Draft document. The entity details and tax ID are real. Retention periods, the limitation of liability and the commercial model are sample data — they show the document’s complete shape and are not binding until settled.

Privacy policy

This document describes what personal data we process in connection with the Splotra service, on what legal basis and for how long. It describes how the system actually behaves, not what we intend to build.

1. Data controller

The data controller is Marcin Górawski, a natural person conducting business as Digital Marcin Górawski, a sole proprietorship registered in Poland, ul. Górki 19G/49, 60-204 Poznań, Poland, tax ID (NIP) 927-196-38-44. Data protection contact: admin@splotra.com.

2. What data we process

Category	Scope	Source
Account data	e-mail address, username, password hash, second-factor secret	provided by you when the account is created
Team data	team name, memberships, invitations (invitee e-mail address)	provided by you while using the service
Data you upload	contents of the files and source URLs you point us at, typically a product catalogue	provided by you, or fetched from the address you supplied
Technical data	request correlation identifiers, timestamps, status codes, IP address in proxy logs	generated automatically

We do not write the contents of your source records into logs. Logs carry identifiers and metrics, so that an operation can be traced without duplicating your data in a second place.

3. Legal basis and purpose

• Performance of a contract (GDPR Art. 6(1)(b)) — operating your account, providing the service, storing and publishing the data you entrust to us.
• Legitimate interest (GDPR Art. 6(1)(f)) — service security, abuse detection, pursuing legal claims.
• Legal obligation (GDPR Art. 6(1)(c)) — accounting and record keeping.

4. Retention

Account and team data — for as long as you use the service and 30 days after account closure (sample period). Data you upload — until you delete it or close the account; historical versions are immutable by design, and deletion covers them as well. Technical logs — 12 months (sample period).

5. Processors

We use infrastructure providers that process data solely on our instructions:

• Hetzner Online GmbH — the server running the application and database.
• Cloudflare — object storage (artifacts and backups).

Authentication runs on our own infrastructure, without a third-party identity provider. We do not share your data for marketing purposes and we do not sell it.

6. Cookies and tracking

This website sets no cookies and loads no external resources — there is no analytics, no social plugins and no fonts fetched from third-party servers. The signed-in application uses strictly necessary session cookies only; they are marked httpOnly and are not accessible to scripts in the browser.

7. Your rights

You have the right to access your data, rectify it, erase it, restrict processing, port it, and to object to processing based on legitimate interest. You may lodge a complaint with the Polish data protection authority (Prezes Urzędu Ochrony Danych Osobowych). Send requests to the address in section 1.

8. Security

Connections are encrypted with TLS. Irreversible operations — publishing, rolling back, issuing an API token, inviting someone to a team — require a fresh second-factor authentication. One team’s data is isolated from another’s at the level of database queries and object storage keys.

9. Changes

We announce material changes before they take effect. Last updated: 11 September 2026.