Privacy Policy

1. Controller

The controller of your personal data is Tymoteusz Mróz, trading as Montinea Tymoteusz Mróz, ul. Krupówki 30, 34-500 Zakopane, Poland, tax ID (NIP) 7361581631, registered in the Central Register and Information on Economic Activity (CEIDG) in Poland (“we”). Contact on data matters: hello@papelot.com, or in writing to the address above.

2. What data we process, why, and on what legal basis

• Access requests and accounts: name, email address, organisation name, the note included with your request — to create your account and provide the service (Article 6(1)(b) GDPR: steps prior to entering into a contract and performance of a contract).
• Billing: invoicing details, payment and invoice history — to issue invoices and keep tax records (Article 6(1)(c) GDPR: legal obligation).
• Using the service: team membership, role, information on who made each change to a flatplan and when, date of last login — so the service works and your team can see the history of its work (Article 6(1)(b) GDPR).
• Service messages: subscription renewal reminders, notices of changes to the terms and plans, warnings before an inactive account is deleted — to keep you informed about your contract (Article 6(1)(b) GDPR).
• Technical data: IP address, browser type, server logs and security events — to keep the service secure and detect abuse (Article 6(1)(f) GDPR: our legitimate interest).
• Correspondence: messages sent to hello@papelot.com — to reply and deal with your request (Article 6(1)(f) GDPR).
• Legal claims: data needed to establish, exercise or defend legal claims (Article 6(1)(f) GDPR).

Providing data is voluntary, but you cannot create an account without an email address, or buy a paid plan without invoicing details. We do not profile users or make decisions about them based solely on automated processing.

3. Data that teams enter into flatplans

Flatplans may contain other people’s data, such as names of authors, clients’ contact persons or the text of notes. For that data, the customer using Papelot (the team) is the controller, and we process it on the customer’s behalf as a processor, under the data processing agreement in section 8 of the Terms of Service. For questions about such data, it’s best to contact the team that entered it.

4. The papelot.com website and cookies

The website does not use cookies for tracking or profiling. We collect visit statistics with Vercel Web Analytics, which does not set cookies or identify individuals. The only things we store in your browser are site settings (such as the currency and billing period chosen on the pricing page), kept in local storage — this data is not sent to us.

The app at app.papelot.com uses cookies and browser storage solely to keep you logged in and to remember interface settings. They are strictly necessary to provide the service, so they do not require consent.

5. Recipients and location of data

We use the following providers (sub-processors):

• Supabase — database and authentication; data is stored in a data centre in Frankfurt am Main, Germany (AWS region eu-central-1).
• Vercel — hosting for the website and the app, and PDF generation.
• Resend — sending system emails (login, invitations, notifications).
• Stripe — payment processing; card details are processed by Stripe only.
• wFirma — issuing invoices and handling Poland’s National e-Invoicing System (KSeF); data stored in Poland.

Vercel, Resend and Stripe may process data in the United States. Such transfers are based on the European Commission’s adequacy decision (EU-US Data Privacy Framework) for providers certified under it and, otherwise, on standard contractual clauses approved by the Commission. We will provide a copy of the safeguards on request. Public authorities may also receive data where the law requires it.

6. How long we keep data

• Account data and flatplan content — for as long as you use the service. After an account is deleted, its data is permanently removed within 30 days.
• Teams on the Free plan where nobody has logged in for 12 months — deleted after a warning sent by email at least 30 days before deletion.
• Backups — up to 30 days; deleted data disappears from backups after that time at the latest.
• Access requests that did not lead to an account — up to 12 months.
• Billing data and invoices — for the period required by tax law (generally 5 years from the end of the year in which the tax obligation arose).
• Correspondence — up to 2 years after the matter is closed.
• Technical logs — up to 90 days.
• Data needed to establish, exercise or defend legal claims — until those claims become time-barred.

7. Security

Connections to Papelot are encrypted, only the team the data belongs to can access it, and each team’s data is kept separate from the others. We make backups and log security events.

8. Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing, to data portability, and to object to processing based on our legitimate interest (Articles 15–21 GDPR). Exporting your team’s data and deleting your account are available in the app settings; for anything else, write to hello@papelot.com. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland or with the data protection authority in the country where you live or work.

9. Changes

We will let you know about significant changes to this policy by email and on this page. The date of the last update is shown at the top.