This policy explains what data Warmvane (“we”, “the service”) collects, why, and how we protect it.
Note: Warmvane is sold to the Polish market and the Polish-language version of this policy is the binding one. This English text is provided for convenience only; in case of any discrepancy the Polish version prevails.
Who we are
The service is operated by Tomasz Matusiak, an individual based in Poland (“we”, “the operator”). We act as the data controller for your account data and as a processor for the prospect data you upload. You can reach us at tomasz.matusiak@post.pl or by post at: Tomasz Matusiak, Przygraniczna 21A, 80-298 Czaple, Poland. The operator provides the service as a natural person under Polish law. We have not appointed a Data Protection Officer, as our processing does not meet the thresholds under Article 37 GDPR that would require one; the operator named above is your contact for all data-protection matters.
What we collect
- Account data — the email address of the account provisioned for you, and your offer profile (product description, tone, language settings).
- Prospect data you upload — names, companies, email addresses, LinkedIn URLs, and any notes you add to prospects and campaigns.
- Generated content — the research summaries and message drafts the service produces for your prospects.
- Usage data — basic operational logs needed to run the service securely (sign-in events, job status, feature usage).
How we use it
- To research the companies and contacts you import, using web search.
- To generate personalized message sequences in your voice.
- To operate, secure, and support your account.
Our research draws only on information that is publicly available on the web about a prospect’s company and, where you provide a LinkedIn URL, publicly available professional information found through web search. We do not log in to, scrape, or access private or password-protected areas of LinkedIn or any other platform.
We do not sell your data or your prospects’ data, and we do not use it to train third-party models beyond what is required to generate your drafts. The service never sends messages on your behalf — every message is sent by you, from your own inbox.
Legal basis for processing
We process your account data to provide the service you signed up for (Article 6(1)(b) GDPR — performance of a contract) and to keep it secure (Article 6(1)(f) — our legitimate interest in running a safe service). We process the prospect data you upload on your behalf and under your instructions, as your processor; you are responsible for the legal basis that covers that data. Where the law requires it, we also process data to meet our legal obligations (Article 6(1)(c)).
Where your data is processed
Your account and prospect data are stored on Supabase in the United Kingdom (London, eu-west-2 region). The United Kingdom is covered by a European Commission adequacy decision, so transfers there from the EEA are permitted. To research prospects and generate drafts, relevant content is also processed by our AI sub-processor in the United States (see international transfers below). Our current sub-processors are:
- Supabase — database, authentication, and hosting (United Kingdom).
- Anthropic — the AI models used for research and message generation, including web search (United States).
- Vercel — application hosting and content delivery (United States, with EU edge locations).
- Autopay — online payment operator: BLIK and instant bank transfers (Poland, European Union).
- PostHog — product and website analytics, hosted in the European Union.
International transfers
When the AI researches a company or drafts a message, the relevant content is sent to Anthropic in the United States. Where personal data is transferred outside the EEA or the UK, we rely on an adequacy decision — including the EU-US Data Privacy Framework where the recipient is certified under it — or on appropriate safeguards such as the European Commission’s Standard Contractual Clauses together with the provider’s data-processing terms, and we limit the data shared to what is needed to produce your research and drafts.
Payments
Online payments are handled by the payment operator Autopay (BLIK, instant transfer). Autopay processes your payment details directly under its own privacy policy — we do not receive or store your full card details or banking credentials. We receive only what we need to activate and manage your access, such as your email address and the status and amount of your order.
Your responsibilities for prospect data
You decide which prospects to upload and remain responsible for having a lawful basis to process their personal data under applicable law (for example, the GDPR). In data-protection terms, you act as the controller of that data and we act as a processor acting on your instructions.
Retention
We keep your account and prospect data for as long as your account is active. When your account is deleted — at your request or on termination — your account data, prospect data, generated content, and usage records are removed from our production database immediately, as a single cascading deletion. Residual copies may persist in our hosting sub-processor’s encrypted backups for up to 30 days before being rotated out. Operational and security logs that do not identify your prospects are retained for up to 12 months. Billing records (such as receipts and the sales ledger) are retained by us for the period required by tax law.
Your rights
Depending on your location, you may have the right to access, correct, delete, export, or object to the processing of your personal data, and to withdraw consent where processing is based on consent. To exercise any of these, contact us at the address on our contact page. Where we act as a processor for prospect data you uploaded, we will forward or refer such requests to you as the controller. You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO).
Analytics and cookies
The app uses essential cookies to keep you signed in and to remember your language preference (English or Polish). We do not use advertising cookies.
We also use PostHog (hosted in the European Union) to understand how the website and app are used — for example pages viewed, clicks, approximate location and device type, and whether visitors return — so we can improve the product. Analytics runs only after you accept it in the cookie banner (Article 6(1)(a) GDPR — consent); until then no analytics identifiers are stored. You can decline in the banner with one click, and withdraw consent at any time by clearing the wv_consent cookie or contacting us. We host analytics in the EU, do not sell this data, and do not use it for advertising.
The cookies and browser storage we use:
| Name | Provider | Purpose | Duration | Category |
|---|---|---|---|---|
| sb-*-auth-token | Supabase (us) | Keeps you signed in | Session / refresh | Essential |
| locale | Warmvane | Remembers your language (EN/PL) | 1 year | Essential |
| wv_consent | Warmvane | Stores your cookie choice | 1 year | Essential |
| ph_* (localStorage) | PostHog (EU) | Product analytics — set only after consent | Up to 1 year | Analytics |
Data breaches
We keep reasonable technical and organizational measures in place to protect your data. If a personal-data breach occurs that is likely to result in a risk to people’s rights, we will notify the relevant supervisory authority and any affected users without undue delay, in line with Articles 33 and 34 GDPR.
Changes
We may update this policy as the product evolves. Material changes will be reflected by the “last updated” date above.
Contact
Questions about privacy? Reach us via our contact page.