KAFLO Privacy Policy
Version of 15 November 2026. Polski: Polityka prywatności.
1. Controller
The controller of your personal data is Kamil Rataj, ul. Atletyczna 27, 62-065 Grodzisk Wielkopolski, email kaflo.wyceny@gmail.com, phone +48 798 377 596. For any privacy request, email that address.
2. The App keeps your data on your device
Quotes, price lists, logo and company details you enter in KAFLO are stored only in your browser (localStorage). We do not receive them. Your license key is checked on your device without sending it to a server. The site uses no cookies, no analytics and no advertising tools. Browser storage is used only to run the App you asked for.
3. What we process, why, and for how long
| When | Data | Purpose and legal basis (GDPR) | Retention |
|---|---|---|---|
| You buy a plan | email, plan, amount, date, transaction ID, license ID | delivering and resending your key, support (Art. 6(1)(b)); our sales record required by Polish law (Art. 6(1)(c)) | sales record: 5 years from the end of the tax year; email and license ID: until contract claims are time-barred |
| You sign up for tips by email | email, language, traffic source, consent text and date, confirmation date, sending and reply history | sending the emails you agreed to (Art. 6(1)(a)) | until you withdraw consent; unconfirmed signups are anonymized after 30 days; after you unsubscribe your address stays on a do-not-email list for 3 years (Art. 6(1)(f)) |
| You write to us | email, message | replying and handling claims (Art. 6(1)(b), (c) and (f)) | until resolved, then until claims are time-barred |
| You visit the site | IP address, browser type, request time in server logs | running and securing the site (Art. 6(1)(f)) | per the hosting provider's rules |
4. Who receives data
- Gumroad, Inc. (USA): reseller and merchant of record for US dollar purchases, acting as a separate controller under its own policy.
- Naffy: order and payment platform for purchases in Polish zloty, with its payment provider.
- Google (Gmail, Google Sheets, Apps Script): the mailbox that sends keys and emails, and the sheet with the sales record and signups.
- The site's hosting provider (Netlify, Inc. or Cloudflare, Inc.).
- Public authorities where the law requires it.
Some of these providers are based in the USA. Transfers outside the European Economic Area rely on the European Commission's adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses used by the provider.
5. Your rights
You have the right to access, rectify and erase your data, to restrict processing, to data portability, and to object to processing based on legitimate interests. You can withdraw consent to emails at any time with the link in every email or by replying "STOP"; this does not affect earlier emails. You can lodge a complaint with a supervisory authority, in Poland the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, or with the authority in your country.
6. Automated decisions
We make no decisions with legal effects about you based solely on automated processing and we do not profile you. Only technical steps are automated: sending your key after payment, the email series, and replying with demo links when you ask for them.