Privacy Policy

1. Data controller

The controller of the personal data of Users of naszprojekt.com is Małgorzata Powązka, conducting business under the registered business name Małgorzata Powązka Przedsiębiorstwo Produkcyjno-Handlowo-Usługowe "POW-ARCH", with its registered office at ul. Poprzeczna 31, 98-330 Pajęczno, Polska, Tax Identification Number (NIP): 5741769481, National Business Registry Number (REGON): 100602003 (the “Controller”). Contact for all matters concerning personal data: biuro@naszprojekt.com, telephone +48 604 323 070.

2. Data we process

• Account data — registration, sign-in (e-mail and password or a Google account) and sessions are handled on our behalf by the specialised authentication provider Clerk (Clerk, Inc.). Passwords and sign-in data are stored exclusively by Clerk; we store only the identifier of your Account linked to your Projects and payments.
• Projects — the content of saved Projects (house geometry, Project name and thumbnail). A Project name may contain any text entered by you.
• AI visualisations — when a paid PDF Export is created, selected exterior and interior images and a technical Project material-and-colour set are sent to the OpenAI API to improve photorealism. We do not send the Project name, Account data, payment data or free text entered by the User.
• Payment data — the payment process takes place entirely on the Stripe operator’s side. Stripe directly collects payment-card or other payment-method details, the User’s first and last name, billing address and e-mail address. We receive or may obtain access to the amount, currency, payment status, transaction identifiers, customer details and invoice data linked to the Project identifier. When a purchase is made without an Account, the transaction identifier is saved in the browser as proof of purchase. We never receive or store payment-card details.
• Technical data — the IP address is used briefly, solely in server memory, to protect against abuse (limiting the number of sign-in attempts, registration attempts and requests); we do not save it in the database.
• Data collected by analytics and advertising tools (only on the basis of your consent) — cookie identifiers, approximate device and browser information, pages visited, events (for example, starting a design or making a purchase) and the traffic source.

The Controller applies appropriate technical and organisational measures to ensure a level of personal-data protection appropriate to the risks of processing.

3. Purposes and legal bases of processing

• Providing services (maintaining the Account, saving Projects, the editor and handling PDF Export) — Article 6(1)(b) GDPR (performance of a contract).
• Tax and accounting settlements relating to payments — Article 6(1)(c) GDPR (legal obligation).
• Security of the Service (protection against abuse and request rate limiting), and the establishment, pursuit and defence of claims — Article 6(1)(f) GDPR (legitimate interests of the Controller).
• Statistics, effectiveness measurement and advertising (Google Analytics 4, Google Ads and Meta Pixel) — Article 6(1)(a) GDPR (consent), given through the consent banner; storing and accessing information on a device takes place pursuant to Article 399 of the Polish Electronic Communications Law.
• Marketing of the Controller’s own services — Article 6(1)(f) GDPR.

4. Recipients of data

We entrust or disclose data only to the extent necessary for the operation of the Service:

• Clerk, Inc. — registration, sign-in (including with a Google account) and session handling; it processes e-mail addresses, passwords and sign-in data as our processor.
• Vercel Inc. — application hosting and server infrastructure.
• Neon, Inc. — the provider of the managed PostgreSQL database in which Projects and payment data are stored.
• OpenAI Ireland Limited — processing selected Project images and the technical material set through its API to create photorealistic visualisations for the paid PDF Export; data sent through the API is not used to train OpenAI models.
• Stripe, Inc. and the relevant entities of the Stripe group — payment processing, collection of billing details, and creation and delivery of an electronic invoice; Stripe acts as an independent controller of the data collected on the payment page in accordance with its own privacy policy (stripe.com/privacy).
• Google Ireland Ltd. — sign-in with a Google account (through Clerk) and, after consent has been given, analytics (GA4) and advertising (Google Ads); when a User signs in, we receive from Google only the data necessary to authenticate the User, namely the e-mail address and account identifier.
• Meta Platforms Ireland Ltd. — after consent has been given, in connection with Meta Pixel.
• Entities providing us with accounting or legal services — where necessary.

5. Analytics and advertising tools

The tools described below are launched only after you give voluntary consent in the consent banner displayed on your first visit. Until consent is given, no analytics or advertising scripts are loaded, and consent signals are sent to Google using Consent Mode v2. You may withdraw or change your consent at any time in the privacy settings in the Service. Withdrawal of consent does not affect the lawfulness of processing carried out before it was withdrawn.

Google Analytics 4

Provider: Google Ireland Ltd. Purpose: statistics on use of the Service (number of visits, popularity of pages, approximate city-level location and device type). GA4 does not store full IP addresses. The data is pseudonymous and we do not combine it with Account data.

Google Ads

Provider: Google Ireland Ltd. Purpose: measuring advertising effectiveness (conversion tracking, for example registration or the purchase of a PDF Export) and remarketing — displaying our advertisements to people who have visited the Service. You can additionally manage Google ad personalisation at adssettings.google.com.

Meta Pixel (Facebook)

Provider: Meta Platforms Ireland Ltd. Purpose: measuring conversions from advertising run on Facebook and Instagram and remarketing. With regard to collecting data through the Pixel and transmitting it to Meta, we and Meta act as joint controllers under Meta’s “Controller Addendum”; subsequent processing is carried out under Meta’s responsibility. You can manage ad personalisation in the advertising-preference settings on Facebook.

Transfers of data outside the EEA

Use of Google, Meta, Stripe, Vercel, Clerk, Neon and OpenAI services may involve transfers of data to the United States. Such transfers take place on the basis of the European Commission’s adequacy decision (the EU–U.S. Data Privacy Framework, for certified entities) and, additionally, standard contractual clauses.

6. Retention periods

• Account data and Projects — until the Account is deleted by the User or the Controller, and after its deletion for the period necessary to defend against or pursue claims, but no longer than until the relevant limitation periods expire.
• Working Projects without an Account — exclusively locally in your browser (localStorage); they are not sent to our servers and you delete them yourself by clearing browser data.
• Payment data — for the period required by tax and accounting law (as a rule, five years from the end of the relevant tax year).
• Data relating to claims — until the relevant limitation periods expire.
• Analytics and advertising data — until consent is withdrawn, but no longer than the cookie lifetimes specified in section 8.
• IP address used for request rate limiting — briefly in server memory (minutes), without being saved in the database.
• Images and technical data sent to the OpenAI API — in accordance with OpenAI API settings and retention rules, generally for no longer than 30 days for abuse monitoring; the Service keeps the result only temporarily in a cache and in the current browser session.

7. Your rights

In connection with the processing of personal data, you have the following rights:

• access to the data and receipt of a copy of it,
• rectification of the data,
• erasure of the data (including deletion of the Account together with Projects, except for data whose continued storage is required by law),
• restriction of processing,
• data portability,
• objection to processing based on a legitimate interest,
• withdrawal of consent at any time (in relation to analytics and advertising),
• lodging a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland, uodo.gov.pl.

Please send requests to biuro@naszprojekt.com. We respond without undue delay and no later than within one month.

8. Cookies and local storage

The Service uses cookies and browser local storage (localStorage). Items marked “essential” are necessary for the operation of the Service (sign-in, language and local Project storage) and do not require consent. Analytics and advertising cookies are saved only after consent has been given in the banner.

You can also delete and block cookies in your browser settings. Blocking essential cookies may prevent sign-in.

9. Automated decision-making and profiling

We do not make decisions about you based solely on automated processing that would produce legal effects. After consent to advertising cookies has been given, Google and Meta tools may create marketing profiles (for example, remarketing audiences) in order to select advertisements.

Profiling does not produce legal effects for a User or similarly significantly affect the User’s situation.

10. Voluntary provision of data

Providing data is voluntary, but you cannot create an Account without an e-mail address and cannot use PDF Export without making payment. You may use the editor without providing any personal data.

11. Changes to the Policy

This Policy may be updated (for example, if the scope of services or tools changes). A new version will be published on this page with its effective date; Users who have an Account will be informed of material changes.