Privacy policy

1. Data collected

• Contact and applications: the details you provide, such as name, email, phone, company, location, professional profile link, selected service and message. A program application also includes its ID, language, offer, the source tag of the link that brought you to the form and, if the link you arrived by carried a campaign tag (for example from an ad), that campaign’s name, passed on in the link. If you arrived from a Google ad, it also includes the click identifier Google adds to the ad’s link (gclid, gbraid or wbraid), passed on in the link the same way. Applications sent before the form was shortened in October 2026 may also include an optional answer about how you heard about the program.
• Practice exams and assessments: answers and progress are processed in your browser. If you request a study plan or assessment result by email, the form also submits the result and the information shown next to that form, such as which exam it is, scores by topic and the weakest topic. If you become a program member, the result you sent is also used to check whether the retake guarantee in the program terms applies.
• Customers and payments: contact and billing details, service purchased, invoice information, amount, currency, payment reference and payment or refund status. Stripe collects the payment details needed for your chosen payment method. A prep pack buyer gets a personal access link at the payment email address; the reader that opens the pack shows that address on its pages and keeps a record of the access while it lasts (12 months); purchase records are kept as described in section 9. A lost link is sent again on request by email from the purchase address. The reader is hosted by Netlify, with its function in the USA (section 7); to check your link it keeps your email address, the link's status and the end of your access there, and the rest of the purchase record stays on the Seller's own server. The reader's own code records no IP addresses or pages opened; Netlify, as the host, keeps standard request logs (including the IP address, the address opened, which contains your personal link, and the browser identifier) for a short period to run and secure the service.
• Website operation: hosting and security providers receive technical request information, including IP address, requested URL, browser information and time, to deliver and protect the site. On English pages that can show the prep pack offer, a small function returns the country of your connection, as Cloudflare (the site’s network provider) or the hosting provider determines it from your IP address, so the offer shows the price for your country (złoty in Poland, US dollars elsewhere). It returns the country code only and stores nothing; this relies on the legitimate interest in showing the right price, under Article 6(1)(f) GDPR.
• Analytics: visits, page performance, interaction and form events, campaign tags, referring domain, entry page and clicked program links. The self-hosted Umami tracker uses no cookies and stores nothing on your device; visits are linked by a pseudonymous identifier computed on the server and changed monthly. With your permission, an attribution ID also connects visits over 30 days, and an application ID can connect an analytics confirmation to the received application. These identifiers are pseudonymous, not a claim that the data is anonymous. Names, email addresses and message contents are not deliberately sent as analytics event properties. On the practice exams, the certification articles and the program pages, events also record whether the prep pack offer could be shown, when and why it appeared or was held back (for example on leaving the page or after a pause), how it was shown, whether it was clicked or closed, and the currency. Each offer shown gets a random offer ID. When you buy, Stripe receives a description of where the offer was seen (page type, trigger, wording, device and language), which identifies no one; the random offer ID is passed to Stripe with the purchase only if you allowed remembering the visit source, so that a purchase can be counted against the offer that led to it.
• Newsletter: your email address, the language list you joined, when you subscribed, and when and from which IP address you confirmed (the evidence of your consent), your subscription status, and bounce or spam reports from the mail provider. If opens or link clicks are measured, they are counted in aggregate and are not linked to your address.

2. Purposes and legal bases

Providing data is voluntary. Fields marked as required are needed to answer the particular request, process an application or complete a purchase. Without them I may be unable to provide that service. Optional fields and consent to remembering the visit source are not a condition of admission.

• Answering an enquiry, reviewing an application and delivering a service: taking steps at your request before a contract and performing a contract, under Article 6(1)(b) GDPR. General business correspondence and handling enquiries made for an organisation rely on the legitimate interest in communicating with that organisation, under Article 6(1)(f).
• Billing, accounting and legal obligations: Article 6(1)(c) GDPR. Handling disputes and establishing or defending claims rely on the legitimate interest in protecting the business and its customers, under Article 6(1)(f).
• Security and reliable operation: the legitimate interest in preventing abuse, troubleshooting and providing a working website, under Article 6(1)(f) GDPR.
• Website analytics: legitimate interest in measuring traffic and the performance of content and campaigns, under Article 6(1)(f) GDPR. You can object by emailing me. Remembering the visit source for 30 days: your consent, under Article 6(1)(a) GDPR. Declining does not prevent you from using the site or submitting a form. The campaign name carried in a link to the program and saved with your application: the legitimate interest in knowing which campaigns bring applications, under Article 6(1)(f) GDPR. It travels in the link’s address, nothing is stored on your device for it, and it does not depend on your analytics choice. You can object by emailing me. The Google ad click identifier saved with your application and sent to Google Ads: the legitimate interest in measuring which ads lead to applications, under Article 6(1)(f) GDPR. Like the campaign name, it travels in the link’s address and nothing is stored on your device for it. You can object by emailing me.
• Marketing emails and the newsletter: consent under Article 6(1)(a) GDPR, given when you subscribe and confirm through the link in the confirmation email (double opt-in). When you leave your address on a practice exam’s form, I send the one email the form promises: your result, a short study plan for your weakest domain and what the Certified AI Consultant Program offers. A separate, optional box asks for a few follow-up emails after that: ticking it is your consent, it is saved with that form submission, and your results are shown whether or not you tick it. You can withdraw consent at any time with the unsubscribe link in every message or by emailing me. Messages needed to fulfil your request, review an application or provide a purchased service are separate from marketing.

3. Payments through Stripe

When you use a Stripe payment link, payment information is submitted to Stripe through its payment page. The application form on this website does not ask for card details, and I do not receive your full card number or CVC. I can receive payment status, a transaction reference, billing details and limited payment-method information needed to identify the transaction, issue invoices or handle refunds.

Stripe processes data to execute payments and also for its own legal, fraud-prevention and security purposes. Depending on the activity, it acts as a processor or an independent controller. Its practices, entities, retention and international transfers are described in the Stripe Privacy Policy and Data Processing Agreement.

Submitting a program application is free. Payment is a separate step after acceptance. When you buy the prep pack, Stripe's payment page asks for your billing address and, if you buy as a business, a tax ID, and an invoice is issued for the payment. Never send card numbers, CVCs or banking passwords in a form or email.

4. Program members: Discord, program email and materials

If you join the Certified AI Consultant Program, a few extra tools are used to give you access. Each processes only what that tool needs.

The program uses a private Discord server with a bot called “CAC Admin”. The bot processes your Discord user ID, username, server roles and which single-use invitation you joined with. It uses them to give you the member role after payment, the certified role after your certification is verified, and to remove roles when your membership ends. To check whether a membership is active, it reads the subscription status from Stripe; it does not see card details. The link between an invitation and a member is stored on my own server in the EU (Hetzner, Helsinki). Discord processes your Discord account under its own Privacy Policy as an independent controller.

To register for Anthropic's certification exams, members receive a program address on this domain (usually name.surname@szymonpaluch.com). It only forwards mail to the personal address you give me and cannot send mail. It is run on Google Workspace, which processes the forwarded messages as my processor. For it I process your first name, last name and the forwarding address. The address is removed when your membership ends, unless you passed a certification exam: then forwarding stays on so you keep access to your certification accounts, until you ask me to remove it.

Exam registration, scheduling and badges are handled by Anthropic (Partner Academy), Pearson VUE and Credly under their own privacy terms. I do not receive your exam results from them; to get the certified role, you send me your Credly badge link yourself.

Program materials are published as a Notion page that contains no personal data of members. Live sessions run on Google Meet. If a session is recorded, participants are told before it starts, and the recording is shared only with members.

5. The MCP server for AI assistants

The public MCP server at https://szymonpaluch.com/mcp lets an AI assistant, such as Claude, use the practice exams, the blog and the service information on this site. It needs no account and returns only content already published here. How to connect it.

The server does not see your conversation with the assistant. It receives only the requests the assistant sends to it: the tool name, its arguments (for example a search phrase, a post address or a question number) and, when the assistant connects, the name and version of its application. It answers each request and keeps nothing from it: requests are not saved, and arguments are not written to logs.

Technical request data (IP address, browser or application identifier, time) reaches Netlify and Cloudflare, as it does for any page of this site, and Netlify uses the address to limit the number of requests. When you add the server as a connector in Claude, on the web or in the desktop app, the requests come from Anthropic's servers, so the address is Anthropic's rather than yours. A client running on your own computer, such as Claude Code, connects from your address.

Each connection and tool call is also recorded as an event in the self-hosted Umami analytics described in section 1: the method or tool name, the reported application name and version, the User-Agent and the address the request came from. Umami uses the address to derive an approximate location and the monthly-changing pseudonymous identifier; it does not store the address itself. Search phrases and other arguments are not sent. Links in the server's answers carry a campaign tag (utm_source=mcp), so a visit that follows one can be attributed to the server.

The legal basis is the legitimate interest in providing this tool, protecting it from abuse and measuring its use, under Article 6(1)(f) GDPR. You can object as described in section 10. The tools need no personal data, so do not include any in text you ask the assistant to search for.

6. Who receives data

Data is disclosed only where needed for the relevant purpose, through the website request, a submitted form, a service integration, correspondence or legally required records. It may be available to authorised people helping operate the service and to the following categories of providers:

• Netlify: website hosting, including the prep pack reader, and receiving form submissions. The practice exams’ study-plan requests and program applications are received by this site's own function and stored with Netlify in its EU region (Frankfurt); the other forms use Netlify Forms. See Netlify’s privacy information.
• Cloudflare: network delivery and protection of the website. The site also loads animation-library files from the cdnjs service, which receives the technical request. See Cloudflare’s privacy policy.
• Hetzner: infrastructure for three services run for this website: the self-hosted Umami analytics at stats.szymonpaluch.com, the self-hosted Listmonk newsletter at newsletter.szymonpaluch.com and the prep pack reader at prep.szymonpaluch.com. Neither is an advertising network.
• Amazon Web Services (Amazon SES, EU Frankfurt region): sending newsletter emails and reporting bounces and spam complaints. See AWS’s privacy notice.
• Stripe and its payment partners: processing and securing payments, as described above.
• Email, scheduling and business-service providers: delivering correspondence, arranging meetings and, where applicable, supporting accounting and legal obligations. Opening a Google booking link involves Google; the speaking form also uses Google reCAPTCHA for spam protection. See Google’s privacy policy.
• Google Ads: if you arrived from a Google ad and send a program application, the ad’s click identifier, the time the application was sent and the application’s random ID are sent to Google Ads, so the application can be credited to the ad. Your name, email address and other answers are not sent. Applications giving a location in the European Economic Area, the United Kingdom or Switzerland are not sent. See Google’s privacy policy.
• Public authorities or professional advisers where disclosure is legally required or necessary to establish, exercise or defend claims. Personal data is not sold.
• Program members: Discord (community server and bot) and Google Workspace (program email forwarding, Google Meet sessions). See section 4.

7. International processing

Some providers and their subprocessors operate outside the European Economic Area, including in the United States. The relevant transfer arrangements may use a European Commission adequacy decision or standard contractual clauses and additional safeguards where required.

Provider-specific arrangements are described in the Netlify Data Processing Agreement, Stripe Data Processing Agreement, AWS Data Processing Addendum and linked provider privacy information. Contact me for information about safeguards applicable to your data and how to obtain a copy.

8. Browser storage and your analytics choice

Remembering the visit source is off until you choose “Accept”. You can refuse it or withdraw permission through “Privacy settings” in the footer or the button below. Withdrawal removes the stored acquisition record from this browser. It does not retroactively undo processing that was lawful before withdrawal.

The self-hosted Umami tracker uses no cookies and no browser storage, and runs regardless of this choice. With your permission, this website separately uses localStorage and sessionStorage for attribution. Necessary browser storage keeps features you request working. Expired records are ignored or removed when next accessed; the browser may retain stored bytes until that access or until you clear site data.

• Privacy choice: remembered for up to 180 days in this browser.
• Acquisition source: first discovery and most recent non-direct source for up to 30 days, only with your permission. The most recent program-link placement is valid for 30 minutes within the tab session.
• Form confirmation: a short-lived handoff retains the form, submission language and application ID so the correct confirmation can be shown. Its validity is 15 minutes; session markers prevent duplicate success events. Remembered attribution is attached only with your permission. A campaign name or ad click identifier carried in a link to the program (section 2) is not remembered on your device.
• Requested features: a language choice and practice-exam progress remain until you change or clear them; a program offer code is remembered for up to 30 days to retain the price you opened, and the time you first finished any of the practice exams is kept so the practice-exam price can be shown for 24 hours. Whether you subscribed to the newsletter or closed its invitation is remembered so the invitation is not shown again for 30 days, or at all after you subscribe. Clearing site data can reset those features. For the prep pack offer, this browser remembers when it was last shown and how many times in a row it was shown without a click (not shown again for 3 days, or 14 days after two showings without a click), when you closed it (7 days) and whether closing it only minimized it to a small button that opens it again (7 days), that you bought the pack (12 months), when an application to the program was received (30 days) and that you paid for the membership (no offer from then on); it also remembers when a promotional pop-up (this offer or the newsletter invitation) was last shown, so there is at most one a day. For the tab session it remembers your country code for the price and the offer you clicked on the way to the Stripe payment page, so the thank-you page can count the purchase. None of these is linked to your name or email address.
• The prep pack reader at prep.szymonpaluch.com sets a cookie that keeps a buyer's personal access open; it is needed for the service the buyer paid for and works only while the access is active. External payment, booking and embedded-content services have their own browser-storage practices. Loading an embedded video or social post connects to its provider. Read the provider’s notice before using that service.

9. Retention and security

Contact and application records are retained for handling the request, completing the admission process and related follow-up. If you become a customer, relevant records are kept for providing the service. Further retention depends on accounting or tax obligations, unresolved complaints and applicable limitation periods for claims. Marketing records are retained for the subscription and, where necessary, evidence of consent or an opt-out.

The browser periods above do not set the retention of a submitted application, transaction or historical analytics record. Those records are retained according to their purpose, the need to evaluate the service and campaigns, and any applicable legal obligations. You can ask about the retention or deletion of your particular record using the contact details above.

The site uses HTTPS to protect data in transit. Administrative systems require authenticated access; access and disclosure are limited to what is needed for operating the service. Payment details are handled on Stripe’s payment page. No transmission or storage system can guarantee absolute security.

10. Your rights

Where the GDPR conditions apply, you can request access, correction, deletion, restriction of processing or portability of your data. You can object to processing based on legitimate interests and to direct marketing, and withdraw consent at any time. Some records must still be retained to meet legal obligations or handle claims.

Email contact@szymonpaluch.com, preferably from the address used in the relevant form or purchase. I may need proportionate information to verify that the request concerns your data. GDPR requests are normally answered within one month; if a permitted extension is necessary, you will be informed within that month.

You can complain to the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), or the competent supervisory authority in your country.

11. Decisions and policy changes

Program admission is reviewed by a person. Practice-exam and assessment scores are calculated automatically for educational feedback; they do not determine admission or produce legal effects. Analytics helps understand visits and applications and is not used to make solely automated admission decisions.

This policy may be updated when services or data practices change. The current version and update date will be published on this page.