Privacy Policy
privacy-2026-08Draft — not legally reviewedSkeleton, not finished text. The structure follows the information duty in GDPR art. 13, but the wording is a template and has not been reviewed by a lawyer. Fill in the bracketed placeholders — especially the list of recipients, which depends on the providers you actually use — and have it checked. When it is approved, delete this note and set
draft: false.
1. Controller
The controller of your personal data is [COMPANY NAME], [ADDRESS], VAT ID [VAT ID]. Data protection contact: [EMAIL]. [DPO DETAILS IF ONE IS APPOINTED]
2. What we process
- Account data — name, email address, hashed password, verification status, two-factor settings.
- Session technical data — IP address, browser and device information, sign-in times.
- Billing data — customer reference at the payment provider, subscription and credit history. We never store card data.
- Consents — the wording and version you agreed to, with date and IP address.
- Correspondence — messages sent through the contact form.
3. Purposes and legal bases
| Purpose | Basis |
|---|---|
| Running the account and providing the service | art. 6(1)(b) GDPR — performance of a contract |
| Billing, invoices, accounting | art. 6(1)(c) GDPR — legal obligation |
| Account security, audit trail, abuse prevention | art. 6(1)(f) GDPR — legitimate interest |
| Handling complaints and claims | art. 6(1)(f) GDPR |
| Answering a contact form message | art. 6(1)(f) GDPR |
4. Recipients
Data is entrusted to processors under data processing agreements:
- payment provider — [STRIPE / WHOP],
- outbound email provider — [NAME],
- hosting and infrastructure — [NAME],
- [OTHER SUBPROCESSORS — COMPLETE].
[IF ANY PROVIDER PROCESSES DATA OUTSIDE THE EEA, DESCRIBE THE TRANSFER BASIS, E.G. STANDARD CONTRACTUAL CLAUSES]
5. Retention
- Account data — while the account exists.
- Accounting records — 5 years from the end of the tax year in which the tax became payable (a legal obligation).
- Security audit trail — [PERIOD].
- Data relating to claims — until the limitation period expires.
Deleting an account permanently removes identifying data and credentials. Accounting records remain but no longer identify you; the basis is art. 17(3)(b) GDPR.
6. Your rights
You have the right of access, rectification, erasure, restriction, data portability, and to object to processing based on legitimate interest.
You can download your account data and delete your account yourself in account settings.
You may also lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.
7. Cookies
The Service uses only cookies strictly necessary for it to work: the session cookie that keeps you signed in, and one that remembers your chosen language. There is no analytics or marketing tracking, which is why no cookie consent is requested.
[IF YOU ADD ANALYTICS OR MARKETING TOOLS, UPDATE THIS SECTION AND ADD A CONSENT BANNER THAT BLOCKS THOSE SCRIPTS UNTIL CONSENT IS GIVEN]
8. Automated decision-making
[DESCRIBE IF ANY. If you make no solely automated decisions producing legal effects, say so explicitly.]
9. Changes
Changes are announced in the Service. The version and effective date of each version are shown at the top of this page.