Privacy Policy

Mat Niznik is the data controller for everything described here. Reach me at m.niznik.tech.mba@gmail.com. There is no separate privacy department; your message comes to me.

When you just read the site

The site is a set of static files served from a server I control. That server keeps standard access logs — IP address, browser and device type, the page requested, and a timestamp. These exist to keep the site running and secure, and are not used to build a profile of you.

When you contact me or book a call

The contact form collects your name, email address, subject, and message. The booking calendar collects your name, email, chosen time, and anything you write in the booking notes. I use this only to reply to you and to arrange the conversation you asked for.

If we end up working together

If a conversation turns into actual work, I will hold what that work requires — your name, contact details, company, our correspondence, and any project materials you share with me. I do not take payments through this site, so no payment or card details are ever collected here.

On social platforms

I publish to and manage my own accounts on platforms including Instagram, TikTok, and LinkedIn, using each platform’s official API under tokens I have granted to my own tooling. If you comment on my posts or send me a direct message, I see and may reply to that message. I do not scrape your profile, add you to a mailing list because you interacted with a post, or send unsolicited automated messages.

This site uses Microsoft Clarity to understand how pages are actually used. Clarity records session activity — clicks, scrolling, mouse movement, and page navigation — and aggregates it into heatmaps and session replays. It sets cookies and is subject to Microsoft’s privacy statement.

Being direct about something most sites leave unsaid: I sometimes prepare a personalized page for a specific company I am talking to. Those pages are unlisted and excluded from search engines, and analytics sessions on them are tagged with that company’s name so I can tell whether the page was useful. This tells me a visit happened on a page made for your organization. It does not identify you personally, and I do not attempt to work out which individual you are.

If you would rather not be measured at all, browser “do not track” settings, private browsing, and content blockers all work here, and nothing on the site is withheld from you for using them.

I keep the list of third parties deliberately short. Each one below receives data only for the stated purpose:

• Microsoft Clarity — analytics and session replay, as described above.
• FormSubmit — relays contact form submissions to my email inbox.
• Cal.com — the embedded booking calendar, if you schedule a call.
• YouTube — embedded videos, loaded in privacy-enhanced mode so playback is not tied to your YouTube profile unless you press play.
• Google (Gmail) — where messages you send me are received and stored.
• Instagram, TikTok, and LinkedIn — where public posts and direct conversations take place, under each platform’s own terms.

I do not sell, rent, or trade your personal information. I do not share it for advertising or profiling. The only other circumstance in which I would disclose it is if the law required me to.

Server logs are rotated automatically and kept only as long as they are useful for security and troubleshooting. Correspondence and enquiries are kept while a working relationship is realistically possible, and then removed. Records from actual client work are kept as long as the engagement and any legal obligation that follows it require. Analytics data is retained according to Microsoft Clarity’s own schedule.

Wherever you live, you can ask me to show you what I hold about you, correct it, delete it, or stop using it. Email the address above and I will act within 30 days. I will not charge you, and I will not make the site worse for you because you asked.

If you are in the European Economic Area or the UK, you additionally have the right to data portability, to object to processing, and to complain to your national data protection authority. My lawful bases are your consent for analytics, legitimate interest for keeping the site secure and answering enquiries, and performance of a contract for client work.

If you are in California, you have the right to know, delete, correct, and opt out of sale or sharing of personal information. I do not sell or share personal information as those terms are defined under the CCPA, so there is nothing for you to opt out of.

The site is served over HTTPS. Access credentials and API tokens for my own accounts are stored encrypted on infrastructure I control and are never committed to source control. No system is perfectly secure, but I do not hold sensitive categories of personal data, which is the most effective protection available.

I am based in the United States, and the services listed above operate internationally. If you contact me from outside the US, your information will be processed there and in other countries where those providers operate.

This site is aimed at professional audiences. It is not directed to children, and I do not knowingly collect information from anyone under 16. If you believe a child has sent me information, tell me and I will delete it.

I will update this policy when what I actually do changes. The date at the top always reflects the current version, and material changes will be described rather than quietly folded in.

Questions, requests, or complaints: m.niznik.tech.mba@gmail.com