Privacy policy

1. Who is responsible for your data

Launch Nest is a professional network run from Poland. It is operated by SILESIAN STARTUP FOUNDATION, a foundation established under Polish law, with its registered office at ul. Kaczyniec 9, 44-100 Gliwice, Poland, entered in the National Court Register (KRS) under number 0001023998, NIP 6312711599, REGON 524712858, represented by its management board. The foundation is the controller of the personal data described below, and it is the provider of the intermediary service under the Digital Services Act.

Write to us at kontakt@slaskiestartupy.pl. That is the address for every right this document describes — access, correction, deletion, restriction, objection, portability — and for any question about what happens to your data.

The same address is the foundation's single point of contact under the Digital Services Act: for you, as someone using the service (art. 12), and for authorities (art. 11). A person reads it. It is not an automated mailbox, and there is no form you have to use instead. Write in Polish or in English; both are answered.

2. What this document covers

This document describes what Launch Nest holds about you, why, for how long, who else touches it, and what you can require of us. It covers the mobile application and the server behind it, and the waitlist form on the Launch Nest landing page.

It does not cover what other people do with what you publish. A post, a comment, a library item and a public profile are visible to other people by design, and this document cannot govern what they do after they have read it.

The landing page of Launch Nest has a form for joining the waitlist. The form is part of our own page and asks for one thing, your e-mail address, plus a tick for your consent. When you send it, the address goes to our own automation server (n8n), which we operate ourselves on Google Cloud in the European Union (region europe-north2, Stockholm). The server stores the address, the text of the consent you give and the time you gave it there, and then passes the address to Brevo so that Brevo can send you a message asking you to confirm. We add the address to our list "Waitlist" in Brevo only after you confirm it from that message (double opt-in). We use it for two things: to tell you when you are admitted — people are admitted in waves of 50 — and to send you occasional news about the platform. The ground is your consent (art. 6(1)(a) GDPR), given by signing up. It is separate from the consents in the app: it creates no account and does not appear in the consent history in Settings. Brevo holds the list on our behalf, and our automation server runs on Google Cloud infrastructure; both are named in the section on who else processes your data, and no other company receives the address. You can withdraw your consent at any time — with the unsubscribe link in every e-mail we send you from the list, or by writing to the contact address at the start of this document, where you can also ask us to delete the address — both from Brevo and from our automation server. Withdrawing does not affect what was lawful before it. We keep the address until you unsubscribe, or at the latest 12 months after we stop admitting people from the waitlist, whichever comes first. We keep the copy in our automation server (the address, the text of the consent and the time you gave it) for just as long.

3. Your account and your profile

Your login account lives in a different system from everything else. Sign-in runs on our own installation of GoTrue, and that is where your e-mail address and your sign-in links are. The application database — the one holding everything else in this document — has no e-mail column at all. The only e-mail address anywhere in it is on an invitation row: the address an invitation was sent to.

In the application database your account row holds an identifier, the display name you typed, whether the account is a person or a company, which community is your home and which you are currently acting in, your interface language, and a settings field.

Your profile holds what the product shows other people: display name, headline, summary, availability, skills, topics, links, avatar, and a marker on every field recording whether you typed it or the model wrote it. It also holds a reputation figure per topic.

4. The material your profile is written from

To write your profile the product accepts four kinds of material, any of them, in any combination: a voice recording, a document (a CV, a portfolio, a screenshot), text you type, and a public GitHub username. What you attach is stored as a file, plus a row naming its kind, its type and its size.

This is the most sensitive material in the product. A CV and a minute of unscripted speech routinely contain things nobody set out to disclose — health, family circumstances, union or political involvement, religion, origin. Please do not put such information in what you send us; if it is there, it is processed together with the rest.

You can delete these files. Deleting your account deletes them, and the deletion routine checks afterwards that they are really gone from storage.

5. Posts, comments, library materials, votes

What you publish — questions, answers, comments, library materials, and the votes and reactions you give — is held with your authorship attached, and is visible according to the visibility of the place you published it in.

Deleting a post or a comment empties it. The database will not accept a row marked as deleted that still has a body, so the emptiness is a rule the database enforces rather than a promise we make. The row itself stays, so that a conversation other people took part in does not collapse.

6. Direct messages, and what "encrypted" means here

Message bodies are encrypted before they are written to the database, with a key per conversation which is itself wrapped by a master key held in a key manager.

This is not end-to-end encryption and we will not describe it as if it were. The keys are ours, not your device's, so the operator can decrypt a message. We keep it that way so a reported message can be examined and so a lost phone does not lose your correspondence. The honest statement is: we can read your messages. Treat them as private from other users, not as private from us.

When you ask for erasure, the content of the messages you sent is destroyed. The conversation row stays, because it belongs to the other person too. When both participants have asked for erasure, the conversation's key is deleted — and from that moment the remaining ciphertext is unreadable by anyone, including us.

7. Reputation, and why the ledger is kept

Reputation is not a number we store and overwrite. It is a ledger: every event that ever moved it is a row recording who acted, on whom, in which topic, what kind of act it was, how much it changed, whether it was capped and why, and the weight of the person who gave it.

The ledger cannot be edited. The database refuses to delete a row from it.

Two things follow and both are true at once. It is the only reason a reputation figure can be explained to you at all — without it, "where did this come from" has no answer. And it is a record of one person's behaviour over time, which is a sensitive thing to hold.

Today the ledger is not made anonymous when you delete your account. The path for it is designed and not built, and we are saying that rather than describing an intention.

8. Matching: embeddings, and the sentence a machine writes about you

To match a question to the people who can answer it, the text of your profile is turned into a numerical vector — an embedding — and compared with the vector of the question. The vector is stored alongside your profile.

A match also carries a sentence written by a language model, about you, shown to another person. It says why you were matched. It is machine-written text and it can be wrong.

Your profile is kept as a series of full snapshots. That means that if you remove a sentence from your profile, an earlier version still contains it. Deleting your account deletes that history; correcting your profile does not reach back into it.

9. Events: signing up, checking in, and being visible in a room

If you check in to an event, a row records that you did, when, and by what method, and it is refreshed roughly every thirty seconds for as long as you are present. That is a continuous record of your physical presence in a place, in time.

Two things about it are built carefully. Being on the "who is here" list is a separate choice from checking in, and it is off unless you turn it on. And nobody can check you in by scanning you: the code is one you show from your own phone.

Two things are not, and we are saying so. Being invisible on the "who is here" list does not make the check-in itself invisible — the organiser and the operator still know you were in the room. And an organiser can record a check-in by hand, in which case there is no act of consent from you at all.

There is no time limit on this data yet and deleting your account does not currently remove it. It is a known gap and it concerns the most sensitive data this product will ever collect.

The event match email. When you sign up in the app for a session at an event, you give three short answers (what you do, what you are looking for at the event, what you can help with) and a link to your LinkedIn profile. On the morning of the second day, or when the organiser runs the matching during the event, we send you one email: it names three people worth talking to, each with their name, headline, a one-line reason and their LinkedIn link; two partner companies present at the event; one person quite unlike you, who has also signed up and given this same consent; and the people who were told to look for you. That email is the service you are signing up for, so the consent is required to sign up through this form: "The people I am matched with for this event will receive by email my name, my headline, my LinkedIn link and one sentence, based on my answers, on why we should talk." Your name, headline and LinkedIn link go to the people for whom you are one of the matches and to the people who were told to look for you. The people for whom you are one of the matches also receive one sentence on why it is worth talking to you, which a language model writes from your answers. You appear in someone else's email only if you gave this consent, just as every person named in your email did. The consent is recorded on the sign-up itself, not in the consent history in Settings. A separate record that you gave it — which event, when, and under which version of this policy, without your answers or your link — stays after the sign-up is deleted, so that we can show that every email already sent went out with your consent (art. 7(1) GDPR); it is deleted when you delete your account.

The LinkedIn link is contact information and nothing else: we do not read it or open it, we do not use it to build or change a profile, and it is stored with the event sign-up, not on your profile. Your three answers, together with the answers and headlines of the other people they are compared with, are processed to choose and explain the matches by the same embedding and language-model processing from Scaleway that the sections on matching and on who sees your text describe; no other company receives them, and the email is carried by Brevo. The one-line reason is written by a language model and can be wrong.

The ground is your consent (art. 6(1)(a) GDPR). You withdraw it by withdrawing your sign-up in the app: no further email is sent, and we delete your answers and your LinkedIn link together with the withdrawal and, whatever happens, no later than 30 days after the event. An email that has already been delivered cannot be called back, and the people who received your name, your link and the sentence about you before you withdrew keep them.

10. Reports, detections and evidence

When someone reports content, a row records who reported it, what was reported, the reason from a closed list, and the state of the case. Automated detectors can also flag content, and a flag is a row about a person too. An appeal against a reputation event or a quarantine decision is likewise a row, with your note in it.

Evidence attached to a case is stored encrypted, because it can contain a fragment of somebody's private correspondence — including the correspondence of a person who reported nothing.

11. The audit log, analytics and limits

The audit log records that something happened: who, what, on what, when. It cannot be modified by anyone, including us, and an entry younger than 400 days cannot be deleted by any path at all. It is what lets us prove we did what we said we did — including that we deleted something when you asked. Where that number of days comes from has not been settled, and it is one of the things a legal adviser has to fix.

Two different things in this system record how it is used. They do not work the same way, and until 22 September 2026 this document described them as one.

The first is product analytics, and it is the part you control. The consent is off by default everywhere, and nothing is sent to our analytics provider before you turn it on. Where we keep your choice depends on what you are using. In the browser, since 21 August 2026, your choice is stored on your own device, in the browser's local storage, and it survives a reload — so a "no" keeps being honoured, and a consent once withdrawn stays withdrawn. What is stored is the choice itself, one yes/no per purpose, and not any analytics data. In the phone app the choice still lives in the app's memory only and is lost when the app restarts, so it is off again on every launch and there is nothing durable there to withdraw. Both ways round it fails safe: a value we cannot read back counts as a refusal, never as consent.

The second is our own operational counters, and that consent does not govern them. Our server records a short, fixed list of events about how the service is being used, with your account identifier beside them, and it does this whether or not you have agreed to product analytics. Turning product analytics off does not turn these off, and we would rather say so than let you assume otherwise.

What they record is which step of something was reached, never what you wrote: that a question received its first real answer; that a message reached a conversation; that a suggested match was opened, or dismissed; that both sides confirmed how a match turned out; that the suggestions at an event were shown to somebody, and how many there were; that a part of the Path grid we have not built yet was seen, or tapped; and that a community's plan limit refused an operation. Beside the name we keep only short fixed values and counts — no IP address, no browser or device details, no free text. The text of a post, a message or a profile cannot get in at all: the code does not build if anybody tries to put it there.

We hold these counters on our legitimate interest in running and debugging the service, not on your consent. There is no time limit on them yet, and deleting your account does not currently remove them. We say so plainly, for the same reason we say it about check-ins.

Rate limits: counters per person per operation, kept for a short window, used to stop abuse. A nightly job clears a counter once its window has closed, and whatever is left is deleted with your account.

12. Why we are allowed to hold it

Running your account, publishing what you write, delivering your messages and matching you to questions: necessary to perform the agreement between you and us (art. 6(1)(b) GDPR).

Reputation, ranking, abuse prevention and the automated moderation detectors: our legitimate interest in a network where contribution is visible and abuse is answerable (art. 6(1)(f)).

Writing your profile from a recording, a document, your text or your GitHub, and storing the result: your consent (art. 6(1)(a)). These are the two separate consents you were asked for.

Being visible on the "who is here" list at an event: your consent, off by default.

Sending you the event match email, and sending your name, headline, LinkedIn link and one sentence, based on your answers, on why you should talk to the people you are matched with, after you sign up for a session at an event: your consent (art. 6(1)(a)), required to sign up through that form. Keeping the record that you gave that consent after your answers are deleted: our legal obligation to be able to show that you consented (art. 6(1)(c) with art. 7(1)).

Signing up for the waitlist on the landing page — telling you when you are admitted and sending you occasional news about the platform: your consent (art. 6(1)(a)), given by signing up. See the section on what this document covers.

Product analytics: your consent.

The operational counters our server keeps about how the service is being used, which are not the product analytics above and which your analytics consent does not govern: our legitimate interest in running and debugging the service (art. 6(1)(f)).

Keeping records of reports and of our own decisions, and the audit log: a legal obligation (art. 6(1)(c)) together with the establishment and defence of legal claims.

Sending an invitation to an e-mail address a member gave us: our legitimate interest in an invitation-based network (art. 6(1)(f)).

13. What leaves this system, and where it goes

One external model provider sees your text, and it is inside the EU. One other company — Google — carries push notifications to your phone, and no text of yours travels with them.

Scaleway. The language model that writes your profile from what you gave it, that writes the sentence explaining a match, and that helps classify content runs on Scaleway's generative interfaces — a French provider inside the European Union. The same interfaces turn your profile into the numerical vector used for matching, and turn a voice recording into text before anything reads it.

What reaches them is the material you supplied: the text you typed, your CV and any images, and the sound of a recording you made. For matching, your profile text and the question go there too. For the event match email, your three sign-up answers, and the answers and headlines of the candidate people they are compared with, go there too, to write the match reasons. None of it is sent to Google — the model that reads it is Scaleway's.

Push notifications are the one place Google is involved, and nothing anybody wrote passes through it. When a notification has to reach your phone while the app is closed, it is delivered by Google's Firebase Cloud Messaging; on Android there is no other transport. What travels through Google is your device's push address and five identifiers: which kind of notification it is, which notification channel it belongs to, what kind of thing it points at, which thing that is, and the identifier of the event that caused it. The message carries no title, no text, no name and no content of any kind. The sentence you read on the lock screen is written by the app on your own phone, from a catalogue that ships inside it, after the message has arrived. Your device is registered with Google for this only after you accept the app's offer of notifications; if you never accept, nothing about you reaches Google at all.

Correction, 17 August 2026: until that version, this section named Google's Gemini as the model that writes your profile, and said the contents of your CV were sent to Google. That described a configuration this product supports but this installation does not run. Your text is not sent to Google.

Correction, 6 September 2026: until that version, this section said that nothing at all is sent to Google. That stopped being true on 5 September 2026, when push notifications began to be delivered. Your text still is not sent there; a device address and five identifiers now are.

14. Where the machines are

Files — your avatar, your CV, your voice recording, library materials — are in Scaleway object storage in the pl-waw region: Warsaw, Poland.

The database and the sign-in system run on our own infrastructure at Scaleway. Your e-mail address does not leave it.

The master key that wraps the message keys is in Scaleway's key manager. Live delivery of messages and notifications inside the app runs on our own server. Embeddings are computed by Scaleway in France. The language model runs on Scaleway's generative interfaces in France, and so does the transcription of a voice recording — see the previous section.

Push notifications to a phone are carried by Google's Firebase Cloud Messaging, which Google operates globally rather than from one country we can name for you. Only your device's push address and five identifiers pass through it — never a sentence, a name or any content — and only once you have accepted the app's offer of notifications.

The e-mail address on the waitlist, together with the text of the consent and the time it was given, is in our own automation server (n8n), which runs on Google Cloud in the European Union, in the region europe-north2 (Stockholm). That is a different thing from the e-mail address of your account in the app, which never leaves our infrastructure at Scaleway. The list in Brevo is described in the section on who else processes your data.

15. Who else processes your data

Scaleway (France): database hosting, object storage in Warsaw, key manager, and the containers the service runs in.

Scaleway generative interfaces (France): the material your profile is written from — typed text, your CV, images, and the sound of a voice recording, which is transcribed into text there; your profile text, in order to compute its embedding; and the text of a question, in order to match it. For the event match email, your three sign-up answers and the answers and headlines of the candidate people they are compared with are added to that, in order to write the match reasons.

Google (Firebase Cloud Messaging): delivery of a push notification to your device — your device's push token, the kind of notification, the notification channel, the kind and the identifier of the thing it points at, and the identifier of the event that caused it. Sent only after you accept notifications in the app; a device that never accepted is never registered. Never the text of a message, a name, or any content of a post, a message or a profile. Google carries this traffic globally, and we do not name a country we have not verified.

Google (YouTube): hosting a video a community member linked in a classroom lesson — loaded only when you press play; nothing is sent before that. Once you do, your IP address and the request for that specific video reach them, served from YouTube's cookieless embed host, which does not set the tracking cookies YouTube's ordinary player does. Necessary to show you the lesson you opened, the same basis as the rest of the classroom.

Vimeo: hosting a video a community member linked in a classroom lesson — loaded only when you press play; nothing is sent before that. Once you do, your IP address and the request for that specific video reach them, played with Vimeo's own do-not-track flag set. Necessary to show you the lesson you opened, the same basis as the rest of the classroom.

Loom: hosting a video a community member linked in a classroom lesson — loaded only when you press play; nothing is sent before that. Once you do, your IP address and the request for that specific video reach them. Necessary to show you the lesson you opened, the same basis as the rest of the classroom.

Google (Drive): hosting a video file a community member linked in a classroom lesson — loaded only when you press play; nothing is sent before that. Once you do, your IP address, the request for that specific file, and the fact that you viewed it reach them — Drive can show the file's owner that it was opened. Necessary to show you the lesson you opened, the same basis as the rest of the classroom.

PostHog (EU Cloud): product analytics — counts of events such as reaching a step of the profile builder, together with a device identifier the analytics library generates. Sent only while you have product analytics turned on in Settings; before that, nothing is sent at all. No content of a post, a message or a profile.

Brevo: outgoing e-mail — sign-in links, notifications and the event match email — and the waitlist list on the landing page: your e-mail address, used to tell you when you are admitted and to send you occasional news about the platform. Our automation server passes the address to Brevo.

Our own automation server on Google Cloud (n8n; European Union, region europe-north2, Stockholm): we operate the server ourselves, and Google provides the machine it runs on. We record the waitlist sign-up on it — your e-mail address, the text of the consent and the time you gave it — before we pass the address to Brevo.

16. How long we keep it

We have to say this plainly: five time limits exist in this system today, and they do not cover most of what we hold.

First, the audit log: 400 days. An entry younger than 400 days cannot be deleted by any path at all. That is a floor, not a ceiling — it says how long an entry is certain to survive, and nothing deletes it afterwards.

Second, notifications: 90 days. A nightly job deletes notifications older than 90 days, with one exception — notifications about your own reputation stay, and are deleted only with your account.

Third, rate-limit counters: a nightly job clears a counter once its window has closed.

Fourth, our internal delivery records: 30 days after the delivery finished. This is a table you never see — the queue that carries a live update to your screen, a notification to the person it is for, and a record of a job that failed — and its rows carry account identifiers. A nightly job deletes a row thirty days after its delivery has finished, and only then: anything still waiting, in progress, or being retried is left alone at any age, because it has not yet done the thing it is there to do.

Fifth, the answers you give when you sign up for a session at an event — what you do, what you are looking for, what you can help with — and your LinkedIn link: they are deleted together with the withdrawal when you withdraw your sign-up, and in any case no later than 30 days after the event ends: a nightly job deletes them once 29 days have passed, so none outlives the 30. An event with no stated end time counts as ending at midnight at the end of the day it starts (Polish time). The record that you consented to the match email (the event, the time and the policy version, without your answers) is not deleted with them: it is kept until you delete your account.

The email address on the waitlist is not covered by any of these five limits: it is kept as the section on what this document covers says — until you unsubscribe, and at the latest 12 months after we stop admitting people from the waitlist. That covers both the list in Brevo and the copy in our automation server.

Everything else is kept until you delete your account, or indefinitely where deletion does not reach it. For that remainder there is still no retention policy, and the law asks for periods or criteria rather than "as long as necessary". The periods are being set; when they are, they will be listed here, per purpose, as numbers.

17. What you can require of us

You have the right of access and to a copy of your data, to correct it, to have it erased, to restrict its processing, to receive it in a portable form, to object to processing based on our legitimate interest, and to withdraw any consent at any time — without that withdrawal affecting what was lawful before it.

What is built today, honestly:

Erasure: a control in settings you run yourself. It tells you before you confirm exactly what disappears and what stays, and afterwards what it touched. The next section lists what it does not reach.

A copy of your data: a control in settings. The copy names, alongside the data, the things it could not include and why — so that "here is your data" is never a bigger claim than the file supports.

Correction: you can edit your profile. It does not reach the version history.

Everything else: write to us. There is no self-service control for restriction or objection, and those requests are handled by hand.

18. What deleting your account does not reach

Deleting your data does not delete everything, and the screen tells you so before you press the button. Specifically:

Your login account is a separate system. The deletion routine runs against the application database and file storage; it does not reach the sign-in system, where your e-mail address is. Your account row here is replaced by a pseudonym; the login account is not deleted by this path.

Posts and comments become empty but their rows stay, so that threads other people took part in do not collapse. Your name is replaced by a pseudonym.

The audit log stays, and an entry younger than 400 days cannot be removed by anyone. It is the record that we did what you asked.

The reputation ledger stays, and is not yet made anonymous.

Several other things are not yet covered by the routine — among them check-in and presence rows, the operational counters our server keeps, notifications, invitations and event attendance.

If you want the login account itself removed as well, write to us and say so.

19. What a consent is here

There are three separate consents and none of them stands in for another: that the voice, files and text you share may be processed by AI to write your profile; that the resulting profile may be stored so you can use the platform; and acceptance of this policy and the terms of service.

Each grant is recorded as its own row: which consent, at what moment, which document and which version of it was on your screen, in which language, and from which screen. Withdrawing one is a second row rather than an overwrite, so the history stays readable and a withdrawal cannot erase the fact that a grant existed.

You can see your own consent history in settings.

20. This service is not for people under 16

Launch Nest is a professional network for adults. In Poland the age at which a person can consent on their own to services of this kind is 16. We do not knowingly hold data about anyone younger.

The system has no way to determine your age: there is no date of birth, no age and no adulthood marker anywhere in it. What it has instead is that you can only join by invitation from an existing member, so somebody who knows you vouched for you.

If you believe we hold data about a person under 16, tell us and we will delete it.

21. What happens without a person deciding

Two things happen without a human in the loop and you should know about both.

Matching: a model reads your profile and a question and proposes who should see what, and writes a sentence explaining why. Nothing about your rights or your access to the service depends on it.

Ranking: where your content appears, and how visible it is, is influenced by figures that accumulate automatically. In the extreme this reduces the reach of what you write without anyone deciding to. Today the product does not send you a notice when that happens, and it should — that is a gap we have written down rather than left implicit.

22. How this document changes

When this document changes in a way that changes what you agreed to, the version changes with it. Older versions are kept, so a consent you have already given always points at the text that was on the screen at the time — and the version you agreed to is shown to you, by name, in the consent history in Settings.

Today the app does not re-open the question by itself when a new version appears. The current text is always readable from Settings, and from a public address that needs neither an account nor the app.

23. Where to complain

If you think we are handling your data unlawfully, write to us first, at kontakt@slaskiestartupy.pl.

You also have the right to lodge a complaint with the supervisory authority. In Poland that is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa.