Privacy Policy

1. Data controller

The controller of Users’ personal data is [company name], [address], tax ID (NIP) [number] (“we”). For data protection matters, write to [e-mail address].

2. Two roles: controller and processor

We are the controller of the data we need to run your account and billing: first name, last name, e-mail address, company details for invoicing, payment history, notification settings and technical logs.

The data your company enters into the Service — clients, contact persons, quotes, orders, attachments and e-mail messages in the inbox — is controlled by your company. We process it on its behalf, under a data processing agreement, solely to provide the service.

3. Purposes and legal bases

• Creating and running your account, providing the services, handling teams and invitations — performance of a contract (Art. 6(1)(b) GDPR).
• Billing, invoices and accounting — legal obligation (Art. 6(1)(c) GDPR).
• E-mails about events in the Service (e.g. a new quote, an upcoming deadline) — performance of a contract; you can turn them off in notification settings or with the link in the message.
• Security, abuse prevention, sign-in attempt limits and error monitoring — legitimate interest (Art. 6(1)(f) GDPR).
• Establishing, exercising or defending legal claims — legitimate interest.

Providing data is voluntary, but an account cannot be created without an e-mail address and password.

4. Recipients

We use providers that process data on our behalf under data processing agreements:

• Supabase — database, authentication and file storage;
• Vercel — application hosting;
• Anthropic — the AI model behind OperatorAI; receives the conversation and the data needed to answer;
• Resend — sending and receiving e-mail;
• Stripe — payments and subscriptions;
• Sentry — error monitoring (EU region, no IP addresses, with e-mail addresses, tax IDs and phone numbers removed).

Company details by tax ID are retrieved from the public REGON registry run by Statistics Poland (GUS). Public authorities may also receive data where the law requires it.

5. Transfers outside the EEA

Some providers are based in the United States. Transfers rely on the European Commission’s EU-US Data Privacy Framework adequacy decision (for certified providers) or on standard contractual clauses approved by the Commission. [To be confirmed for each provider.]

6. Retention

• Account data — until the account is deleted, and afterwards for the limitation period for claims.
• Billing data — 5 years from the end of the year in which the tax obligation arose.
• Data entered by a company — until the company deletes it or deletes the company.
• OperatorAI conversations and attachments — according to the retention setting in the Service; deleted files are also removed from the model provider.
• Error logs — [Sentry retention period].
• Backups — overwritten on a [period] cycle.

7. Your rights

You have the right to access, rectify and erase your data, to restrict its processing and to data portability, and the right to object to processing based on legitimate interest. You can delete your account yourself in profile settings (Account, Delete account). To exercise the other rights, write to [e-mail address].

If you believe we process data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, Poland).

If your data was entered into the Service by a company you work with (e.g. as its client), it is best to exercise your rights with that company — it is the controller of that data.

8. Cookies

We only use cookies that are strictly necessary for the Service to work:

• sign-in session (Supabase) — keeps you signed in;
• interface language;
• interface layout — collapsed sidebar and panel sizes.

We do not use analytics, advertising or tracking cookies, so we do not ask for cookie consent. You can delete cookies in your browser settings — this signs you out of the Service.

9. OperatorAI

Conversations with OperatorAI are private — other company members cannot see them unless you share a conversation. To prepare an answer, we send the model provider the conversation, attached files and the Service data the assistant requested in that conversation. Under the provider’s commercial terms, this data is not used to train models. [To be confirmed against the provider’s current terms.]

OperatorAI does not make decisions that produce legal effects concerning you — you can review and undo every change it saves.

10. Security

Connections are encrypted (HTTPS). Each company’s data is isolated at the database level (Row Level Security) and is accessible only to that company’s members according to their permissions.

11. Changes and language versions

We will inform you of material changes to this policy by e-mail or by a notice in the Service. The date of the current version is shown at the top of the page.

This policy is available in Polish and English. The Polish version is binding; the English version is a translation.