Privacy Policy

Last updated: 24 June 2026. How 4Luts handles your personal data under the GDPR (RODO).

1. Data controller

The controller of your personal data is Maciej Gałązka, operating the brand 4Luts, ul. Michaliny Szczepankowskiej 27, 05-300 Mińsk Mazowiecki, Poland. Contact: 4luts.contact@gmail.com. We collect very little data (see below); payment data is handled by our Merchant of Record, not by us.

2. What we collect

• Contact data — the email address and message you send us, or your email if you subscribe to updates.
• Technical data — standard server logs (IP, browser, time) collected by our hosting provider for security and reliability.
• Payment data — we do not see or store your card details. Payments are processed by our Merchant of Record (Lemon Squeezy), who acts as an independent controller for the checkout.

3. Purposes & legal bases

• To deliver the product and provide support — performance of a contract (Art. 6(1)(b) GDPR).
• To run and secure the website — our legitimate interest (Art. 6(1)(f)).
• To send marketing emails (only if you opt in) — your consent (Art. 6(1)(a)), withdrawable at any time.

4. Who we share data with (processors)

• Merchant of Record / checkout: Lemon Squeezy — payment, invoicing, tax, delivery.
• Hosting: Vercel (Vercel Inc.).
• Advertising measurement: Meta Platforms Ireland Ltd. (Meta Pixel), only with your consent.
• Fonts: Google Fonts (Google LLC, USA). Loading fonts may transfer your IP address to Google; we plan to self-host them to remove this transfer.

5. Cookies & tracking

We use the Meta (Facebook) Pixel to measure the performance of our ads. It is loaded only after you give consent in the cookie banner, and you can decline. If you decline, no advertising or tracking cookies are set. The Pixel may transfer data to Meta Platforms Ireland Ltd., which acts as an independent controller for that processing. The checkout (Lemon Squeezy) may set its own cookies governed by its privacy policy.

6. International transfers

Some providers may process data outside the EEA. Where they do, transfers are covered by appropriate safeguards such as the EU Standard Contractual Clauses.

7. Retention

We keep contact and order-related data only as long as necessary for the purpose collected and to meet legal/accounting obligations, then delete or anonymise it.

8. Your rights

You have the right to access, rectify, erase, restrict or object to processing of your data, and to data portability. You may withdraw consent at any time. To exercise any right, email 4luts.contact@gmail.com. You also have the right to lodge a complaint with the Polish supervisory authority (Prezes UODO, uodo.gov.pl) or your local authority.