Draft — to be reviewed by a lawyer. Draft v0.2, 2026-10-23. This text is not yet binding and is not legal advice.

The company has not been registered yet, so the controller and provider data fields are intentionally empty. Company details will be added once the company (sp. z o.o.) is registered

Privacy Policy

Draft v0.2, 2026-10-23

1. Who is responsible for your data

The controller of personal data processed in connection with Enigma LABZ will be the company listed below once it is registered:

Company name: — (to be completed after company registration)
Registered office: — (to be completed after company registration)
KRS number (National Court Register): — (to be completed after company registration)
NIP (tax ID): — (to be completed after company registration)
Contact e-mail: — (to be completed after company registration)
Data protection officer (DPO): — (to be completed after company registration)

We will assess whether we must appoint a data protection officer (Art. 37 GDPR); with the current, minimal processing we probably do not.

2. Our principle: as little data as possible

The product is built to run locally. Models, prompts and conversations stay on your device and never reach us. Telemetry in the App is off by default. The Website uses no trackers; our own page-view statistics run only after you consent (section 3).

3. The website

We use no ad pixels and no profiling. If you accept the “analytics” category in the cookie banner, the site sends our own page-view statistics to our server, with no cookies and no third parties: the page address and title, the referring domain or campaign tag, screen width, browser language, device type, browser, operating system and time spent on the page. The statistics do not store your IP address: a visitor is recognised only within one day, by a hash of the IP address and browser mixed with a random daily salt that is deleted after two days. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw under “Cookie settings” in the footer. Our hosting server keeps technical request logs, including your IP address. Because an IP address can be personal data (CJEU, 19 October 2016, C-582/14, Breyer), we treat these logs as personal data. For browser storage, see the Cookie Policy.

4. The waitlist

If you join the waitlist, we process your e-mail address and the price option you picked. You confirm your sign-up through a link we e-mail you (double opt-in). The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time via the link in every e-mail or by writing to us; this does not affect processing that took place before.

Current status: the form’s backend is not live, so the form on the Website currently sends nothing.

5. Your account

You can create an Account in two ways:

Sign in with Google, GitHub or Hugging Face — we process your account identifier with that provider, your username (GitHub, Hugging Face) and your e-mail address if the provider shares it (Google, GitHub; Hugging Face does not). We request only minimal scopes: openid email on Google, user:email on GitHub, openid profile on Hugging Face. We never access your contacts, repositories, models or anything else.
Username and password, no e-mail — we process only the username you choose and a hash of your password (argon2id with a random salt). We never store or know the password itself. We ask for no e-mail address or other data, so if you lose your password we cannot restore access to the Account.

To protect Accounts against password guessing, we count failed sign-in attempts per username and IP address and temporarily block sign-in once a limit is reached. These records are deleted after 24 hours at the latest (legitimate interests — security, Art. 6(1)(f) GDPR).

6. The hardware scan

The scan runs locally and sends nothing on its own. It produces a single-line code that you can read in full. If you paste that code into the form on our Website, it is processed only in your browser and never reaches our server.

Hardware scan scope
Read locally (needed to match a model)	Never read
operating system and version; CPU (model, threads, AVX2/AVX-512); total RAM	computer name (hostname), user name, home directory paths
GPU: vendor, model, VRAM, driver version, target architecture, PCIe generation and width	serial numbers, GPU UUIDs, MAC addresses, disk serials
available compute backends (CUDA, ROCm, Vulkan, Metal) and their versions	kernel boot parameters, dmesg, system logs
free space on the selected drive	file lists, installed applications, history
power source (AC / battery) and temperatures — live and local only	location, IP geolocation, the content of prompts and chats

We access information on your device only to provide the service you explicitly asked for (matching a Model), which falls within the exemption in Article 5(3) of the ePrivacy Directive 2002/58/EC and Article 399(2) of the Polish Electronic Communications Law. Sending anything to us always requires separate consent.

7. The desktop app

Telemetry is off by default. We split telemetry into three independent categories; consent for each is separate and off until you give it:

Crash reports — before each report is sent you see exactly what it contains and can discard it.
Share acceleration profile anonymously — we receive hardware, Model, settings and benchmark result, with no IP address and no installation ID. Our ingestion service drops the IP address on arrival and never stores it.
Usage statistics — we do not collect them at all. There is no switch because there is nothing to switch on; we mention it so you know the absence is deliberate.

Your prompts and conversations never leave your device, whatever your settings. The local API listens only on your computer’s loopback interface.

8. Recipients and processors

a hosting provider with its seat and servers in the EEA — to be chosen; bound by a data processing agreement under Art. 28 GDPR;
an e-mail delivery provider (waitlist) — to be chosen, preferably in the EEA;
Google, GitHub and Hugging Face — only if you choose to sign in with them; they act as separate controllers for their own services;
a planned Merchant of Record payment provider such as Paddle — only once sales begin; it is a separate controller for payment data.

9. Transfers outside the EEA

Signing in with Google, GitHub or Hugging Face may involve transferring data to the United States. Such transfers rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and otherwise on standard contractual clauses. If you would rather avoid this, create an Account with a username and password.

10. How long we keep data

Retention table
Context	Data	Purpose and legal basis	Retention
Website (server logs)	IP address, date and time, requested URL, status code, user agent	security and availability — legitimate interests (Art. 6(1)(f) GDPR)	up to 14 days, then deleted (to be confirmed with the hosting provider)
Waitlist	e-mail address, chosen price option, consent date and confirmation (double opt-in)	release notification and pricing research — consent (Art. 6(1)(a))	until you withdraw consent or 30 days after the paid edition launches; unconfirmed sign-ups — 7 days
Account	Google, GitHub or Hugging Face account ID, username and e-mail address (if the provider shares it), or username and password hash (argon2id); creation date	running your Account — performance of a contract (Art. 6(1)(b))	until you delete the Account; backups overwritten within 30 days
Sign-in protection	username, IP address, number of failed attempts and lockout time	protection against password guessing — legitimate interests (Art. 6(1)(f))	up to 24 hours
Crash reports (optional)	stack trace, App version, OS, GPU model — after you preview them	fixing bugs — consent (Art. 6(1)(a))	90 days
Acceleration profile (optional)	GPU model, driver, Model, settings and benchmark result; no IP, no installation ID	building the profile database — consent (Art. 6(1)(a)); once anonymised it is no longer personal data	indefinitely, as anonymous data
Complaints and correspondence	contact details, your message	handling it — legal obligation and legal claims (Art. 6(1)(c) and (f))	until the limitation period for claims expires

11. Your rights

You have the right to:

access your data and get a copy (Art. 15 GDPR);
rectification (Art. 16);
erasure (Art. 17);
restriction of processing (Art. 18);
data portability (Art. 20);
object to processing based on legitimate interests (Art. 21);
withdraw consent at any time, without affecting earlier processing;
lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or with the authority in your own EU country.

Send requests to the controller’s e-mail address in section 1. We will reply without undue delay and within one month at the latest.

12. Automated decision-making

We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects for you (Art. 22 GDPR). The hardware-based model recommendation is only a suggestion you can override.

13. Changes to this policy

We will announce material changes on the Website and tell Account holders in advance: by e-mail where we have one, otherwise with a notice after sign-in.