Privacy Policy

01.Controller and contact details#

• Legal name: Douglas Anthony Silkstone
• Trading name: WithSeismic
• Legal form: natural-person entrepreneur registered in the Czech Republic
• Trading address: Nademlejnská 600/1, Hloubětín, 198 00 Prague 9, Czech Republic
• Business ID (IČO): 10911243
• VAT number: CZ8803201550
• Data box ID: uebsrdr
• Email: doug@withseismic.com
• Website: https://withseismic.com

02.Data collected and legal basis#

The data collected depends on how you use the site or work with me.

• Enquiries and bookings. This includes your name, email address, booking time and anything you include in an email, booking form or project note. The booking script is served by Cal.com when the site loads, so Cal.com also receives technical request data such as your IP address and browser information. The data is used to reply, assess the proposed work and take steps towards a contract. Legal basis: steps taken at your request before entering a contract, performance of a contract (Article 6(1)(b) GDPR), and legitimate interests in providing the booking facility (Article 6(1)(f)).
• Conversations with the AI agent. If you talk or type to the AI agent on the site, your speech or text is sent to Google's Gemini API, which runs it, so it can answer. The site keeps a written transcript, the details the agent notes (who you are, what you want to do, your stage and your budget), a short summary, the next step it suggested and your email address if you choose to give it. The site does not store your audio. If you ask the AI agent for the free guides, your email address is handled as described under Email updates. To limit abuse, it counts conversations against a one-way hash of your network address, which is deleted after 24 hours and never stored with the transcript. The agent can also show you a short form; what you send in it is kept with the transcript, passed to the agent and included in the email to me. If a form asks where you are and you search for a place, the text you type is sent from the site's server to Photon, a place search run by komoot on OpenStreetMap data, without your IP address. A map the agent shows loads its tiles from OpenFreeMap, which sees your IP address as any website you load files from does. A YouTube video it shows loads its preview picture from YouTube (Google); the video itself, from youtube-nocookie.com, loads only when you press play. The data is used to reply, assess the proposed work and fill in the booking form if you book a call. When a conversation ends, if you gave your email address, the site emails me the details the agent noted, its summary and your email address through Cloudflare so I can reply personally. Cloudflare’s Turnstile script loads when you point at, focus or touch the agent. The check itself runs when you start a conversation; once you pass, the ws_voice_checked cookie lets further conversations from the same network skip it for 12 hours. Most people see nothing; if Cloudflare is unsure, a small “Verify you are human” checkbox appears inside the agent panel. The site sends the token from the check and your IP address to Cloudflare for confirmation. If Cloudflare does not confirm it, the conversation does not start. Cloudflare processes the signals the check relies on (your IP address, TLS fingerprint and User-Agent header, with the site key and the page's origin) as a processor for the check, and as a controller when it uses them to improve its bot detection. The check is strictly necessary for the conversation you request. Legal basis: steps taken at your request before entering a contract (Article 6(1)(b) GDPR), and legitimate interests in answering enquiries and preventing abuse (Article 6(1)(f)).
• Live calls with me. If I'm at my desk and you agree, the AI agent can put you through to me for a live audio call in the same panel. Your audio and mine pass through Cloudflare's TURN relay (Cloudflare Realtime), encrypted end to end between our browsers. Cloudflare sees both IP addresses, but neither of us sees the other's. The call is not recorded and no audio is stored. The site keeps the times the call was answered, connected and ended, its duration and who hung up, alongside the conversation transcript. The legal basis is steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
• Email updates. If you sign up through a form on the site or ask the AI agent for the free guides, the site collects your email address, your first name if given, where on the site you signed up (“voice” means the AI agent), the page and a signup event. These are sent to Loops (run by Astrodon Corporation, in the US), which I use to send the How I work course and the build log. Each signup is also saved in a backup file on the site’s server in case Loops is down. The purpose is to send the email updates you requested. Legal basis: consent (Article 6(1)(a) GDPR), which you can withdraw at any time through the unsubscribe link in any email or by emailing doug@withseismic.com.
• Client work. This may include correspondence, contracts, shared documents, repository access, delivery records and invoice details. It is used to deliver and administer the engagement. Legal basis: performance of a contract (Article 6(1)(b)), compliance with tax and accounting obligations (Article 6(1)(c)), and legitimate interests in maintaining business records and handling legal claims (Article 6(1)(f)).
• Site and security logs. Hosting systems may record IP address, browser or user-agent information, requested URL and timestamp. These logs are used to operate, secure and troubleshoot the site. Legal basis: legitimate interests in providing a secure and reliable website (Article 6(1)(f)).
• Analytics, if you consent. PostHog records page views, referral sources, selected site interactions, browser and device information, a random browser identifier and approximate location derived from the request. It is used to understand site use and whether enquiries follow a visit. Legal basis: consent (Article 6(1)(a)).
• Advertising measurement, if you consent. The Reddit Pixel and Reddit's Conversions API record that a page was visited and whether an enquiry, download or booking followed, together with the Reddit click identifier from the link you arrived on, your IP address, browser information, screen size and a Reddit-set browser identifier. If you send an enquiry, a one-way hash of your email address is sent so Reddit can match the enquiry to an ad click; the address itself is not. It is used to measure whether Reddit advertising leads to enquiries. Legal basis: consent (Article 6(1)(a)).
• Cookie decisions. The site stores your choices and the time you made them in a first-party cookie. It also sends an anonymous count of each decision using a new random identifier for every request, with IP geolocation disabled and no person profile. This is used to check that the consent mechanism is working. Legal basis: legitimate interests in operating and auditing the consent system (Article 6(1)(f)).

Personal data is not sold or rented. It is not used for automated decisions that produce legal or similarly significant effects.

03.Cookies and analytics#

Optional analytics is off unless you consent. The site remains available if you reject it or make no choice.

• Consent cookie: ds_consent. This first-party cookie stores your optional-cookie choice, the policy version and the date of the decision. It expires after 12 months. It is necessary to remember the choice and is set whether you accept or reject analytics.
• Abuse prevention cookie: ws_voice_checked. This first-party cookie is set only after you pass Cloudflare Turnstile when starting a conversation with the AI agent. It holds an expiry time and a signature tied to a one-way hash of your network address, with no personal details. It lets further conversations from the same network skip the check and expires after 12 hours. It is strictly necessary for the abuse check on a conversation you request.
• PostHog analytics. If you allow analytics, PostHog stores a random browser identifier and receives the analytics data described above. Session recording, heatmaps, surveys and automatic capture of page content are disabled.
• Booking attribution. If you complete a Cal.com booking after allowing analytics, the booking's unique ID is used to associate the booking event with the earlier site activity held under the random browser identifier. Your email address is not sent to PostHog by this site.
• Reddit Pixel. If you allow marketing, Reddit's pixel script loads and stores a random browser identifier (_rdt_uuid) and the site stores the Reddit click identifier (ds_rdt_cid) for 7 days. Conversion events are sent to Reddit from the browser and from the server, carrying the same event identifier so each is counted once. Reddit may use this data as described in its own privacy policy.

You can change or withdraw consent at any time through Cookies in the footer. Withdrawing consent stops future analytics and advertising measurement and clears the PostHog and Reddit identifiers from the browser; it does not erase data already received. You can request erasure by email.

04.Service providers and recipients#

Personal data is shared only where needed to run the site, communicate, book calls, deliver client work or meet legal obligations.

• Railway: website hosting, infrastructure and server logs.
• Google Workspace: business email and correspondence.
• Cal.com: scheduling, booking details and the booking widget.
• PostHog EU: consented website analytics and anonymous consent-decision counts.
• Google (Gemini API): speech recognition, the voice and the conversation for the AI agent.
• OpenFreeMap: map tiles for maps the AI agent shows.
• komoot (Photon): place search in the AI agent's forms.
• Google (YouTube): videos the AI agent shows, from their preview picture.
• Cloudflare (Cloudflare, Inc., US): abuse prevention for the AI agent through Turnstile. It sends me notification emails when an AI agent conversation ends, but only if you gave your email address. These contain the details the agent noted, its summary and your email address so I can reply. It also relays audio from live calls with me through its TURN service without recording it.
• Loops (Astrodon Corporation, US): sending the How I work course and build log email updates.
• Reddit (Reddit, Inc.): consented advertising measurement via the Reddit Pixel and Conversions API.
• GitHub and client-controlled systems: source code, project records and access required for client work.
• Accountants, banks, tax authorities, regulators, courts and professional advisers where required for accounting, legal obligations or legal claims.

05.International transfers#

Some providers are established outside the European Economic Area or may allow support access from outside it. Where a restricted transfer occurs, the transfer is covered by an applicable adequacy decision or appropriate safeguards.

• a European Commission adequacy decision, including the EU-US Data Privacy Framework where the recipient is certified; or
• European Commission Standard Contractual Clauses, with supplementary safeguards where required.

Email doug@withseismic.com if you want details of the safeguard used for a particular provider.

06.Retention#

Data is kept only for as long as it is needed for the purpose described above or to meet a legal obligation.

• Unsuccessful enquiries and booking correspondence: normally no longer than 24 months after the last contact, unless earlier deletion is requested or longer retention is needed for a legal claim.
• Client correspondence, files and code: for the engagement, handover and any agreed support period, then only for as long as needed for contractual records or legal claims.
• Invoices and tax records: for the statutory period required by Czech accounting and tax law.
• AI agent conversations: the site's transcript and notes are kept on the same terms as other enquiries. Google keeps Gemini API data for a limited period for abuse monitoring under its API terms.
• Cloudflare Turnstile checks: Cloudflare keeps the check data under its Turnstile terms, which do not state a retention period.
• Email updates: until you unsubscribe or ask for erasure. After you unsubscribe, your address is kept marked as unsubscribed so you aren’t emailed again.
• Server logs: normally about 30 days, subject to the hosting provider's operational and security requirements.
• Consent cookie: 12 months. PostHog analytics data is retained according to the active project retention setting and is deleted or anonymised when no longer needed.

07.Your rights#

Subject to the conditions and exceptions in the GDPR, you can:

• Access — ask for a copy of the data I hold about you.
• Rectification — ask me to correct inaccurate data.
• Erasure — ask for data to be deleted where there is no overriding reason to retain it.
• Restriction — ask me to pause processing while a dispute is resolved.
• Portability — receive the data you provided in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — at any time for processing based on consent. Withdrawal does not affect earlier processing.
• Complain — to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz.

08.How to exercise your rights#

Email doug@withseismic.com and describe your request. I will normally respond within one month. I may request information needed to confirm your identity. If a request is manifestly unfounded or excessive, the GDPR permits a reasonable fee or refusal; any such decision will be explained.

09.Children#

This business-to-business site is not directed at children. If you believe a child has submitted personal data through the site, email doug@withseismic.com.

10.Security#

Reasonable technical and organisational safeguards are used, including encrypted connections, access controls, multi-factor authentication and restricted access to client systems. No internet service can guarantee absolute security.

11.Changes to this policy#

The date and version at the top change when this policy is revised. If a change affects the basis on which optional cookies are used, the site will request consent again.