Privacy policy

The controller under the General Data Protection Regulation (GDPR) is:

Dominik Smaga NETFACE
ul. Piękna 9, 33-300 Nowy Sącz, Poland
Email: contact@refberg.com

Refberg is a trading name of Dominik Smaga NETFACE. We have not appointed a data protection officer, as the law does not require one for our business. For any privacy question, write to the address above.

The site is a static website with one script that handles the contact form (section 5), hosted on Cloudflare Pages, provided by Cloudflare, Inc. (USA). When you open a page, your browser sends technical data that the hosting needs to deliver it and to protect it from attacks: IP address, date and time, the page requested, referrer, browser and operating system.

• Purpose: delivering the site, security, fault analysis.
• Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).
• Retention: Cloudflare keeps these logs for a short period under its own policies. We do not combine them with other data.

We do not currently use any visitor statistics or analytics tools. The site contains no tracking code.

If we decide to count visits, we will use Cloudflare Web Analytics, which does not set cookies, does not use your browser's local storage and does not build a profile of you; we would see only aggregated figures, such as page views, referring sites, countries, and browser and device types. Its legal basis would be our legitimate interest (Art. 6(1)(f) GDPR). We will update this section before we switch it on.

This site does not use cookies. That is why there is no cookie banner. The only exception is the AI assistant: once you click "Start chat", the ElevenLabs widget may store data in your browser that it needs to run the conversation (section 7). Nothing of that kind happens before you click.

If you switch between light and dark mode, your choice is saved in your browser's local storage so the site remembers it. If you choose a currency in the header, its code (for example USD) is saved in the same way, and only then. Both are saved only at your request and only because the function you chose needs them, so they need no consent. They stay on your device and are not sent to us. You can delete them at any time by clearing this site's data in your browser settings. If you tick "Offline check" in the Composer Lock Check, that setting is saved in the same way (section 6).

When you use the contact form or write to contact@refberg.com, we process what you send: name, company, email address, PHP version and framework, your description of the problem, the optional answers (who looks after the app, deadline, consent to AI tools), an optional composer.json or composer.lock (pasted into the form, as an attachment or a repository link), and the topic you chose.

The contact form sends your message over an encrypted connection to a small script on our Cloudflare hosting (section 2). The script passes it to the outgoing mail server of OVH SAS (France), which sends it to our mailbox. The script does not store the message.

• Purpose: replying to you and, if you wish, preparing an offer.
• Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) or, for other enquiries, our legitimate interest in replying to you (Art. 6(1)(f) GDPR). The checkbox in the form confirms that you have read this policy; it is not a separate consent.
• Processors: Cloudflare, Inc. (form handling) and OVH SAS (France, EU; email delivery). Our mailbox is hosted by Google Cloud EMEA Limited (Ireland) as part of Google Workspace.
• Retention: if no contract follows, we delete the correspondence 12 months after our last contact. If a contract follows, we keep it for the duration of the contract and as long as tax and accounting law requires (in Poland, generally 5 years from the end of the year concerned).

Providing these details is voluntary. Without an email address we cannot reply.

The Composer Lock Check runs entirely in your browser. The composer.lock or composer.json you drop or paste is read in the browser tab and is not sent to us or to anyone else. We receive no file, no package names and no results. Loading the tool itself (its script, texts and end-of-life dates) from refberg.com is ordinary use of the site (section 2).

To look up security advisories and abandoned packages, your browser sends requests directly to packagist.org, the public Composer package repository: package names (for example symfony/console) and vendor names (for example symfony). Versions and the rest of the file are not sent. The requests carry no cookies and no address of our page. Like any website, packagist.org receives your IP address and the domain of this site, and handles them under its own terms. These requests go from your browser to packagist.org; we do not receive them.

End-of-life dates ship with the page. Only if that file cannot be loaded does your browser ask endoflife.date for the dates of PHP, Laravel, Symfony and CakePHP, in the same way.

With "Offline check" ticked, the tool sends nothing to packagist.org or endoflife.date. The sample report sends nothing at all. The offline setting is saved in your browser's local storage, on your device only (section 4).

If you follow a link from the report to the contact form, the page address contains from=lock-check and the risk level (for example risk=high). Like any page address, it may appear in the hosting logs (section 2). Package names and versions are never part of it.

Where the chat window is available on this site, it is an AI assistant, not a person. It is provided by ElevenLabs. The assistant loads only when you click "Start chat". Before that, no data is sent to ElevenLabs.

When you use it, we process your messages, the details you choose to give (for example name, company, email address), and technical data such as IP address and browser. If you switch on voice, we also process your voice recording and its transcript. ElevenLabs acts as our processor under a data processing agreement.

• Purpose: answering your questions about our services and passing a short brief to our engineer.
• Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering enquiries quickly (Art. 6(1)(f) GDPR). Voice: only if you switch it on; the legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future.
• Retention: we delete chat transcripts and recordings within 90 days. A brief that leads to further contact is handled like a contact form message (section 5).
• The assistant can make mistakes. Prices, dates and commitments are binding only when we confirm them in writing.
• There is no automated decision-making with legal or similarly significant effects (Art. 22 GDPR).

Please do not share passwords, access keys, code or other people's personal data in the chat.

Cloudflare, Google and ElevenLabs may process data in the United States. These transfers rely on safeguards under Chapter V GDPR:

• Cloudflare, Inc.: certification under the EU–US Data Privacy Framework.
• Google LLC: certification under the EU–US Data Privacy Framework.
• ElevenLabs: the safeguard set out in its data processing agreement with us (certification under the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses).

You can ask us for a copy of the relevant safeguards.

When we work on a client's application, any personal data in it is processed on the client's behalf under a separate data processing agreement (Art. 28 GDPR). This policy does not cover that processing.

You have the right to:

• access your data and receive a copy (Art. 15 GDPR),
• have it corrected (Art. 16) or erased (Art. 17),
• restrict processing (Art. 18),
• receive it in a portable format (Art. 20),
• withdraw consent at any time, with effect for the future (Art. 7(3)).

Right to object. You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 21 GDPR). We then stop, unless we have compelling legitimate grounds or need the data to establish, exercise or defend legal claims.

To use these rights, write to contact@refberg.com.

You can also lodge a complaint with a supervisory authority. Ours is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl). You may also contact the authority in the EU country where you live or work.

We update this policy when we add or change a tool. The date at the top shows the current version.