legal basis for that processing.

Giving the data is voluntary. Without a name and an e-mail address, though, I cannot answer the inquiry.

3. What the form does not collect

The form does not ask for data about children. The group name field is meant for a name for the whole group, for example “Pszczółki”. Please do not enter children's first names or any other information that could identify a particular child in any field. The form does not automatically detect such data in the text entered.

The form accepts no files and no recordings, voice samples included.

A voice sample, voice model and narration that allows a person to be identified may be that person's personal data. A voice is not automatically special category data: Article 9 GDPR concerns biometric data processed for the purpose of uniquely identifying a person. Before choosing the technology, I assess whether this is the case. I base cloning and use of the voice in the agreed film on separate consent from the owner of the voice under Article 6(1)(a) GDPR and, if the processing falls under Article 9 GDPR, also on their explicit consent under Article 9(2)(a) GDPR. After the quote, but before the consent is signed and I receive the sample, I give the owner of the voice information complying with Article 13 GDPR: who processes the data, what data is processed and for what purpose, on what legal basis, with whom it is shared, in which countries, with what transfer safeguards and how to obtain a copy of them, how long the data is kept, what rights the person has and how to withdraw consent. I give the name of the speech synthesis provider, which may operate outside the European Economic Area, and its data deletion rules. You hand over the sample only after I have received the signed consent, through a link I send for encrypted file sharing with a limited validity period. I delete the sample and model within 30 days after the ordering party receives the film, and without undue delay after consent is withdrawn. The adult owner of the voice must sign personally; consent from an institution or supervisor does not replace their signature. An employee must have a genuine opportunity to refuse and withdraw consent without pressure or adverse consequences at work. The film can be ordered with the author's voice or a library voice. If there are doubts about whether consent is freely given, I do not use the employee's voice.

4. Where the data goes and who sees it

The message from the form goes to the controller's e-mail inbox. The code of the site does not save the form data in a database or in its own logs. The data exists in the message that was sent and in the copies the mail provider keeps. It also exists in the logs of Cloudflare's mail services (more on that below) and in my correspondence with you.

The recipients of the data are Cloudflare, Inc. and my mailbox provider. Cloudflare provides hosting and sends messages from the form; it receives and forwards mail addressed to orders@bipsclub.com through Email Routing, including mail sent from an e-mail program instead of the form. When handling the connection, it may process the IP address and request headers. According to Cloudflare's documentation dated 15 October 2026, the Activity log covers mail sending and forwarding events, SPF, DKIM and DMARC results, responses from the recipient's server, delivery attempts and timing, rejection reasons and final status. Related event data also includes the sender, recipient, subject and message identifier. The Activity log description (opens in a new tab) does not give a separate retention period for that log; the filter's date range is not a retention period. The metrics and analytics documentation (opens in a new tab) gives a retention period of 31 days for data in the datasets described there, including individual event data available in the Activity log. This does not establish a deletion deadline for all of the provider's internal logs or copies. Message content previews for outgoing messages are disabled for the sender's domain; the documentation gives a retention period of about seven days for previews of messages sent while the feature is enabled.

To protect the form and mailbox against abuse, I use a Cloudflare Rate Limiting counter under Article 6(1)(f) GDPR. My legitimate interest is the security and availability of these services. The counter uses a SHA-256 hash of the IP address, which I still treat as personal data, and contains no inquiry content. It is set to five attempts within a 60-second window; counting is approximate and takes place separately at Cloudflare locations. The 60-second window does not mean that the provider deletes the counter's state after that time. The documentation for this mechanism (opens in a new tab) gives no deadline for deleting that state, so I do not state a specific retention period for it. My code does not save a separate copy of the counter or its key. The counter covers only sending through the site; a message prepared in a mail program bypasses it.

Cloudflare, Inc. and mail providers may process data outside the European Economic Area. In Section 6 of its data processing agreement (opens in a new tab), Cloudflare describes transfers under the EU-US Data Privacy Framework and the use of the European Commission's standard contractual clauses where a transfer requires such safeguards. This is information from the provider, rather than my confirmation of the current certification of a particular service. A transfer may be based on a European Commission adequacy decision, including the EU-US Data Privacy Framework only for a recipient with a current listing covering the transfer in question, or on standard contractual clauses together with an assessment of protection in the recipient's country and additional safeguards if needed. Merely using a US provider or confirming that the policy has been read does not provide such a basis. I establish the transfer basis separately for the actual provider of each mailbox receiving messages. You can obtain information about the safeguards used and a copy of them, or instructions on how to obtain one, by writing to orders@bipsclub.com.

5. Analytics, cookies and outside resources

The site uses no analytics, no cookies and no tracking tools. Fonts, scripts, images and sounds load from the same site, with no outside servers.

The form does not use Cloudflare Turnstile. The page containing the form does not load that service's script or widget.

Links to YouTube, Wikimedia Commons, Creative Commons, Teachable Machine, Creatiwi.ai and Buy Me a Coffee open outside sites. Once you click, their own rules apply.

6. How long I keep the data

I keep the data from an inquiry for up to 12 months after the last contact about it. If an order follows, I keep the data as long as tax and accounting law requires and as long as claims can be pursued.

I delete voice samples and voice models within 30 days after the film is handed over to the ordering party.

7. Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing, and to object to processing based on legitimate interest. You also have the right to data portability where the law provides for it, and to withdraw consent at any time where processing rests on consent (for example for a voice sample).

To use these rights, write to orders@bipsclub.com. You can also lodge a complaint with the President of the Personal Data Protection Office in Poland (uodo.gov.pl) or with the supervisory authority in your own country.

8. Profiling and automated decisions

I do not profile people or make decisions about them based solely on automated processing that produce legal effects or similarly significantly affect them. The counter described above automatically limits how frequently inquiries can be sent, and the hidden field helps reject automated submissions.

9. Changes to this policy

I change the policy when the way the site works changes. The date of the current version is at the top.