Privacy Policy

Effective date: July 1, 2025 · Controller: Puzzles Sp. z o.o.

What data we collect

Category	Examples	Purpose
Identity data	Email address, display name	Account creation and management
Authentication data	Password hash (bcrypt), session tokens, Google ID	Secure login
Profile picture	Image file uploaded by the user	Account personalisation (optional)
Inventory content	Item names, photos, locations, tags	Providing the service
Subscription data	Plan tier, expiry date	Billing and feature access
Technical data	IP address, server logs, session cookies	Security and diagnostics
Consent records	Date of terms and GDPR acceptance	Documenting consents

Legal bases for processing

Art. 6(1)(b) GDPR — performance of a contract (providing the service).

Art. 6(1)(c) GDPR — compliance with a legal obligation.

Art. 6(1)(f) GDPR — legitimate interests (system security, fraud prevention).

Art. 6(1)(a) GDPR — consent (profile picture, marketing communications).

How long we keep data

Account data — for the lifetime of the account and 30 days after deletion.

Technical logs — up to 90 days.

Billing data — 5 years (tax obligation).

After the retention period, data is anonymised or permanently deleted.

Who we share data with

Data is never sold or shared for marketing purposes. Shared only with:

Infrastructure providers — hosting services (under data processing agreements).

AI providers (Anthropic) — photos and item names sent ONLY when you actively trigger AI recognition or packing suggestions; not retained by the provider beyond handling that single request.

Payment processors — only data necessary for transactions.

Public authorities — where required by law.

Data is stored on servers within the EEA or covered by appropriate GDPR safeguards.

Cookies

The App uses only technical (httpOnly) cookies necessary for session management. No tracking or marketing cookies. Session cookies are deleted on logout or token expiry.

Your rights

Access

Obtain a copy of your data.

Rectification

Correct inaccurate data.

Erasure

Delete your account in profile settings.

Restriction

Pause processing in certain cases.

Portability

Data export available in the app.

Objection

Object to legitimate-interest processing.

To exercise your rights, email kontakt@gdziecomam.pl or delete your account in profile settings.

You may also lodge a complaint with the President of the UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

Data security

We apply: password hashing (bcrypt), HTTPS encryption, httpOnly tokens, access restricted to authorised personnel.

Changes to this Policy

We will notify you of material changes at least 14 days in advance by email or in-app message.

GDPR Information Clause

Article 13 of Regulation (EU) 2016/679

Data Controller

Puzzles Sp. z o.o., ul. Sosnowa 7, 44-203 Rybnik, Polska

Email: kontakt@gdziecomam.pl

Purposes and legal bases

Providing the service — Art. 6(1)(b) GDPR (contract performance)

Legal obligations — Art. 6(1)(c) GDPR

System security — Art. 6(1)(f) GDPR (legitimate interest)

Consent records — Art. 6(1)(c) GDPR

Recipients

Hosting and infrastructure processors (under data processing agreements), payment processors, public authorities as required by law. AI model provider (Anthropic) — only data submitted as part of the photo recognition and packing suggestion features you initiate.

Retention period

For the duration of the account, then until claims are time-barred or archiving obligations expire, no longer than 5 years.

Your rights

Right of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent (without affecting prior lawful processing).

Right to complain

You may lodge a complaint with the President of the UODO, ul. Stawki 2, 00-193 Warsaw.

Voluntary provision of data

Email address — required to create an account.

Display name and profile picture — optional, not required to use the service.

Automated decision-making

Your data is not used for automated decision-making or profiling within the meaning of Art. 22 GDPR.

Data protection enquiries: kontakt@gdziecomam.pl