Privacy Policy

This English version is provided for convenience. The binding version of this Policy is the Polish version available in the Polish language setting.

1. Data controller

The controller of personal data of naszprojekt.com users is [UZUPEŁNIJ: nazwa firmy / imię i nazwisko przedsiębiorcy], [UZUPEŁNIJ: ulica, kod pocztowy, miejscowość], Tax ID (NIP): [UZUPEŁNIJ: NIP]. Contact for all data protection matters: biuro@app4you.dev.

2. Data we process

• Account data — registration, sign-in (e-mail and password, or Google) and sessions are handled on our behalf by the specialised authentication provider Clerk (Clerk, Inc.). Passwords and sign-in data are stored only by Clerk — we store just your account identifier linked to your projects and payments.
• Projects — the content of saved projects (house geometry, project name, thumbnail).
• Payment data — the payment process itself takes place entirely on the payment page of Stripe. Data provided there (card or other payment method details, e-mail for the confirmation) is collected directly by Stripe, which is the controller of that data and processes it under its own privacy policy (stripe.com/privacy). We receive and store only: amount, currency, payment status and transaction identifiers, linked to a project identifier (purchase is possible without an account — the transaction identifier is then stored in your browser as proof of purchase). We never receive or store card details.
• Technical data — your IP address is used briefly, in server memory only, for abuse protection (rate limiting of sign-in and registration attempts); it is not stored in our database.
• Analytics and advertising data (only with your consent — section 5) — cookie identifiers, device and browser information, pages visited, events (e.g. starting a design, purchase), traffic source.

3. Purposes and legal bases

• Providing the services (account, projects, editor, PDF export) — art. 6(1)(b) GDPR (contract).
• Tax and accounting obligations regarding payments — art. 6(1)(c) GDPR.
• Service security (abuse protection, rate limiting) and handling legal claims — art. 6(1)(f) GDPR (legitimate interest).
• Statistics and advertising (Google Analytics 4, Google Ads, Meta Pixel) — art. 6(1)(a) GDPR (consent), given via the consent banner.

4. Recipients

• Clerk, Inc. — registration, sign-in (including Google) and session handling; processes e-mail, password and sign-in data as our processor.
• Vercel Inc. — application hosting.
• PostgreSQL database provider — storage of project and payment data.
• Stripe — payment processing, entirely on Stripe's pages (independent controller for data collected at payment; stripe.com/privacy).
• Google — Google sign-in (via Clerk) and, with consent, analytics (GA4) and advertising (Google Ads).
• Meta Platforms Ireland Ltd. — with consent, in connection with the Meta Pixel.
• Accounting or legal service providers, where necessary.

5. Analytics and advertising tools

The tools below run only after you give voluntary consent in the consent banner shown on your first visit. Until then no analytics or advertising scripts are loaded, and consent signals are passed to Google using Consent Mode v2. You can withdraw or change your consent at any time in the privacy settings; withdrawal does not affect the lawfulness of prior processing.

Google Analytics 4

Provider: Google Ireland Ltd. Purpose: usage statistics (visits, popular pages, approximate city-level location, device type). GA4 does not store full IP addresses. The data is pseudonymous and is not linked to your account.

Google Ads

Provider: Google Ireland Ltd. Purpose: measuring ad effectiveness (conversion tracking, e.g. registration or PDF export purchase) and remarketing. You can additionally manage Google ad personalisation at adssettings.google.com.

Meta Pixel (Facebook)

Provider: Meta Platforms Ireland Ltd. Purpose: measuring conversions from ads on Facebook and Instagram, and remarketing. For the collection and transmission of Pixel data we act with Meta as joint controllers under Meta's Controller Addendum; further processing is Meta's responsibility. You can manage ad preferences in your Facebook settings.

Transfers outside the EEA

Using Google, Meta, Stripe, Vercel and Clerk services may involve transfers to the USA, based on the European Commission's adequacy decision (EU–U.S. Data Privacy Framework — Google LLC, Meta Platforms Inc., Stripe Inc., Vercel Inc. and Clerk, Inc. are certified) and, additionally, standard contractual clauses.

6. Retention

• Account data and projects — until the account is deleted.
• Local drafts without an account — stored only in your browser (localStorage); they never reach our servers and you delete them by clearing browser data.
• Payment data — as required by tax and accounting law (generally 5 years from the end of the tax year).
• Claims-related data — until limitation periods expire.
• Analytics and advertising data — until consent is withdrawn, no longer than the cookie lifetimes in section 8.
• IP address for rate limiting — briefly, in server memory only (minutes).

7. Your rights

You have the right to access, rectification, erasure (including deleting your account with its projects), restriction of processing, data portability, objection to processing based on legitimate interest, and withdrawal of consent at any time. You may lodge a complaint with the President of the Polish Personal Data Protection Office (PUODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or your local supervisory authority. Requests: biuro@app4you.dev— we respond within one month at the latest.

8. Cookies and local storage

Items marked "essential" are required for the Service to work (sign-in, language, local project drafts) and do not require consent. Analytics and advertising cookies are set only after you consent in the banner.

9. Automated decision-making and profiling

We do not make solely automated decisions with legal effects about you. With your consent to advertising cookies, Google and Meta tools may build marketing profiles (e.g. remarketing audiences) to select ads.

10. Voluntary provision of data

Providing data is voluntary, but an e-mail address is required to create an account and a payment is required for PDF export. You can use the editor without providing any personal data.

11. Changes to this Policy

This Policy may be updated (e.g. when services or tools change). The new version will be published on this page with its effective date; account holders will be informed of material changes.