This document is shown in English. The Polish version is binding.
1. Controller
The controller of your personal data is Robert Brzoza, 250 Prospect Ave, Meriden, CT 06451, USA. For data protection matters, write to kontakt@pisaczek.pl.
2. What data we process
- Account data: e-mail address, first name (if you provide it), a hash of your password, plan, language, time zone, creation and last sign-in dates.
- Content you add: notes, files, calendar entries, settings, chat messages, questions to search and the Assistant.
- Security data: sign-in history, IP address and browser information, the encrypted two-factor key, hashes of backup codes, the record of accepting the Terms (date, version, IP address).
- Device data: the app identifier on your device and the notification subscription, if you enable notifications.
- Data from integrations you enable: e.g. encrypted access details for your mailbox or a connection to Google Calendar.
- Payment and invoice data: if you buy a paid service – the transaction identifier and status, amount and currency, the country of residence you give at purchase and the country derived from your IP address (evidence required for VAT), and for business purchases – company name, address and VAT number (checked in the EU VIES database). We use this data to issue invoices. We do not store card data; the payment operator handles it.
- Approximate location: the country derived from your IP address, to choose the language and currency.
3. Purposes and legal bases
- Providing Pisaczek, running your Account and carrying out your instructions – Article 6(1)(b) GDPR (contract).
- Security, abuse prevention, proof of accepting the Terms, establishing and defending claims, service statistics – Article 6(1)(f) GDPR (our legitimate interest).
- Handling complaints and notices of illegal content, and accounting and tax obligations for payments – Article 6(1)(c) GDPR (legal obligation).
- Newsletter and marketing information – Article 6(1)(a) GDPR (consent), only if you give it. You can withdraw consent at any time.
4. Who receives the data
We share data only as needed to provide the services, with entities acting on our behalf:
- server provider: DigitalOcean (data centre in Frankfurt, Germany);
- artificial intelligence model providers: OpenAI and Anthropic (USA) – only the content of requests to search, the Assistant and voice features;
- payment operators: Tpay (Krajowy Integrator Płatności S.A.) and PayPal – for purchases and subscriptions;
- the European Commission (VIES database) – a business VAT number, only to verify it;
- tax authorities – sales data in VAT (OSS) returns, as required by law;
- browser and system notification services (Google, Apple, Microsoft, Mozilla) – if you enable notifications;
- Google – if you connect Pisaczek to Google Calendar.
We send e-mail from our own server. Data may be disclosed to public authorities where required by law.
5. Transfers outside the European Economic Area
The controller runs Pisaczek from the USA, and data is stored on servers in Frankfurt (Germany). Some providers are based in the USA. Transfers rely on the European Commission’s adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses. You can obtain a copy of the safeguards by writing to kontakt@pisaczek.pl.
6. How long we keep data
- Account data and your content – until you delete the Account or the content; items in the trash – until permanently deleted.
- Backups – deleted data disappears from backups as they rotate.
- Sign-in history and security data – no longer than 12 months.
- The record of accepting the Terms and data needed to defend claims – until limitation periods expire.
- Invoices and country evidence for VAT (OSS) – 10 years from the end of the year of the sale (required by EU VAT rules); other payment documents – for the period required by tax law.
7. Your rights
You have the right to access your data, rectify it, erase it, restrict processing, data portability, to object to processing based on legitimate interest and to withdraw consent at any time (without affecting the lawfulness of earlier processing). You can handle most of them yourself in Pisaczek: Account → Privacy and data (view and download your data, change your e-mail, consents, account deletion, request form). You can also write to kontakt@pisaczek.pl. You may also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw), or the authority in your country.
Providing data is voluntary, but an e-mail address and password are required to create an Account. We do not make decisions based solely on automated processing that produce legal effects for you.
8. Cookies and device storage
We use only cookies and browser storage necessary for Pisaczek to work: the sign-in session, the “Remember me” feature (up to 30 days), the chosen language and the storage of the app installed from the browser, which makes Pisaczek start faster. We do not use advertising or tracking cookies. You can delete cookies in your browser settings, but you will then be signed out.
9. Security
The connection to Pisaczek is encrypted (HTTPS). Passwords are stored only as hashes, and two-factor keys and mailbox passwords are encrypted. We recommend enabling two-factor sign-in.
10. Data you process
If you enter other people’s data into Pisaczek (e.g. clients booking appointments or message recipients), you are its controller and we process it on your behalf as described in § 8 of the Terms.
11. Changes
We will announce material changes to this Privacy Policy in Pisaczek or by e-mail. This Policy applies from 7 October 2026.