Personal data

Privacy Policy

This English version is a translation provided for convenience. The Polish version of the Privacy Policy is legally binding.

In force from 4 November 2026.

1. Who the data controller is

The data controller is Serafin Conseil Adrian Serafin, os. Oświecenia 54/39, 31-636 Kraków, Poland, NIP (tax ID) 6751310425, the owner of the Radar ICP service (radaricp.com).

For personal data matters, write to kontakt@radaricp.com.

2. What this policy covers

This policy covers the radaricp.com home page (the “Contact” form, the Academy videos, pricing), the pages with the blog, market reports and sample signals, the “Radar for your company” report (radaricp.com/try), the “Okno” series (radaricp.com/serial-okno), the demo (radaricp.com/demo), the plan calculator (radaricp.com/calc), plan orders (radaricp.com/zamow) and the Radar ICP panel (radaricp.com/app) for people with an account: sign-in and LinkedIn sync, booking a call, the help chat and integrations with your tools.

3. Forms and requests

A question from the website (“Contact” section). We collect your first name, an email address at your company’s domain (we do not accept personal mailboxes such as Gmail) and the content of your question. We store the request with the date and the company domain read from the address in a private file store and send it to our contact mailbox, from which we reply to the address you gave. We do not send an automatic confirmation. Sending a question means you want to receive a reply; the legal basis is steps taken at your request before a possible contract (Art. 6⁠(1)⁠(b) GDPR).

A demo request from the “Okno” series. We collect your first name, work email address, the website of the company you are looking for clients for, an optional message, the role chosen in the series (e.g. CEO) and the date of the request. The request goes to our contact mailbox; we get back to you personally to arrange a time. The legal basis is your consent to being contacted about the demo (Art. 6(1)(a) GDPR) and steps taken at your request before a possible contract (point (b)).

A request for access through LinkedIn. A person without an account who clicks “Sign in with LinkedIn” on the sign-in screen does not get an account: we store their first name, surname and email address from LinkedIn as a request for access and are notified by email. We may then send an invitation to Radar. Requests for access sent before 31 October 2026 through the former forms on the website, in the demo and on the sign-in screen are kept on the same terms.

The “Radar for your company” report (radaricp.com/try). We collect an email address at your company’s domain (we do not accept personal mailboxes), your company website address, which we read from the email domain and which you can change, the referral source (utm parameters from the link or the referring page) and the date of the request. Radar reads the company’s public website and prepares an offer profile from it, which you see on screen straight away. It then searches Google (through the Serper service) for companies in your market that show a current signal and turns this into a PDF report. Anthropic’s Claude models and the search engine receive the content of the company website and a description of its market, not your email address. We send a message with a link to the report and the Radar ICP offer to the address you gave. When we prepare a report by hand, you first receive a confirmation with a date. The request also goes to our contact mailbox and to the administrator panel. We record the first opening of the report link with a date and are notified of it by email. If you order a report for the same website within 7 days, we send the same report; we remember the website profile for 30 days. The legal basis is your consent to preparing the report and to one message with the report and offer, given by sending the form (Art. 6(1)(a) GDPR). You can withdraw consent by writing to kontakt@radaricp.com. We send further messages only if you reply or ask to be contacted yourself.

The Early Access offer. People who took part in the free beta, received an invitation to it, requested access or expressed interest in Radar in a conversation with us may receive one message with the Early Access offer, or a link to it, as described in the terms of service (clause 6.7). Each address receives it at most once; we keep a list of the addresses it was sent to. The legal basis is our legitimate interest, namely presenting the offer to people who contacted us themselves (Art. 6(1)(f) GDPR). To object, simply write to kontakt@radaricp.com.

Protection against abuse. From your IP address we create a one-way hash with a secret key and accept at most five requests a day from one address; we do not store the address itself. On radaricp.com/try we use the same hash to check that no more than three report orders a day come from one connection, and a hash of the email address to check whether a confirmation has already been sent that day; we delete these hashes after 30 days. A hidden form field that only bots fill in does not reject the request; it only flags it to us as possible spam. When sending, we check in public DNS (Cloudflare) whether the email domain accepts mail and whether the given website exists; only the domain name is used for this check. The legal basis is our legitimate interest (Art. 6⁠(1)⁠(f) GDPR).

Requests from the last 90 days are viewed in the panel by the Radar ICP administrator.

4. Visit statistics

None of our statistics use cookies or create user profiles. The legal basis is our legitimate interest in improving the website, the series and the offer (Art. 6⁠(1)⁠(f) GDPR).

The “Okno” series. We use Vercel Web Analytics: it counts page visits, the referral source (e.g. LinkedIn), the device type and country, and events in the series (starting an episode, the part watched, opening and sending the form). It recognises visits by a hash of the request data that changes daily, so it cannot be used to track you across days or websites. We also store the same events, together with episode watching time, country and device type, in our own statistics database. There we recognise a viewer by a hash of the IP address and browser whose key changes daily, so visits from different days cannot be linked; a separate daily hash of the address alone is used only to limit the number of events from one connection. We do not store the IP address itself.

The “Radar for your company” report page. The radaricp.com/try page records in the same database the visit with its source (utm parameters or referring page) and button clicks, on the same terms as the series.

Academy videos on the home page and in the panel. The player records in the same database the visit, playback, 25, 50 and 75 per cent of the video watched, its end, a click on the button next to the video and a visit from a chapter link, on the same terms as the series. A random visit identifier lives in the browser tab’s memory until the tab is closed. In the panel (company search screen) we also record whether the video started on its own with sound or muted; the events are not linked to your account. The episode and the point at which the video stopped are remembered only by your browser, so the video resumes from there; this information does not reach us.

Calculator and order. We record the visit with its source (utm parameters from the address when the link was tagged, e.g. sent to one company, or the referring page), the click on “Order”, the country and city read from network headers and the device type. We recognise a visitor by a daily hash, as in the series. An order placed from a tagged link records its name.

Demo. The demo runs in the browser on a fictional company and fictional data; nothing you click in it goes to AI models or to a real radar. We record the views visited, clicks, active time (counted in 15-second units), referral source, country, city, device type, browser and operating system. We recognise a visitor by a hash of the IP address with a fixed secret key, so later visits by the same person are combined into one history that the Radar ICP administrator can view. We do not store the IP address itself.

The blog, market reports and the “Who it’s for” and “Sample signals” pages have no statistics.

Hosting logs. The hosting provider (Vercel) keeps request logs with IP addresses for a short time, needed for security and for investigating errors.

5. Your Radar ICP account

Creating an account. We collect your first name, an email address at your company’s domain, your company website address and a password, of which we store only a one-way hash (we do not store the password). We also record that the terms of service and this policy were accepted, and the date and place of registration (website, sign-in screen or demo). The account is named after the website domain; the owner can change the name. We check the email and website domains in DNS and limit the number of registrations from one IP address in the same way as requests (section 3). A registration is also a request visible to the Radar ICP administrator; we send you a welcome email and notify ourselves of the new account by email. An account from an invitation (to a team or after paying for an order) is created with the address from the invitation, giving your first name, surname and a password; the invitation is valid for 30 days.

Signing in. After you sign in, your browser receives a session cookie: necessary for the panel to work, valid for 30 days and inaccessible to scripts. We record every sign-in attempt with the email address, the result and a hash of the network address to block password guessing: after five failed attempts within 15 minutes we block further attempts and send you an email. Changing your password signs out your other devices and also triggers an email.

Signing in with LinkedIn. You can sign in or create an account from an invitation through LinkedIn (Sign In with LinkedIn, OpenID Connect). LinkedIn then gives us your first name and surname, your email address with information on whether it is verified, and your photo, a copy of which we store ourselves because the photo address on LinkedIn expires; your team can see the photo. We link the account to your profile identifier, and you can disconnect it in “My profile”.

Your profile and work in the panel. In your profile you can give your job title, department, campaign roles and languages. In the panel we store what your team creates: the offer description and customer profile, companies on the radar with scores and signals, contacts, notes, decisions, contact steps, message drafts, tasks, knowledge base materials (pages, PDF files, notes, logo and brand), your own company lists from CSV files and the radar’s work log. Content carries the name of the person who added it, visible to the team.

AI models. For analysing companies and preparing messages, strategies, reports and replies we use Anthropic’s Claude models. They receive only the content needed for the task at hand: the description of your offer, data on companies and people from the radar, a pasted reply from the other person, your materials. Anthropic does not use this data to train its models.

Help chat. Projects with a paid plan include a help chat. We keep the content and state of the conversation on our server, questions are handled by an Anthropic model, and when the chat does not know the answer or you ask for it, it forwards the conversation to Adrian Serafin by email together with your email address; the reply comes to that address.

Emails from Radar. Account emails (password, access, team, payments, plan limits, deletion of a profile or projects, first steps) are always sent. Emails about the radar’s work (the daily and weekly plan, replies from LinkedIn, meetings, new companies to work on, the monthly report and similar) can be turned off in “My profile”, “Email notifications” tab. Every email has a key so that it is never sent twice. We do not send a newsletter.

Team. The owner and administrators of an account invite people by email address (an invitation works once and is valid for 30 days) and see the names, addresses, roles and latest activity of people in the account. When account ownership is transferred, we record the date, email address, IP address, browser and the content of both parties’ declarations.

The legal basis for processing account data is the contract, i.e. the use of Radar ICP (Art. 6(1)(b) GDPR), and for protection against abuse, our legitimate interest (Art. 6⁠(1)⁠(f) GDPR).

Booking a call

After signing in, an account without a plan sees a start page where you can book a 30-minute call with Adrian Serafin. The calendar is a Calendly frame embedded in the panel. It loads only after you click “Choose a time”, and until then Calendly receives no data. Once the calendar is open, Calendly receives your IP address and browser data, and the form is prefilled with the first name and email address from your account (you can change them). After you choose a time, Calendly records your first name, email address, the time and the content of any note, adds the meeting to Adrian Serafin’s calendar and sends you a confirmation at the address you gave. You can cancel the call with the link in the confirmation.

The legal basis is steps taken at your request before a possible contract (Art. 6⁠(1)⁠(b) GDPR).

Orders and payments

When you order a plan, we collect your company’s tax ID, name and address and the email address to which we send the invoice and a link to the account. We retrieve the company details by tax ID from the public VAT White List of the Polish Ministry of Finance; only the tax ID is sent to the register. Card payments are handled by Stripe: you enter the card number in the Stripe field and it never reaches Radar ICP’s servers. From Stripe we receive only information about the payment and the card type and last four digits. The Stripe script on the order page stores its own cookies, which Stripe uses to detect fraud; they are described in Stripe’s privacy policy. We issue VAT invoices in the inFakt service, which also sends them to the National e-Invoicing System (KSeF) run by the Polish Ministry of Finance.

An order placed without an account waits for payment; if no payment arrives, we send one reminder by email. After payment you receive a link to create the owner account, valid for 30 days. If a renewal fails, we let you know by email.

The legal basis is the contract (Art. 6(1)(b) GDPR) and tax and accounting obligations (Art. 6(1)(c) GDPR). For protection against abuse, we store a hash of the IP address from which the order was placed (Art. 6⁠(1)⁠(f) GDPR).

Integrations you connect yourself

Each integration is turned on by the owner or an administrator in the project settings, on their own account with the given service, and can be disconnected at any time. You process the data that goes to your tool through an integration further on the terms of that tool.

• CRM (HubSpot or Pipedrive). We store the service key or API token encrypted (AES-256-GCM); the browser sees only its last characters. We send the company, up to five people from the buying committee (first name, surname, job title, LinkedIn profile address) and a note with signals, the radar’s assessment and a link to the company card to the CRM. Once an hour we reconcile conversation stages, and in the morning we add new signals.
• Claude (MCP connector). An AI assistant to which you give a key from the “Integrations” tab or OAuth consent reads and changes your project with your permissions. The data it retrieves goes to the assistant’s provider on that provider’s terms. We keep a log of connector calls (time and key used) for 90 days.
• LinkedIn ads. You connect your ad account by signing in with LinkedIn; we store an encrypted token and the selected account. We build the report on companies from the radar that saw and clicked your ads from LinkedIn when the view is opened and keep it in memory for at most 30 minutes; we do not store report data, because LinkedIn’s terms prohibit it.

Deleting your profile and leaving an account

In “My profile”, “Leaving the account and deleting the profile” section, you can leave an account or delete your profile. You confirm deletion with your password and by retyping your email address (without a password: with a link from an email). From that moment the panel is closed, and keys and connections with Claude expire. After a 14-day grace period (until then you can reverse the deletion by signing in) we delete your first name, email address, password hash, profile data, the LinkedIn link and your photo, and replace your name on the team’s content with “Former user”. Accounts in which you are the sole owner and which you choose to delete disappear together with their projects. We let you know by email when a deletion is scheduled, reversed and carried out.

6. LinkedIn account sync

Sync is voluntary and independent of signing in with LinkedIn. Radar also works without it, but then you tick off contact steps by hand and paste replies yourself.

Why. With sync, the radar notices on its own that you sent an invitation or message to a person at a company on your radar, that someone accepted an invitation and that someone replied. Steps tick themselves off, and you get a draft for a reply straight away. The radar also shows who you already know at the companies on your list.

How it works. We use LinkedIn’s official Member Data Portability API, which LinkedIn provides under the EU Digital Markets Act (DMA). It works only for people with a profile in the European Union, the European Economic Area or Switzerland. You give consent directly on LinkedIn’s website and can withdraw it at any time in the Radar ICP panel or in your LinkedIn settings. We store the access key encrypted.

Read-only. Radar sends nothing on your behalf: no invitations, messages or posts. The interface does not allow it.

What we download and what we store. LinkedIn provides data from your account: your profile, your list of connections (first name, surname, company, job title, profile address, connection date), invitations, messages and current events such as a message or invitation being sent. Radar processes them automatically and stores only what concerns people at companies on your radar: the profile address, the dates of invitations and connections, and the content of conversations with those people. Other messages and connections are skipped and not stored. From your profile and sent messages, the radar may prepare a description of your offer and writing style, which you approve before it is used.

Who sees it. Stored conversations are seen by you and the people you have invited to your radar account. Nobody at Radar ICP reads your messages. AI models receive only the content of the reply the radar analyses to prepare a draft.

Disconnecting. When you disconnect sync, we immediately delete the access key and all data downloaded from LinkedIn. It disappears from database backups within 30 days at the latest.

The legal basis for processing your LinkedIn data is your consent (Art. 6(1)(a) GDPR). We process the data of the people you write to on the terms in section 7.

7. Data of people at companies the radar finds

At companies on your radar, the radar looks for the people who decide on purchases and helps you manage the contact you make yourself. Sources: company websites (team and management pages), Google search results retrieved through the Serper service (including public LinkedIn results), the Polish National Court Register (KRS) and other public registers, job postings and press articles. We store the first name and surname, job title, public LinkedIn profile address, company and a confidence score that the person really holds the role; from the KRS we store the composition of the management board. Once a week we check through the search engine whether the people you are in contact with still work at the company. AI models prepare message drafts to these people; you send them yourself, from your own accounts. Conversations with these people downloaded from LinkedIn are described in section 6, and if you turn on the CRM or Claude integration, these people’s data also goes there (section 5).

The legal basis is the legitimate interest of both us and your company, namely conducting B2B sales to companies that show a need for the offer (Art. 6(1)(f) GDPR). Each of these people can write to kontakt@radaricp.com to access, rectify or delete their data, or to object.

8. What stays only in your browser

The series page remembers in browser storage (localStorage) the selected profile, the point where you stopped watching an episode and whether the series is on your list. The home page and the radaricp.com/try page keep a random visit identifier in the tab’s memory. The panel remembers view settings: the open tab, filters, collapsed sections, hidden tips and the project open in that tab. This information is not sent to us or to anyone else. You can remove it by clearing site data in your browser.

9. Who we entrust data to

We use service providers that process data on our behalf:

• Vercel Inc. (hosting of the website and panel, a private file store with requests, radaricp.com/try reports, company data, photos and materials, Vercel Web Analytics for the series, request logs);
• Neon (the Radar ICP panel database and the statistics of the series, home page, calculator and demo);
• Anthropic (AI models that analyse companies, prepare messages and radaricp.com/try reports and answer in the help chat);
• Resend (sending emails: requests to our mailbox, radaricp.com/try reports and all emails to people with an account);
• Google (Google Workspace mail, in which we reply to requests, and website fonts loaded from Google Fonts servers, which receive your IP address in the process);
• Cloudflare (public DNS, through which we check that a domain exists, and the cdnjs servers from which the home page loads a graphics library and which receive your IP address in the process);
• Serper (Google search for the radar and radaricp.com/try reports: queries contain company names, a market description and the names of people from the radar, never your account data or your email address);
• Stripe (card payments and subscriptions; Stripe is also an independent controller of payment data);
• inFakt (issuing VAT invoices and sending them to KSeF);
• Calendly LLC (the calendar for booking a call from the account start page; the calendar page also loads Google reCAPTCHA protection; Calendly processes data collected by the mechanisms of its own page as an independent controller under its own privacy policy);
• LinkedIn Ireland Unlimited Company (sign-in, data sync and the ads report; LinkedIn is an independent controller of the data of its service).

Independent recipients also include the Polish Ministry of Finance (the VAT White List, to which only the tax ID is sent, and KSeF, to which invoices are sent) and your own tools connected through integrations: HubSpot or Pipedrive and the AI assistant’s provider.

Some of these companies are based in the USA. Data is transferred there on the basis of the European Commission’s decision on the EU-US Data Privacy Framework or standard contractual clauses.

10. How long we keep data

Requests, radaricp.com/try reports, statistics, sign-in attempts, the error log, the list of addresses that received the Early Access offer and the projects of accounts after that offer are deleted after their retention period by an automated job that runs every night.

• Requests (questions from the website, demo sign-ups, requests for access, registrations): we delete the record of a request 12 months after it was sent, and keep the correspondence in our mailbox for up to 12 months from our last contact with you (we review it once a month), or for a shorter time if you withdraw consent or object. If we sign a contract, the data moves to its handling. We delete the list of addresses that received the Early Access offer in full 12 months after the offer ends, i.e. on 1 February 2028.
• The “Radar for your company” report (radaricp.com/try): we delete the request (email address, website, referral source), the PDF report and the website profile 12 months after they are stored, and the abuse-protection hashes after 30 days. We keep the correspondence as for other requests.
• Statistics of the series, home page, radaricp.com/try page, calculator and demo: up to 24 months.
• Sign-in attempts and the technical error log (may contain the account email address): up to 12 months.
• Account and project data: for as long as the account exists. We do not delete accounts without a plan (from the free beta or after an expired subscription) on our own: you delete them in the panel or ask us to. After a plan expires, project data stays in the account (terms of service, clause 8.3). The exception is the projects of an account with no active plan after the Early Access offer: we delete them 12 months after the end of the offer period, and the owner and administrators of the account receive an email with the deletion date 30 days in advance (terms of service, clause 6.7). The account, people and invoices remain. We keep the data of people at companies on the radar for as long as the project exists, or until deletion on request.
• Profile data: until the profile is deleted, which we carry out after a 14-day grace period (section 5). We keep proof that the request was carried out (date, IP address, content of the declaration, without the name and email address) for 5 years to demonstrate GDPR compliance (Art. 5(2) and Art. 17⁠(3)⁠(e)).
• Invoices and the data on them: 5 years from the end of the year in which the tax payment deadline passed, as required by tax law; the right to erasure does not cover them (Article 17(3)(b) of the GDPR).
• Data from LinkedIn sync: for as long as sync is on; it disappears from backups within 30 days at the latest.
• Integrations: the Claude connector call log for 90 days; OAuth client registrations that nobody used, 30 days; CRM, LinkedIn ads and sync tokens until disconnected.

11. Your rights

You have the right to:

• access your data and receive a copy of it;
• rectify your data;
• have your data erased and its processing restricted;
• data portability;
• object to processing based on our legitimate interest;
• withdraw consent at any time (without affecting what we did before);
• lodge a complaint with the President of the Polish Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or with the data protection authority in your country.

Simply write to kontakt@radaricp.com. We will reply within one month at the latest. These rights also apply to people at the companies the radar finds (section 7).

12. What we do not do

We do not make automated decisions about you, do not profile you for advertising and do not pass data on for sale or to other companies for marketing purposes. Providing data is voluntary, but without it we cannot answer your question, create an account or issue an invoice.

13. Changes

If we change how we process data, we will update this page and the date at the top.