Privacy and cookie policy
1. Data controller
The controller of personal data of users of pallet3d.com is Tomasz Stanisławski, conducting unregistered business activity within the meaning of Art. 5(1) of the Polish Entrepreneurs' Law. Contact for data protection matters: tomaszstanislawski2000@gmail.com or via the contact form on the website.
2. What data we process
| Category | Data | Source |
|---|---|---|
| Account data | first and last name, e-mail address, password (stored hashed) | registration form or Google sign-in |
| Billing data | subscription status, Stripe customer and subscription identifiers, billing period dates; we do not receive or store payment card data — it is processed solely by Stripe | Stripe; at purchase we pass to Stripe the first name and e-mail address assigned to the Account |
| Usage data | saved boxes, pallets and load layouts | use of the calculator |
| Contact data | name, e-mail, message content | contact form |
| Technical data | visit and interaction statistics (e.g. page views, referrer); Google statistics require cookies | Cloudflare Web Analytics and Google Analytics (after consent) |
| Demo and security data | an irreversible hash of the IP address together with the number of visits to the demo and counters of the actions performed there (e.g. how many times a calculation was run, how many times the plan preview was opened); the same hash is used to limit the number of free trial periods started from one connection. We also record the two-letter code of the country the connection came from (provided by our infrastructure provider, Cloudflare) — it serves solely for aggregate statistics on which markets the traffic comes from. We do not store the IP address in plain form and we do not link these data to an account | use of the demo and account registration |
3. Purposes and legal bases of processing
- Providing the service (running the account, saving data, handling the subscription) — Art. 6(1)(b) GDPR (performance of a contract).
- Billing and accounting — Art. 6(1)(c) GDPR (legal obligation).
- Responding to enquiries from the contact form — Art. 6(1)(f) GDPR (legitimate interest).
- Statistics and improving the service — cookieless statistics (Cloudflare Web Analytics) on the basis of Art. 6(1)(f) GDPR; Google Analytics statistics (which use cookies) solely on the basis of your consent — Art. 6(1)(a) GDPR, which you may withdraw at any time. We do not use profiling or behavioural advertising.
- Demo statistics and prevention of abuse — counting visits and actions in the demo under an irreversible hash of the IP address, and limiting the number of free trial periods from one connection — Art. 6(1)(f) GDPR (legitimate interest: developing the service and protecting the trial period from abuse). These data do not allow us to establish the visitor's identity and are not linked to an account. The same basis covers the form protection (Cloudflare Turnstile), which distinguishes a human from a bot at login, registration, contact and password recovery.
- Service communication (e.g. notice that the trial period is ending) — Art. 6(1)(b)/(f) GDPR. Product news is sent only to people who ticked a separate, voluntary consent — Art. 6(1)(a) GDPR. That consent can be withdrawn at any time: through the link in the footer of every such message or in the account settings. Withdrawing it does not affect e-mails about the account itself.
4. Data recipients
We share data only with entities necessary for the operation of the service. Cloudflare, Resend and Google process it on our behalf (as processors). Stripe, as the merchant of record for the subscription, acts in respect of payments as a separate controller — it processes data in its own name for the purposes of settling the transaction, taxes and preventing abuse, under its own privacy policy:
- Cloudflare, Inc. — hosting, infrastructure, statistics, form protection (Turnstile); transfers outside the EEA are possible on the basis of standard contractual clauses,
- Stripe Payments Europe, Ltd. (Ireland) together with Stripe, Inc. (USA) — payment handling and settlement of the subscription in the role of merchant of record; we pass on the first name and e-mail address and receive the subscription status and payment identifiers (transfers outside the EEA are possible on the basis of standard contractual clauses),
- Resend, Inc. — sending e-mail messages concerning the account and the service (address confirmation, trial period reminders, replies to support requests and, for those who have given consent, news updates); we pass on the e-mail address, first name and message content (transfers outside the EEA are possible on the basis of standard contractual clauses),
- Google LLC / Google Ireland Ltd. — Google sign-in and visit statistics (Google Analytics and Google Tag Manager) after consent is given; transfers outside the EEA are possible on the basis of standard contractual clauses.
We do not sell personal data and we do not share it with third parties for marketing purposes.
5. Retention period
- Account data — for as long as the account exists, and after its deletion for a maximum of 30 days (backups).
- Billing data — for the period required by tax and accounting regulations (as a rule 5 years). Documentation of the payment transactions themselves is kept by Stripe as merchant of record, in accordance with its own legal obligations.
- Correspondence — up to 12 months after the matter is closed.
- Demo data and IP address hashes — up to 12 months from the last visit.
6. User rights
Every user has the right to: access their data, rectify it, erase it, restrict processing, data portability, object, and lodge a complaint with the President of the Personal Data Protection Office (the Polish supervisory authority). To exercise your rights, contact us via the form on the website.
7. Cookies and similar technologies
| Technology | Purpose | Type |
|---|---|---|
| token cookie (httpOnly) | keeping the logged-in user's session | necessary — 7 days |
| localStorage | preferences (language) and a local cache of calculator data | necessary — until deleted by the user |
| Cloudflare Turnstile | protection of forms (login, registration, contact, password recovery) against automated account creation and spam | necessary (security) — not used for tracking or profiling |
| Cloudflare Web Analytics | anonymised visit statistics | no cookies, no cross-site tracking |
| Google Analytics cookie (_ga, _ga_*) | visit and traffic statistics | analytics — only after consent, up to 24 months |
| Google Tag Manager | managing the loading of statistics tags | loads tags according to your consent (Consent Mode) |
Analytics cookies (Google Analytics) are stored only after you give consent in the cookie banner. We use Google Consent Mode: until consent is given, no analytics or advertising cookies are stored. Before you consent, only anonymous, cookieless and aggregated statistical signals may reach Google (without a user identifier and without tracking between visits); after consent is given, full cookie-based statistics are activated. You may change or withdraw your consent at any time using the “Cookie settings” link in the page footer, or by deleting cookies and localStorage in your browser settings. We do not use advertising cookies or cross-site tracking. Necessary files (login session, preferences) always work — without them the service could not function; deleting them may make logging in impossible.
8. Security
Data transmission is encrypted (TLS/HTTPS with HSTS), passwords are stored only as a hash (PBKDF2), and only authorised persons have access to the data.
9. Changes to the policy
We may update the policy as the service develops — the version in force is always available at this address, together with its effective date.