Privacy policy
This notice explains how KReative Studio processes limited website, correspondence and product-notification data under the GDPR and applicable Polish electronic-communications rules.
1. Data controller
The controller of your personal data is Kamil Rzeczkowski, operating the KReative Studio brand in Poland. Privacy enquiries and requests concerning your data can be sent to contact@kr-studio.com.
2. Data we process
When you visit the site, Cloudflare may process standard connection and security data such as your IP address, browser and device information, requested URL, request time and diagnostic events. When you request a launch notification, we process your email address, selected product, subscription status, consent and confirmation timestamps, the applicable privacy-policy version and a hashed confirmation token. For abuse prevention, a one-way hash derived from the requesting IP address is stored temporarily; KReative Studio does not store the raw IP address in the mailing database. If you contact us, we process the information included in your correspondence.
3. Browser storage and analytics
KReative Studio does not currently set optional analytics, advertising or behavioural-tracking cookies. The site uses first-party local storage for a few functional preferences: that this notice was acknowledged, the language you chose, that you have seen the opening intro on this device and, once you use the KReative EQ demo on its product page, that demo's view settings. These preferences are not used to identify you across services and can be removed by clearing this site's browser data.
4. Purposes and legal bases
Technical and anti-abuse data is processed to deliver, maintain and protect the website and mailing service on the basis of our legitimate interests under Article 6(1)(f) GDPR. Correspondence is processed to answer enquiries, provide support, take requested pre-contractual steps or pursue legitimate business interests under Article 6(1)(b) or 6(1)(f) GDPR, as applicable. A product launch notification is sent only after double opt-in confirmation and on the basis of your consent under Article 6(1)(a) GDPR and Article 398 of the Polish Electronic Communications Law. Consent can be withdrawn at any time without affecting processing carried out before withdrawal.
5. Voluntary data and communications
Providing an email address and consent is voluntary. If you do not provide them, you will not receive the requested launch notification. The notification list is product-specific: it is not a general newsletter and is not used for unrelated marketing. You can withdraw consent before the launch message is sent by writing to contact@kr-studio.com.
6. Recipients and processors
Cloudflare provides website delivery, security, Worker execution and D1 database services. Resend receives the email address and message-delivery data needed to send confirmation and launch messages. Walkthrough videos are embedded from YouTube in privacy-enhanced mode (youtube-nocookie.com) and load only after you press play; from that moment Google processes data under its own privacy terms. Data may also be disclosed to professional advisers or public authorities where required by law. Product and support links may lead to independent services, including Buy Me a Coffee, which apply their own privacy terms. KReative Studio does not sell personal data.
7. International data transfers
Cloudflare and Resend are providers established in the United States and may process data in the United States or other countries outside the European Economic Area; the same applies to Google when you play an embedded video. Where Chapter V GDPR applies, transfers are made using safeguards made available by those providers, including the European Commission's Standard Contractual Clauses where applicable. Their current data-processing terms are available in the Cloudflare DPA and Resend DPA.
8. Retention
Browser preferences remain until the relevant browser storage is cleared. Rate-limit hashes are deleted after 24 hours. Confirmation links expire after 24 hours, and expired unconfirmed requests are removed by the next daily cleanup. Confirmed addresses are retained until the requested launch notification is sent, the product is cancelled or consent is withdrawn. Unsubscribed records are removed after a short operational period of up to 30 days. Correspondence is retained only as long as needed to handle the matter and meet applicable legal or record-keeping obligations.
9. Your GDPR rights
Subject to the conditions in the GDPR, you may request access to your data, rectification, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time. You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO). To exercise your rights, contact contact@kr-studio.com.
10. Automated decisions and policy changes
KReative Studio does not use the data described here for automated decision-making or profiling. This policy may be updated when the site, providers or legal requirements change. The current version and update date are shown below.
Version 2026-10-09 · last updated October 9, 2026
Back to the studio