Privacy and cookie policy
1. Data controller
The controller of personal data of users of pallet3d.com is Tomasz Stanisławski, conducting unregistered business activity within the meaning of Art. 5(1) of the Polish Entrepreneurs' Law. Contact for data protection matters: tomaszstanislawski2000@gmail.com or via the contact form on the website.
2. What data we process
| Category | Data | Source |
|---|---|---|
| Account data | first and last name, e-mail address, password (stored hashed) | registration form or Google sign-in |
| Billing data | subscription status, payment identifiers; card data is processed solely by Stripe | payment provider Stripe |
| Usage data | saved boxes, pallets and load layouts | use of the calculator |
| Contact data | name, e-mail, message content | contact form |
| Technical data | visit and interaction statistics (e.g. page views, referrer); Google statistics require cookies | Cloudflare Web Analytics and Google Analytics (after consent) |
3. Purposes and legal bases of processing
- Providing the service (running the account, saving data, handling the subscription) — Art. 6(1)(b) GDPR (performance of a contract).
- Billing and accounting — Art. 6(1)(c) GDPR (legal obligation).
- Responding to enquiries from the contact form — Art. 6(1)(f) GDPR (legitimate interest).
- Statistics and improving the service — cookieless statistics (Cloudflare Web Analytics) on the basis of Art. 6(1)(f) GDPR; Google Analytics statistics (which use cookies) solely on the basis of your consent — Art. 6(1)(a) GDPR, which you may withdraw at any time. We do not use profiling or behavioural advertising.
- Service communication (e.g. notice that the trial period is ending) — Art. 6(1)(b)/(f) GDPR.
4. Data recipients
We entrust data only to entities necessary for the operation of the service:
- Cloudflare, Inc. — hosting, infrastructure, statistics (transfers outside the EEA are possible on the basis of standard contractual clauses),
- Stripe, Inc. — payment handling,
- Google LLC / Google Ireland Ltd. — Google sign-in and visit statistics (Google Analytics and Google Tag Manager) after consent is given; transfers outside the EEA are possible on the basis of standard contractual clauses.
We do not sell personal data and we do not share it with third parties for marketing purposes.
5. Retention period
- Account data — for as long as the account exists, and after its deletion for a maximum of 30 days (backups).
- Billing data — for the period required by tax law (as a rule 5 years).
- Correspondence — up to 12 months after the matter is closed.
6. User rights
Every user has the right to: access their data, rectify it, erase it, restrict processing, data portability, object, and lodge a complaint with the President of the Personal Data Protection Office (the Polish supervisory authority). To exercise your rights, contact us via the form on the website.
7. Cookies and similar technologies
| Technology | Purpose | Type |
|---|---|---|
| token cookie (httpOnly) | keeping the logged-in user's session | necessary — 7 days |
| localStorage | preferences (language) and a local cache of calculator data | necessary — until deleted by the user |
| Cloudflare Web Analytics | anonymised visit statistics | no cookies, no cross-site tracking |
| Google Analytics cookie (_ga, _ga_*) | visit and traffic statistics | analytics — only after consent, up to 24 months |
| Google Tag Manager | managing the loading of statistics tags | loads tags according to your consent (Consent Mode) |
Analytics cookies (Google Analytics) are stored only after you give consent in the cookie banner. We use Google Consent Mode: until consent is given, no analytics or advertising cookies are stored. Before you consent, only anonymous, cookieless and aggregated statistical signals may reach Google (without a user identifier and without tracking between visits); after consent is given, full cookie-based statistics are activated. You may change or withdraw your consent at any time using the “Cookie settings” link in the page footer, or by deleting cookies and localStorage in your browser settings. We do not use advertising cookies or cross-site tracking. Necessary files (login session, preferences) always work — without them the service could not function; deleting them may make logging in impossible.
8. Security
Data transmission is encrypted (TLS/HTTPS with HSTS), passwords are stored only as a hash (PBKDF2), and only authorised persons have access to the data.
9. Changes to the policy
We may update the policy as the service develops — the version in force is always available at this address, together with its effective date.