Privacy Policy

1. Controller

The controller of your personal data is Robert Brzoza, 250 Prospect Ave, Meriden, CT 06451, USA. For data protection matters, write to kontakt@pisaczek.pl.

2. What data we process

• Account data: e-mail address, first name (if you provide it), a hash of your password, plan, language, time zone, creation and last sign-in dates.
• Content you add: notes, files, calendar entries, settings, chat messages, questions to search and the Assistant.
• Security data: sign-in history, IP address and browser information, the encrypted two-factor key, hashes of backup codes, the record of accepting the Terms (date, version, IP address).
• Device data: the app identifier on your device and the notification subscription, if you enable notifications.
• Data from integrations you enable: e.g. encrypted access details for your mailbox or a connection to Google Calendar.
• Payment and invoice data: if you buy a paid service – the transaction identifier and status, amount and currency, the country of residence you give at purchase and the country derived from your IP address (evidence required for VAT), and for business purchases – company name, address and VAT number (checked in the EU VIES database). We use this data to issue invoices. We do not store card data; the payment operator handles it.
• Approximate location: the country derived from your IP address, to choose the language and currency.
• Location in the Pisaczek Android app (“Store reminder” feature, only if you turn it on): the locations of stores you save and your phone’s current location, also in the background when the app is closed or not in use. It is used only to remind you of your shopping list when you enter a saved store. This data is processed only on your phone (using Google Play location services on the device) and is not sent to Pisaczek. You can delete it by deleting stores in the app or revoking the location permission in your phone settings.
• Shopping list without an account: if you use Shopping without signing in, the list is stored only in your browser; only the text of an item you add is sent to Pisaczek to recognise its quantity and aisle – without storing it.
• Pantry, meal plan, prices and loyalty cards in Shopping: we store what you add – pantry items with expiry dates, your meal plan (with the recipe address, if you give one), prices and totals from receipts you confirm, and deals marked on the list; people on your list can see them. Loyalty cards (store name and card number) are visible only to you – your device draws the card code, and we do not pass the numbers to stores or anyone else. You can delete all of this in the app at any time.
• Adding people to a Shopping list: when a list owner enters your e-mail address, we check whether you have a Pisaczek account and send you a notification and an invitation e-mail (the inviter’s name and the list name). You join the list only after accepting; you can decline, and the invitation expires after 14 days.

3. Purposes and legal bases

• Providing Pisaczek, running your Account and carrying out your instructions – Article 6(1)(b) GDPR (contract).
• Security, abuse prevention, proof of accepting the Terms, establishing and defending claims, service statistics – Article 6(1)(f) GDPR (our legitimate interest).
• Handling complaints and notices of illegal content, and accounting and tax obligations for payments – Article 6(1)(c) GDPR (legal obligation).
• Newsletter and marketing information – Article 6(1)(a) GDPR (consent), only if you give it. You can withdraw consent at any time.

4. Who receives the data

We share data only as needed to provide the services, with entities acting on our behalf:

• server provider: DigitalOcean (data centre in Frankfurt, Germany);
• artificial intelligence model providers: OpenAI and Anthropic (USA) – only the content of requests to search, the Assistant and voice features, and photos you send in Shopping to read a list or a receipt (we do not store the photos – only the items and prices read, after you confirm them);
• payment operators: Tpay (Krajowy Integrator Płatności S.A.) and PayPal – for purchases and subscriptions;
• the European Commission (VIES database) – a business VAT number, only to verify it;
• tax authorities – sales data in VAT (OSS) returns, as required by law;
• browser and system notification services (Google, Apple, Microsoft, Mozilla) – if you enable notifications;
• Google – if you connect Pisaczek to Google Calendar.

We send e-mail from our own server. Data may be disclosed to public authorities where required by law.

5. Transfers outside the European Economic Area

The controller runs Pisaczek from the USA, and data is stored on servers in Frankfurt (Germany). Some providers are based in the USA. Transfers rely on the European Commission’s adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses. You can obtain a copy of the safeguards by writing to kontakt@pisaczek.pl.

6. How long we keep data

• Account data and your content – until you delete the Account or the content; items in the trash – until permanently deleted.
• Backups – deleted data disappears from backups as they rotate.
• Sign-in history and security data – no longer than 12 months.
• The record of accepting the Terms and data needed to defend claims – until limitation periods expire.
• Invoices and country evidence for VAT (OSS) – 10 years from the end of the year of the sale (required by EU VAT rules); other payment documents – for the period required by tax law.

7. Your rights

You have the right to access your data, rectify it, erase it, restrict processing, data portability, to object to processing based on legitimate interest and to withdraw consent at any time (without affecting the lawfulness of earlier processing). You can handle most of them yourself in Pisaczek: Account → Privacy and data (view and download your data, change your e-mail, consents, account deletion, request form). You can also write to kontakt@pisaczek.pl. You may also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw), or the authority in your country.

Providing data is voluntary, but an e-mail address and password are required to create an Account. We do not make decisions based solely on automated processing that produce legal effects for you.

8. Cookies and device storage

We use only cookies and browser storage necessary for Pisaczek to work: the sign-in session, the “Remember me” feature (up to 30 days), the chosen language and the storage of the app installed from the browser, which makes Pisaczek start faster. We do not use advertising or tracking cookies. You can delete cookies in your browser settings, but you will then be signed out.

9. Security

The connection to Pisaczek is encrypted (HTTPS). Passwords are stored only as hashes, and two-factor keys and mailbox passwords are encrypted. We recommend enabling two-factor sign-in.

10. Data you process

If you enter other people’s data into Pisaczek (e.g. clients booking appointments or message recipients), you are its controller and we process it on your behalf as described in § 8 of the Terms.

11. Changes

We will announce material changes to this Privacy Policy in Pisaczek or by e-mail. This Policy applies from 20 October 2026.