This page explains what I do with your data when you use Product Build Day: the website, event applications, the city waiting list, the playbook and other free downloads, the contact form, my email list, and Builders, the public page of people who built something at an event. It also carries the terms for using Builders, near the bottom. Product Build Day is run by me, Marcin Klimaszewski.
Who I am
I am the controller of your data. Marcin Klimaszewski, sole trader, trading as gonogo.design. Write to me at [email protected] or through the contact form. I answer requests about your data within one month.
I have no data protection officer. An operation this size does not need one under the GDPR, so these requests come to me.
Applying for a seat at an event
A free evening has sixteen seats and runs by application. The form asks for your full name, your email, your LinkedIn address, how comfortable you are with English, a few lines on why you want to take part, and a short note about anything else I should know. All of it is required.
I use those answers twice: to decide who gets a seat, and to run the day for the people who get one. I read every application myself and pick the room by hand. The basis is Article 6(1)(b) of the GDPR, which covers the steps before a contract as well as the contract itself, taken at your request. Without the answers I cannot offer you a seat.
I keep applications for the event and up to 12 months after, unless you ask me to delete yours sooner.
The note field, food, and access needs
The last question on the application is open. If you have nothing to say, "none" is a complete answer, and plenty of people write exactly that.
If you do choose to mention a food or access need, what you write can reveal something about your health, so I treat it with more care than the rest of the form. I use it only to plan the day, I pass nothing beyond what the caterer or the venue has to know, and I do not use it to decide who gets a seat. The basis is Article 6(1)(b) together with your explicit consent under Article 9(2)(a), given when you choose to type it in rather than writing "none". Ask me after the event and I will strip that answer from your application straight away.
Photos, video, and sound at events
Every event is photographed, filmed, and recorded. I use general shots of the room and the day to keep a record of what happened and to show people what a Product Build Day is like. The basis is my legitimate interest under Article 6(1)(f) in documenting my own events. If you would rather not appear, tell me through the contact form or find me on the day, and I will keep you out of the shots I use.
I keep the material as the record of that event, with no set end date, because the record is the point of it. If you want your face out of what I still hold, ask and I will remove what I can.
For close-ups that clearly show you, named quotes, and anything I put into marketing, I rely on your consent instead. That is the next section.
Featuring you
If you tick the featuring box, you let me use your photos, video, recordings, quotes, opinions, and survey answers from the event in Product Build Day marketing. That covers online and offline, social media and print, with no end date. If you gave me your LinkedIn address, it also lets me reuse your LinkedIn photo, name, title, and link in the same materials.
This runs both ways. When I feature you, I promote you: your face, your work, and a link back to you go in front of the people I reach.
You can withdraw this whenever you want by writing to me. When you do, I stop using your material in new work from that point. Things already printed or already posted may stay out there, and I will not reuse them again. I keep material covered by this consent until you withdraw it.
Email updates and the city waiting list
If you tick the email box, I email you about future Product Build Days and free resources. That is the only thing I use it for, and I do not pass your address to anyone for their own marketing. The basis is your consent, under Article 6(1)(a) of the GDPR and Article 398 of the Polish Electronic Communications Act. You confirm your address by clicking a link before anything is sent.
The city waiting list works the same way. It stores your email, the city you typed, and which formats you said interest you, so I can tell you when a day lands near you.
You can unsubscribe from any email or write to me, and I stop. When you unsubscribe, I mark your address as unsubscribed and stop emailing you. The address stays on the list with that mark and nothing else, so a later import or another form fill does not put you back on by accident. If you would rather it were gone completely, ask me and I delete it.
The playbook and other free downloads
The playbook is free. I ask for your email so I can send you the PDF and confirm the address with a link. The basis is Article 6(1)(b), because sending you the file is what you asked for.
Downloading the playbook does not put you on my email list. That is a separate box on the same form, and you get the PDF whether or not you tick it. The whole book is also readable on the site with no email at all.
Messages you send me
The contact form asks what the message is about, your email, an optional subject, and the message itself. There is also a hidden field that catches spam bots and that no person ever fills in. I use all of it to read your message and reply, and for nothing else. The basis is Article 6(1)(b) where you are asking about a booking or a seat, and Article 6(1)(f) otherwise, my interest in answering my own post.
Your message sits in my mailbox for as long as the conversation might matter. Ask me to delete it and I will.
Builders: your account
Builders is the public page of people who built something at a Product Build Day. To add yourself you create an account, either with Google or with an email address and a password.
If you use Google, Google tells me your email address and your name. What Google does on their side is covered by Google's own privacy policy, and Google is the controller for that part, not me. If you use a password, the password is hashed by my database provider and I never see it. Either way the address you sign in with is used for signing in, for the emails listed further down, and for writing to you if something about your profile does not add up.
Your sign-in address is not part of your profile. The profile table has no email column at all, so no public page and no public query can return it.
The basis for the account is Article 6(1)(b), the service you asked for, under the Builders terms of use you accept when you register. I record the moment you accept them.
Builders: your public profile
This is the part to read twice, because the point of a Builders profile is that it is public.
Once I publish your profile, all of this is visible to anyone on the internet with no sign-in: your full name, your job title and company if you gave them, your LinkedIn address, your own website if you gave one, your short bio, your photo, the name of the app you built, the link to it, up to three screenshots of it, the city and date of the evening you attended, the format of that evening, a winner or mentor mark if either applies, and a credential ID in the form PBD-2026-STO-014. Your profile also appears as a tile on the main Builders page and on the page for your city, and your name and photo appear as a small pill on the profiles of other people from the same evening.
Your profile address is built from your name, for example productbuildday.com/builders/ida-lindqvist, and it stays the same after publication even if you later change the name on your profile.
The basis is Article 6(1)(b). Publishing is the service, not a side effect of it. A directory that does not publish is not a directory. You choose to join, you choose every field, and you can take the whole thing down yourself at any time.
Two consequences worth being clear about. The page is meant to be found, so search engines can crawl it and index it, and I do nothing to stop them. And anything public can be copied: search engines cache pages, archive sites keep copies, and people can screenshot or repost what they see. When you delete your profile it disappears from my site immediately, and I have no way to reach copies that other people already made.
Until I publish it, your profile is a draft. It does not appear on the Builders page, on a city page, or at its own address.
Builders: checking that you were there
At registration you pick the evening you attended from a list. Before I publish anything, I check that choice by hand against my own event records, and I check that your app link opens. Nothing is matched automatically, I do not copy any attendee list into the Builders tables, and there are no codes or hashed addresses anywhere in it. I open my own records and look.
If something does not match, nothing gets published and I write to you myself.
The basis is Article 6(1)(b). A credential that nobody checks is not worth putting your name on.
Builders: emails about your profile
Your sign-in address gets these and nothing else: a confirmation email if you signed up with a password, a note when your profile goes into the queue, a note when it goes live, one reminder if you registered and never added an app, a password reset if you ask for one, and a message from me by hand if something about your profile does not match my records.
There is no marketing on this path. Joining Builders does not put you on my email list. Those are two separate decisions.
Builders: Add to LinkedIn and the share image
The Add to LinkedIn button opens LinkedIn's own form with the edition name, the date, your credential ID, and the link to your page already filled in. Your browser does that. I send nothing to LinkedIn, and what happens after that is covered by LinkedIn's privacy policy and not mine.
The share image is built in your browser from your own photo and text, then downloaded to your device. I do not store it and I never receive it.
Builders: your photo and screenshots
Your photo and your screenshots are cropped and resized in your browser before anything is sent. The original file never leaves your device. What I store is the resized copy. The files sit in storage that is not browsable, and the pages that show them use links that expire after an hour rather than permanent public addresses.
I do not run face recognition on your photo, I do not compare it to any other image, and I do not process it to identify you. It is a picture on a page.
Builders: if someone reports a profile
If you think a profile breaks the rules, write to me. I look at it myself, I tell the person what I decided and why, and I take it down if it has to come down.
I keep the report and what I did about it for as long as I need it to handle the case and to be able to account for the decision. The basis is my legitimate interest under Article 6(1)(f) in keeping the page clean and in being able to explain a decision I made.
Builders: the view you do not see
In the admin console I can group builders by the company they typed in. I use it to see which companies keep turning up, and to decide who to approach about running a private day inside their company. It covers everyone who has registered, whether their profile is published or not. It is never public and I never share it.
The basis is my legitimate interest under Article 6(1)(f) in finding work for the paid formats. Because this is direct marketing, Article 21(2) gives you an absolute right to object. Tell me and I stop, with no balancing and no questions. Leaving the company field empty also keeps you out of it.
Builders: how long I keep it
Your account, your profile, your photo, and your screenshots stay for as long as you want them there. The delete button at the bottom of your profile screen removes the profile row, the attendance, the images, and the sign-in account in one go, immediately and for good. There is no archive and no soft delete.
If you create an account and never add an app, the profile stays as a draft that nobody can see. You can delete it yourself at any time. Nothing clears old drafts automatically yet, so if you want yours gone, press the button or ask me and I will do it.
Deleting your Builders profile does not erase my event records. The application you sent for the evening itself is a separate thing with the retention described further up, and those records are what let me answer questions about who was in the room.
Requesting a seat at Pro
The form asks for your name, work email, company, number of seats, where you are with approval (optional) and a referral code (optional). If you came through a link with a campaign tag, the tag is attached to your request so I can tell which ads work. I use it to reply, hold your seat and invoice your company. The basis is Article 6(1)(b). I keep the request as long as the booking needs it, and invoice records as long as tax law requires.
Technical logs
My backend keeps short technical logs of requests, including IP addresses, so I can see when a form is being hammered by a bot and stop it. The basis is my legitimate interest under Article 6(1)(f) in keeping the site standing. When something on the site breaks, a technical error report goes to Lovable, my host, so I can fix it.
Is any of this optional
Optional: the email list, the city waiting list, the featuring consent, and whether you mention a food or access need in the note. The site and the events work without any of them. Analytics, session recordings and the Meta Pixel are optional too. Nothing of it loads until you say yes in the banner, and you can switch it off in Cookie settings in the footer.
Not optional: the answers on an event application, because I cannot offer you one of sixteen seats without them, and the required fields on a Builders profile, because a profile without a name, a LinkedIn address, an edition, and a photo is not a profile. Builders itself is entirely optional, and so is every field on it that is not marked required.
Who sees your data
I do not sell your data and I do not share it with event sponsors. A few tools help me run things and work on my instructions, under contracts that hold them to it: Resend for sending email, reached through Lovable, Supabase for applications, accounts, profiles, and file storage, Lovable for hosting and error reports, Google Analytics for statistics, and Microsoft Clarity for session recordings, the last two only if you agree. If you agree to marketing, Meta receives data from the Meta Pixel to measure my ads. Meta is not my processor: for collecting and sending that data Meta and I are joint controllers, and after that Meta is its own controller. If an event has a venue, I may pass a name list for entry, and a caterer may get what they need about food. I share with authorities only if the law makes me.
A published Builders profile is public, so anyone on the internet can see it. That is the point of it.
Sending data outside the EU
Some of those tools may process data outside the EU. Where they do, I rely on the safeguards Chapter V of the GDPR allows, such as an adequacy decision or the EU Standard Contractual Clauses. Ask me and I will tell you which one a particular tool relies on and give you a copy of the clauses where I have one. Meta may process Meta Pixel data in the US under the EU-US Data Privacy Framework.
A published profile is on the open internet, so it can be read from anywhere in the world. No transfer mechanism covers that and none applies, because you chose to make it public.
Keeping it safe
Access to the database goes through row level security, so a signed-in person reaches their own row and the published rows and nothing else. Passwords are hashed by my database provider. I am the only administrator. Photos and screenshots are served through links that expire.
Your rights
You can ask me for a copy of your data, correct it, delete it, limit how I use it, object to my legitimate-interest uses, or get it in a portable file. You can withdraw any consent whenever you want, and that does not change what I already did before you asked. To use any of these, write to me at [email protected] or through the contact form.
For your Builders profile you can do most of this yourself without asking me. Every field has an edit button, and the delete button removes everything at once.
You can also complain to the Polish regulator:
Prezes Urzędu Ochrony Danych Osobowych
ul. Stanisława Moniuszki 1A
00-014 Warszawa
uodo.gov.pl
You can complain to the data protection authority in the country where you live instead, if that is easier.
Withdrawing consent
Write to me, or click unsubscribe in any email. It is as easy to pull out as it was to opt in. For analytics and the Meta Pixel, open Cookie settings in the footer and switch them off. That stops them sending right away.
Automated decisions
Nothing on this site makes a decision about you automatically that has a legal or similar effect on you, and I do not profile you. Who gets a seat is decided by me reading applications. Whether a Builders profile gets published is decided by me checking two things by hand.
Under 18
Product Build Day is for working professionals, not for children, so I do not knowingly collect data from anyone under 18. You have to be at least 18 to apply for a seat or to create a Builders profile. If you think a child sent me data, tell me and I will remove it.
Builders profiles and terms
These are the terms for using Builders. What a published profile shows is listed further up, under "Builders: your public profile". Your email address is never part of it.
Attendance at the edition you pick, and the link to your app, are checked before publishing. A profile confirms attendance and the result of the evening. It is not a qualification and it does not grade anyone.
You keep whatever rights you have in the app you built. You are responsible for keeping it online and for what it does. If it stops working it may be marked as no longer running.
You can edit or delete your profile at any time from your profile screen. Deleting it removes the page, your photo, your screenshots and your account, and the credential link stops working. The Code of conduct also applies.
Changes
If I change how I handle data, I update this page and the date at the top. For anything big, I tell the email list, and I tell everyone with a Builders profile.
AI use on this site
Everything on this site is AI-assisted and human-approved. For the full disclosure, see Transparency.