Privacy Policy

This Privacy Policy explains how Tom of Poland handles personal data when you visit tomofpoland.me, contact me, or use the private admin workspace.

Who is responsible for your data?

The website is operated under the Tom of Poland name. For privacy questions, data requests or concerns, contact tom@tomofpoland.me.

What data may be processed?

• Information you choose to send in an email or collaboration request, such as your name, email address and message.
• Essential technical information needed to deliver and secure the website, such as request timestamps, browser information and network identifiers in service logs.
• Essential browser data used to remember age verification and your cookie notice preference. Details are described in the Cookie Policy.
• For the private admin workspace: an approved administrator identity, authentication and session data, audit events, and information needed to manage connected social accounts.

Connected social accounts

Connecting a social account is optional and is available only to an authorised owner of the admin workspace. When a Facebook Page or a professional Instagram account is connected through Meta, the application may receive the account or Page ID, name or username, profile URL, granted permissions and access tokens returned by Meta.

This information is used only to identify and verify the account selected by the administrator and to support the connected-account features enabled in the workspace. Access tokens are encrypted on the server and are not returned to browser components or written to application logs. Disconnecting an account removes its local token data and marks the connection as revoked; provider-side permissions can also be revoked in the provider account settings.

Meta processes data under its own terms and privacy policy. See the Meta Privacy Policy for information about Meta's processing.

Why do we use this data?

• To respond to messages, collaboration requests and other enquiries.
• To provide, maintain and secure the website.
• To authenticate authorised administrators and maintain the admin workspace.
• To connect, verify and disconnect social accounts at the administrator's request.
• To meet legal, security and record-keeping obligations where applicable.

Depending on the circumstances and applicable law, these purposes may be based on responding to your request, performing an arrangement with you, legitimate interests in operating a secure website, consent given through a provider authorisation flow, or a legal obligation.

Service providers and transfers

Hosting, authentication, database and infrastructure providers may process limited data on our behalf to operate the website and admin workspace. Social providers process data when you authorise a connection. These providers may operate in countries outside your country of residence; where required, appropriate safeguards are used for such transfers.

How long is data kept?

Contact messages are kept only for as long as needed to handle the request and maintain necessary records. Admin and audit records are kept while the workspace is active or where there is a legitimate security or legal reason to retain them. Social connection tokens are kept only while the connection is active and are cleared when the connection is disconnected, revoked or no longer usable. Technical logs are retained for as long as reasonably needed for security, reliability and legal purposes.

Your choices and rights

Where applicable law grants these rights, you may request access to, correction or deletion of your personal data, restriction of processing, data portability, or object to processing. You may also withdraw consent where processing is based on consent. Contact tom@tomofpoland.me; we may need to verify your identity before fulfilling a request. You may also complain to your local data protection authority.

Security

Reasonable technical and organisational measures are used to protect personal data, including access controls, HTTPS and server-side encryption of social access tokens. No internet transmission or storage system can be guaranteed to be completely secure.

Adults only

This website contains adult-oriented content and is not intended for anyone under 18. The site uses an age-verification step and does not knowingly collect personal data from children.

Data deletion requests

To request deletion of personal data, email tom@tomofpoland.me with the subject “Data deletion request” and describe the data or account involved. Please include enough information for us to identify the request, but do not send passwords or access tokens. Requests are verified before action and may be limited where retention is required by law or needed to establish, exercise or defend legal claims.

If you connected a Meta account, you can also disconnect it in the admin workspace and revoke the application's access from your Meta account settings. Local connection tokens are removed when the connection is disconnected.

Changes to this policy

This policy may be updated when the website, admin workspace or legal requirements change. The current version is always published on this page.

Last updated: September 8, 2026