SLX TRANSPARENCY CENTER
KNOW — CHOOSE — CONTROL — TRUST
Control over your data. OIT Transparency is an internal organizational standard, not an official certification.
Privacy policy and purposes
Controller identified by the owner: Space LogistiX, ul. Złota 7 lok. 28, 00-019 Warszawa, Poland; NIP: 7712789387; REGON: 364476574. Contact: office@spacelogistix.pl. Owner attestation dated 31 October 2026; not an independent registry verification. DPO appointment status and processor agreements require confirmation.
Customer inquiries and cargo data are separate from analytics. Requested inquiries: pre-contractual steps; organizational contacts: legitimate interest in responding, subject to controller assessment. Security requires a separate legitimate-interest assessment. Optional analytics and preferences: consent. Browsing history is not automatically linked to accounts or email addresses.
Cookie policy and technology register
slx_privacy_receipt: necessary preference receipt, random ID, 180 days; Secure on HTTPS, HttpOnly, SameSite=Lax, Path=/; no project content.slx-language/ils-public-comparison: localStorage only with EXPERIENCE consent; removed on withdrawal.- No GA4, Meta Pixel or session recording tools are installed. First-party analytics uses aggregate counters without raw event storage or visitor identifiers.
- Sign-in and hosting: OpenAI Sites and Cloudflare. A complete inventory of platform cookies, including HttpOnly, is unavailable in this audit. Unverified cookie names are not published.
Providers and recipients
OpenAI Sites: access and hosting; Cloudflare D1/R2: database and files; Resend: office notifications; inquiry recipient office@spacelogistix.pl. Public launch data: The Space Devs and RocketLaunch.Live, fetched server-side without cargo data. Operator technical documentation: server-side source checks. Resend processing region requires configuration and contract verification. Transfers outside the EEA and provider roles require contract review; no claim is made that all processing remains within the EEA.
Privacy register — reviewed 31 October 2026
The technical mechanisms below were checked in the application. Controller details follow the owner’s attestation; deployment does not verify provider agreements or unapproved retention periods.
Providers: scope established in the project
- OpenAI Sites / ChatGPT — application hosting, sign-in and access control. Contracting entity and subprocessors require review of the owner’s agreement.
- Cloudflare Workers, D1, R2 — application runtime, records, PDFs, attachments and email outbox through Sites hosting. A direct owner–Cloudflare contract is not assumed.
- Resend — code sends notifications to office@spacelogistix.pl when delivery is configured. Content may include contact details and inquiry parameters. Processing location, retention and transfer safeguards require provider-contract and dashboard verification.
- Mailbox provider for office@spacelogistix.pl: owner confirmation required. DNS configuration alone does not establish the full scope of email processing.
- The Space Devs / RocketLaunch.Live — server-side sources of public mission data; the reviewed import does not send customer or cargo data to them. This does not automatically make them customer-data processors.
Retention periods and actual cleanup
| Category | Period / criterion | Mechanism and limitations |
|---|---|---|
| Preference receipt and consent audit | 180 days | Expired entries removed on privacy POST requests and intelligence reads; no independent schedule. |
| Aggregate analytics counters | 365 days | Same cleanup mechanism. No raw events or counter-to-account link. |
| Browser EXPERIENCE preferences | Until withdrawal or storage clearing | No separate automatic localStorage expiry. |
| Inquiries, account and cargo parameters | Period requires controller approval | Automatic deletion of these categories is not implemented. |
| PDFs and quarantined attachments | Period requires controller approval | Access expiry or quarantine does not mean file erasure. |
| Backups and exports | Period requires controller approval | Includes downloaded local copies. No automatic rotation. |
| Notification outbox and correspondence | Period requires controller approval | R2 email-outbox copies and messages held by providers require separate erasure. |
| Hosting and email provider logs | Not confirmed in this audit | To be checked in provider agreements and settings. |
How to request erasure
Contact office@spacelogistix.pl. State the request type and the email address used to contact us. Do not attach passwords, login codes or complete technical documentation. Withdrawing analytics consent does not erase a business inquiry.
- The controller verifies entitlement proportionately. An identity-document scan is not routinely required.
- The scope covers database records, PDFs, attachments, R2 outbox, email, exports and backups. Legal obligations and justified erasure exceptions are checked.
- An authorized administrator performs erasure. There is currently no complete automatic account-and-related-data erasure button. Retained data should have restricted access, a specified basis and an end date.
- Copies held by recipients and providers require separate handling. Backups must not return to operational use without reapplying approved erasures. Immediate selective erasure from every backup is not promised.
- A response is due without undue delay, normally within one month of receipt. Where a permitted extension of up to two further months applies, notice and reasons are given within the first month. Refusal requires reasons and information about complaint and judicial remedies.
This describes manual handling; it does not confirm that any particular erasure has occurred. Product analytics is not used for automated decisions producing legal effects.
Retention and rights
Implemented technical limits: preference receipts and consent audit 180 days; aggregate counters 365 days. Raw events are not stored. Expired records are removed during privacy requests. Forms, PDFs, backups and emails require a separate controller retention policy; automatic deletion is not implemented. These limits do not guarantee legal compliance.
Change or withdraw consent using the panel above or the footer. For access, correction, erasure, restriction, portability or objection: office@spacelogistix.pl. Do not send identity documents without an agreed process. Complaints: Polish supervisory authority UODO. Withdrawal does not affect prior lawful processing or requested inquiry handling.
Measurement covers analytics-consenting activity only. Missing data does not indicate lack of interest. Unique people, locations and individual customer journeys are not measured. Reports hide groups with fewer than 5 events.
EDPB / EROD — consent and lawful processing · Prawo komunikacji elektronicznej