What this site collects
Last updated: 3 November 2026
Short version: an email address and the record that you gave it, used only to send what you asked for and the letter. If you buy The Working Files, Polar also passes me the order details, used only for that order. Beyond that, only page counts without cookies, a log of the emails sent, sign-in records for the library, server logs that rotate and are deleted, and error reports with a small sample of request timings. Nobody gets any of it for their own use.
Your email address
If you ask for the Proof Pack or the newsletter, I store your address, the date you gave it, and the IP address and browser string of that one request, which is the record that the consent was yours. The address also passes through Resend, the mail service that delivers the message, and sits in the backups described below; nobody gets it for their own use. I use it to send the files you asked for and, after that, a letter about business analysis when there is something worth sending. There is no schedule and no sequence waiting for you. Every letter carries a one-click unsubscribe link, and unsubscribing stops them; the only message without that link is the confirmation email, which is the one asking whether you wanted any of this. You can also write to hello@analify.com and ask me to delete everything I have about you - I will, and I will confirm it.
Giving the address is up to you, but without it I cannot send the files. The basis is your consent (Article 6(1)(a) GDPR). You can withdraw it at any time, by unsubscribing or by email, and that does not make what was sent before unlawful. I keep the record of your consent because I must be able to show it (Article 6(1)(c) GDPR, read with Article 7(1)).
How long: if you never click the confirmation link, the address and the record are deleted automatically after 30 days, together with the address's entries in the email log described below, unless the same address also has an Analify account or a purchase. While you are on the list, I keep both. When you unsubscribe, the letters stop and the address stays on file, marked as unsubscribed, with the record of your consent: that keeps me from writing to it again and lets me show what you agreed to (Article 6(1)(f) GDPR). If you want it gone entirely, ask, and I delete it. Each email this site sends is also logged with the address, the kind of message, the date and whether it went out, so that I can answer whether something reached you (Article 6(1)(f) GDPR). Resend counts clicks for my sending domain: links in these emails first pass through its redirect at links.analify.pl, and when Resend reports that a message was delivered or that a link in it was clicked, the log notes it against the address, on the same basis. Apart from the case above, the log has no automatic deletion; your entries go when you ask me to delete your data.
Purchases
The Working Files are sold by Polar Software, Inc., a US company acting as merchant of record. Polar takes the payment, works out the tax, issues the receipt and keeps the order under its own terms and privacy policy. I never see your card details. When Polar confirms an order, it passes this site your email address, the order identifier, Polar's customer identifier and what you bought, with the amount, and I keep that record so that the files can open for you here: it is what the sign-in link checks. Signing in sets one cookie, for this site only, that says the files are yours to read; it holds no name and nothing a third party could read. Each sign-in is recorded with the date, the kind of browser (for example "Firefox on Windows"), the network it came from, cut to its first three parts, never the full address, and the last time that browser opened the library (updated at most once an hour). That record keeps the library to three signed-in browsers at a time and shows me when one purchase is being signed in from many places. Signing out ends that sign-in, and a refund ends all of them. Each download is logged with the date, the file and the order it belongs to, so that I can see the files reached you and answer a question about an order. The sign-in link reaches you by email through Resend, the mail service this site uses, and the record lives on a server rented from OVH. Nobody else gets any of it for their own use, and buying does not put you on the newsletter. When a refund is issued, the access ends and the record is marked as refunded. You can ask me to delete the order record at any time, and I will; that also ends your access to the library.
The legal basis is the contract you enter into when you buy (Article 6(1)(b) GDPR), and the email address is part of it: without one there is no purchase and no way to send you the files. The sign-in records serve the same contract, a licence for one person, and my legitimate interest in keeping one purchase from being shared or misused (Article 6(1)(f) GDPR). If one purchase is signed in unusually often, or from several networks, within 24 hours, an alert reaches me through Sentry with the address masked (for example ab***@example.com) and the two counts. It blocks nothing.
How long: the order record, the sign-in records, the record of each emailed link (a fingerprint of the link, never the link itself, with its expiry, when it was used and the network it was used from, cut the same way) and the download log have no automatic deletion. I keep them together, also after a refund, until you ask me to delete them; then they go together, and your access with them. A request on the sign-in page is logged with the address typed in, also when there is no purchase for it, so that I can see the form being misused (Article 6(1)(f) GDPR), and it is kept the same way. Polar keeps its own record of the order as a separate controller, under its own privacy policy.
The buy buttons on the product page are links to Polar's checkout, and the ones in the online library lead to that page. Umami counts each click the way it counts a page view: without a cookie and without anything that identifies you.
Traffic measurement
I want to know which articles are read, so I count page views two ways, and both are cookie-less. Umami, running on my own server at analytics.analify.pl, records the page, the referrer, the country, region and city, the browser, the operating system, the device type, the screen size and the language, and clicks on a few marked links and buttons on The Working Files pages and on the links to those pages from the rest of this site. A click may carry a short label: where the link sits, or which document or file it belongs to. In the online library, marking a document as read and opening the search count the same way. It stores no IP address and sets no cookie. A second counter, built into this site, keeps nothing on file but the date and the path, and exists so the number survives when Umami is blocked or down; to keep the numbers honest, it holds your IP address in a short-lived counter for five minutes. Neither is used to identify you or to follow you to other sites, and nothing here is a Google, Meta or advertising pixel. Umami is software I host myself, and the statistics it stores stay on my server, apart from the backups described below. Its script and each count reach that server through Cloudflare, described under "Who else handles it".
The basis is my legitimate interest in knowing what is read (Article 6(1)(f) GDPR). The second counter keeps daily totals per page with no end date, because they say nothing about any reader. Umami has no automatic deletion either: I keep its statistics for as long as I use them to compare what is read over time.
Server logs and error reports
The web server records each request: the IP address, the page asked for, the browser string and the other headers the browser sends, such as its language. It writes them to files of up to 20 MB, keeps five closed files at most and deletes closed files older than 30 days. The application behind the sign-up form and the library keeps its own log, set to delete entries older than 30 days. Both are there for security and to find faults. To stop the forms being abused, a counter holds your IP address for up to ten minutes and your email address for an hour after the last attempt.
When something breaks in the code, an error report goes to Sentry: what failed, where in the code, on which page and with which request headers. Reports are sent without your IP address, without cookies and without what you typed into a form, and the codes carried by links and any email address in the page address are replaced by asterisks; one can still contain a piece of data the code was handling at that moment, such as an email address. About one request in twenty also goes to Sentry as a timing sample, to see how fast the site answers: the same request details, cleaned the same way, and how long each step took. Sentry deletes both after 30 or 90 days, depending on the plan. The basis for the logs, the counters, the error reports and the timing samples is my legitimate interest in keeping the site secure and working (Article 6(1)(f) GDPR).
Who else handles it
The server is rented from OVH (OVH SAS, a French company) and stands in Frankfurt, Germany. The database, Umami and the logs are kept there.
The statistics script and every count it sends pass through Cloudflare (Cloudflare, Inc., a US company), which sits in front of analytics.analify.pl and hands each request on to my server, so Cloudflare handles your IP address, browser string and the page being counted. The pages of this site do not go through Cloudflare. Cloudflare's data processing agreement, which its self-serve terms incorporate, relies on the EU-U.S. Data Privacy Framework, and on the EU standard contractual clauses if that certification lapses.
Emails go out through Resend (Plus Five Five, Inc., a US company). The domain they are sent from is set to Resend's EU region in Ireland, but Resend's data processing agreement says its main processing takes place in the United States. For transfers out of the EEA that agreement uses the EU standard contractual clauses, and in it Resend states that it complies with the EU-U.S. Data Privacy Framework.
Error reports go to Sentry (Functional Software, Inc., a US company), which stores them in its EU region in Frankfurt, Germany. Sentry states that it complies with the EU-U.S. Data Privacy Framework for transfers from Europe to the United States, and its data processing agreement falls back on the EU standard contractual clauses if that framework is invalidated or does not apply.
Backups of the database, made every six hours, are stored with Backblaze (Backblaze, Inc., a US company) in its EU Central region in Amsterdam, the Netherlands. The backup job deletes copies older than 14 days, on the server and at Backblaze. Backblaze's data processing addendum for customers in the EEA applies the EU standard contractual clauses to these transfers.
Your rights
You can ask what I hold about you and for a copy of it, and ask for it to be corrected, deleted or restricted. You can ask for the data you gave me in a format you can take elsewhere, and withdraw your consent to the letter at any time; the right to object is set out on its own below. One email to hello@analify.com is enough. I do not sell data, I do not share lists, and I do not run retargeting campaigns.
You also have the right to complain to a data protection authority. In Poland, where I am registered, that is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl). If you live in another EU or EEA country, you can complain to the authority there instead; the European Data Protection Board lists them. In the UK it is the Information Commissioner's Office (ico.org.uk).
Nothing here makes a decision about you by automated means that has legal or similarly significant effects. The limit of three browsers only signs out the browser signed in first, and the alert on unusual sign-ins blocks nothing.
Your right to object
You can object to any use that rests on my legitimate interest, at any time: the email log, the statistics, the logs, the sign-in records and the error reports. Write to hello@analify.com and I stop, unless I can show compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend a legal claim. You can also object to the letter, which is direct marketing; then it stops in every case.
Contact for anything on this page: hello@analify.com. Controller: Skrutiny Sebastian Koczyk, a sole proprietorship (jednoosobowa działalność gospodarcza) registered in Poland.