Privacy notice
What happens with the details you leave here
Controller. H2M sp. z o.o., ul. Partynicka 3B/7B, 53-031 Wrocław, Poland, KRS 0000642495, VAT ID PL5252680451. Contact: maksym@h2mai.com.
What is collected. What you type into the scoping-call form (email, optional phone, the time and the page). If you use the six-step request at /start: the brief, your name, email and phone, the call time you book, and, only if you choose to add them, a video or voice recording and the files you attach. Where the request came from (UTM parameters, a Google or Meta click id when present, the referring page) is stored with it so I know which page worked.
Payment. Nothing is paid on this site. After the scoping call you get an offer on its own link (h2mai.com/o/...); when you accept it, H2M records your name, email, the company's tax number if you give it, the time, your IP address and a hash of the offer document, as proof of the order. The audit and every later invoice are paid by bank transfer against an invoice from H2M sp. z o.o.
Booking a call. When you book a call (h2mai.com/book, step 05 of /start or the client panel): your name, email, company, what you want to solve, the company size where asked, the time, your time zone and where the visit came from (UTM parameters, a click id when present). They serve this call and the reply to it only; the basis is the steps you ask for before a contract (Art. 6(1)(b) GDPR). When H2M's Google Calendar is connected, Google, as H2M's processor, keeps the calendar event with your name and email as the guest, sends you the invitation and creates the Meet link. The link to move or cancel the call is stored only as a hash. Your IP address is kept with the request, and a hash of it serves the daily limit that stops automated bookings. Kept as a request: no longer than 12 months from the last exchange, unless we start working together.
Measurement. The site runs first-party analytics operated by H2M: page views and form events are written to a database under the H2M account (no third-party tracker receives them). Advertising or analytics tags from Google or Meta load only if you give consent in the cookie banner; without consent no third-party tracker runs.
Why, and on what basis. To reply to your request and arrange the scoping call. The legal basis is your consent (Art. 6(1)(a) GDPR), given by ticking the box next to the form; you can withdraw it at any time by writing to the address above, which does not affect processing done before the withdrawal.
How long. Until your request is closed, and no longer than 12 months from the last exchange, unless we start working together, in which case the details move to the contract file. Recordings and attachments are deleted with the request; you can ask for them to be deleted earlier at any time.
Who sees it. Only Maksym. The site is hosted on Cloudflare (edge network, EU and worldwide): requests are stored in a Cloudflare D1 database and recordings and files in a private Cloudflare R2 bucket, both under the H2M account. A summary of each request is relayed to a private message channel operated by H2M sp. z o.o., and a confirmation may be emailed to you through Resend, the transactional email provider listed below. Fonts are served from h2mai.com itself, so no font provider receives your IP address. No data is sold or shared for advertising.
Client panel. If your company works with H2M and you were invited to the client panel (h2mai.com/panel): your name, email, the company or training group you belong to and your role; what you send there (requests, messages, files, and vault items, which are encrypted in your browser and readable only by H2M); sign-in records; and, when you accept a quote or a project stage, your name, the time, your IP address and a hash of the document. The basis is the contract with your company (Art. 6(1)(b) and (f) GDPR). Kept while the account is active, then as long as the contract file and tax law require. Where H2M processes personal data on your company's behalf, the data processing agreement with your company applies.
Subprocessors. Cloudflare (hosting, database and file storage; EU and worldwide, standard contractual clauses). GitHub (code and the work items of client projects; USA, standard contractual clauses and the Data Privacy Framework). Resend (transactional email; USA, standard contractual clauses and the Data Privacy Framework). Google (“Sign in with Google” for the client panel, which shares your name, email and profile picture, and calendar invitations; EU and USA, Data Privacy Framework). Fakturownia (VAT invoices and their filing with the national e-invoicing system; Poland). SMSAPI (text messages; Poland). Anthropic (AI assistance in project and support work; USA, standard contractual clauses and the Data Privacy Framework). Fireflies (meeting notes) only for meetings where you agreed to it in writing. The list is updated before a new subprocessor starts; a client may object under its data processing agreement.
Your rights. Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent, by email to the address above. You can also complain to a data protection authority: the one where you live or work, or the one competent for H2M, the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.