Privacy policy

1Who is responsible for your data

The controller of personal data in the PrezentOS app and on the websites prezentos.apps-net.pl and prezentos.com is AC GROUPS POLSKA spółka z ograniczoną odpowiedzialnością (KRS 0000955652, NIP 5492466220, REGON 521271810), ul. Łączna 14, 32-600 Oświęcim, Poland.

For any matter concerning your data, please contact us at kontakt@apps-net.pl.

2What data we collect and why

• First nameYou give it when you sign up. We share it with your friends and with the people you share your list with, so they know whose gift list they are looking at.
• Email addressUsed to sign you in and to tell accounts apart. Friends don’t see it by default — they only see it if you turn on “Friends see my e-mail” in Settings (described below).
• Permission to show your e-mail to friendsWe store whether you allowed friends to see your e-mail address in Settings (Data → “Friends see my e-mail”), and when you last changed that choice. By default you haven’t. When you turn the option on, your friends — people who are your friends in the app — see your e-mail in “Details”, can copy it and write to you from their own mail app; we don’t send any messages to you or to them because of it. The address doesn’t appear in search results or invitations, and when you turn the option off your friends stop seeing it at once (we don’t keep a copy on their side; they may have copied it earlier). We keep the permission until you delete the account, and you can withdraw it at any time. Legal basis: consent (Art. 6(1)(a) GDPR).
• PasswordIt must be at least 8 characters long and cannot be one of the most common passwords, your first name or your email address. We do not store it in plain text: we save only an irreversible hash with a randomly generated “salt”. Once you turn on encryption (section 16), instead of your password the app sends the server a sign-in key derived from your password on your device — and it is the hash of that key that we store. We do not know your password and we cannot recover it or send it to you. If you have encryption turned on, you can set a new password with your recovery code; in all other cases, please contact us at the address given in section 1.
• Passkeys (fingerprint, Face ID)If you turn on signing in with your fingerprint or face, your phone creates a passkey. On the server we store only its public part and technical data: the key identifier, the usage counter, the device type and name, and the dates it was added and last used. If encryption is turned on, we also store a copy of the account key encrypted with that passkey. Only your phone can decrypt it, after checking your fingerprint or face, which is why signing in this way opens your encrypted data straight away. Neither your fingerprint nor the image of your face leaves your phone — they are checked by your phone's system, not by us. You can remove your passkeys in Settings (“Passkeys”); they are also removed when your account is deleted and when you set a new password with your recovery code.
• Phone numberRequired at sign-up and unique: one number, one account. It lets your friends find you in the app. We describe what this means in section 3.
• Your gift listThe gift name, an optional link to a shop, the occasions assigned to it (e.g. a birthday, Christmas) and the dates it was added and last changed.
• Gift ideasYour private notes on what to buy a friend: the text, an optional link and occasion, and a “bought” marker. Only you can see them — the person they are about never receives them. Once you turn on encryption, we store them only in encrypted form (section 16).
• Important datesYour notes about your friends' dates (e.g. birthdays, name days, anniversaries): the type of occasion and the day and month, without the year. Only you can see them. Once you turn on encryption, we store them only in encrypted form (section 16).
• Dates you enter about yourselfThe day and month of your birthday, name day or another occasion — if you enter them yourself, including in reply to a friend's request. Your friends can see them: all your friends or only the ones you choose (in which case we store who you show them to); by default, a reply to a request is seen only by the person who asked. Because other people can see them, they are not encrypted.
• ReservationsInformation that you have reserved a gift from a friend's list (“I’ll buy it”). The owner of the list does not find out about the reservation. Other people the list has been shared with see only that someone is already buying this gift — without a name.
• FriendsInformation about who you have added as a friend and who has added you.
• InvitationsWhen you invite someone who does not have an account yet, we store with your account their phone number (the last nine digits and the country code), the first and last name you enter for them, take from a contact you pick, or that the app from Google Play finds in your contacts by their number (section 4), the invitation code, the chosen card design and language, and the date it was sent — so that we can show you the list of people you invited and connect you as friends as soon as they sign up. Only you can see the invited person’s first and last name — we do not show it to them or to anyone else. You send the invitation (a text message, a card or an email) yourself from your phone; we do not send it. The link in the invitation opens a page showing your first name — anyone the link reaches will see it, and a messaging app may show it in the link preview. When that person creates an account, you get a notification (if notifications are on), and we delete their number and first and last name from the invitation. You can cancel an invitation at any time — the link then stops working and we delete the invitation data after one day (until then you can restore it). We delete an invitation that has not been accepted 12 months after the invitation.
• List sharesInformation about who you have shared your gift list with and whose lists have been shared with you.
• List requestsInformation that you asked a friend for their gift list or they asked for yours — together with the date of the request and whether you put it off (“Not now”).
• Date requestsInformation that you asked a friend for the date of their birthday or another occasion, or they asked you — together with the date and time of each ask (at most the last 20, as the person asking can ask again), the time of the last notification about the request, and whether you answered “I’d rather not say” (a new ask shows the request again). The person asking can withdraw the question — we then store the time of the withdrawal, and for up to 7 days (or until they first open it) the person asked sees that the question was withdrawn, and when. The request disappears once the person asked enters their date and shows it to the person who asked.
• Reminders about a list and about a dateWhen a friend reminds you about your shared but empty list (or you remind them), we store who reminded whom about which list, and the date and time of each reminder — an in-app message or a card (the last 10 per matter at most; each one is a separate bubble in the conversation) — and whether you answered “Not now” (then the person reminding cannot remind about the same list for 7 days, by card either). We also keep the history of sends for list requests and date questions.
• Reminder cardsWhen you prepare a reminder or request card for a friend, we store a random link code, who prepared it and for whom, what it is about (a list or a question about a date — with the name of the occasion, never the contents of the list), the chosen design and language, and the date — so that the link opens PrezentOS straight in the conversation with you and a messenger can show a preview. You send the card (an image, a text message or an e-mail) yourself from your own phone — we do not send it. The link preview shows your first name and the name of the occasion. A link opened by someone it was not made for does not reveal the matter — they only see that the reminder is for someone else. We delete the codes 30 days after last use.
• A friend’s notification statusWhen you want to remind a friend about a list or a date, the server checks and tells you one thing: whether that friend has notifications switched on (yes or no) — so that we can suggest a card if an in-app message would not trigger a notification. After you send a message you also learn whether the notification arrived. The other way round: a friend who reminds you sees only whether you have notifications switched on — not your devices or any other data.
• Encrypted data and keysOnly once encryption is turned on: the encrypted set of your ideas and notes, the account key in encrypted copies (one protected by your password, another by your recovery code and — if you sign in with your fingerprint or face — one for each of your passkeys), an irreversible hash of the recovery code and the parameters needed to derive the key from your password. Without your password or your recovery code we are unable to read either the data or the key.
• Notification subscriptionWe store it only after you agree to notifications: the technical address (the endpoint) issued by your browser and two keys used to encrypt the content of the notification. The address points to one specific browser on one specific device and serves only to deliver a notification to you.
• Occasion remindersYour reminder settings (whether they are turned on, the timings, the time of day, the kinds of occasion), settings for individual friends (muting, custom timings) and a record of the reminders sent: the friend or holiday, the occasion, the timing and the date of the occasion — so that we do not send the same one twice. For reminders, the server reads the dates visible to you, your unencrypted notes about dates and whether you already have a gift for a given person (without the name of the gift). A notification contains the friend's first name, the occasion and the timing.
• Activity in the appThe days on which you used the app — the date alone, without the time, IP address or content. We save at most one entry per day, when the app connects to the server with a signed-in account. They are used for statistics on the operation of the service (how many people use it and whether they come back) and to assess whether the account is in use — authorised people see them in the administration panel (section 8). We delete them together with the account, and after 13 months at the latest.
• Data stored in your browserOnce you are signed in, your browser stores the sign-in token together with your first name, email address and phone number, so you do not have to sign in every time you open the app. Once you turn on encryption, it also stores the account key — in a form that cannot be copied out of the browser. The token, account details and key are deleted when you sign out. Settings and drafts that make the app easier to use stay on the device (e.g. the shop you last chose, the text of an invitation, the dates of your last visits to friends' pages, the fact that you have already seen the notice about a change to this policy, the fact that you have put off the offer to sign in with your fingerprint), as does the list of accounts that have signed in on this device (email address, first name and whether the account has a passkey on this device) — you can remove them by clearing the site data.
• Technical server logsThe server keeps standard entries: IP address, date and time, the address of the resource opened (with its parameters — e.g. the number typed into the friend search), the address of the page from which the request was sent and the browser type, and, for page views on the prezentos.apps-net.pl website and visits to the app from campaign links, also the browser language. We use them to diagnose failures, to counter abuse and — once the IP address has been shortened — for aggregate visit statistics (section 17). We keep them for 60 days.
• Visit statisticsAggregate records of page views on the prezentos.apps-net.pl website and of visits to the app from campaign links, and weekly sign-up counters — without cookies and without any link to your account. The website itself also uses Google Analytics, which sets cookies only with your consent. Details in section 17.
• Payments and invoices (only when you buy Standard)The invoice details, transaction data, discount coupon and card token described in section 18. We do not collect them if you do not buy Standard.

3Your phone number and account visibility

This is the most important thing to read before you sign up. In PrezentOS your phone number works as an address: thanks to it, a friend who has you in their contacts can add you without searching by surname.

• Anyone signed in to the app who knows your number — or types just the start of it (from four digits) — will see that you have an account, along with your first name and full phone number.
• They will not see your gift list, though. Only the people you share it with can see the list.
• We do not pass your phone number to advertisers and it never appears in ads.
• Turning off the option to be found by phone number is not available at present — the only way out is to delete your account (section 11).
• Someone who knows your number can also add you as a friend — without your consent, but you will get a notification about it. They will then also see your mutual friends and the dates you show to all your friends. You can remove such a person from your friends at any time.

4Contacts from your phone

• The app does not browse your address book in the background or without your knowledge. It reaches into your contacts only when you pick people from them yourself and — in the app from Google Play, with your permission — when it looks up the number of a person you invited (see below).
• When you choose “Pick from contacts”, your phone opens its own system dialog, where you select specific people. The app receives only the entries you selected.
• We send the numbers you selected to our server for one purpose: to check which of them belong to PrezentOS accounts.
• The server sends back the matches and stores neither the numbers sent nor the names from your address book — once it has answered, nothing is kept. The exception is the number and the first and last name of a person you invite yourself (section 2, “Invitations”).
• The person you add becomes your friend — and this works both ways: they also see you as a friend. In the same way, someone who knows your number can add you (section 3).
• The app from Google Play can look up the number of a person you invited in your phone’s contacts on its own — when you choose “Add first and last name” next to an invitation without a name. Before it does this for the first time, it explains what it will check and waits until you choose “Search contacts”; only then does Android ask whether to allow PrezentOS to access your contacts. Once you allow it, it searches straight away the next time.
• The search happens only on your phone and concerns a single number — the one you sent the invitation to. Apart from the first and last name of the person with that number, nothing from your contacts leaves your phone: we do not copy your contacts, send them to our server or to anyone else, or change anything in them. If that number has several different names in your contacts, the app does not guess and saves nothing.
• When the app finds the number in your contacts, we save only the first and last name from that contact with the invitation — only you can see it, and you can undo this right away or edit the name later (section 2, “Invitations”). Allowing access is voluntary: if you do not allow it or the number is not in your contacts, the app saves nothing on its own — you then pick the contact yourself or type the name. You can withdraw the permission in your phone settings (usually: Settings → Apps → PrezentOS → Permissions → Contacts). In the browser (including when installed from the website) and on iPhone, the app never searches your contacts on its own.

5Notifications

• Notifications are optional and start only once you agree to them in your browser or system.
• We send them when: someone adds you as a friend, someone you invited creates an account, someone shares their list with you, someone asks you for your list, someone asks you for the date of your birthday or another occasion, a friend's occasion or a holiday is coming up (reminders), you send a test notification yourself from Settings, and also when we pass on a message about your account or the operation of the service. We do not send advertising notifications.
• You can withdraw your consent in your browser or system settings — we then stop sending them. We delete a saved subscription when the notification provider rejects it as out of date, and when an account is deleted.
• Occasion reminders are turned on by default: about your friends' birthdays, name days and other dates that you can see in the app, and about fixed-date holidays (e.g. St Nicholas Day, Christmas) — a week before, the day before (only if you do not have a gift for that person yet) and on the day of the occasion, at 9:00; if there are several on the same day, we combine them into one. You can change the timings, the time of day and the kinds of occasion, and turn reminders off, in Settings → Notifications → “Occasion reminders”; you can mute an individual friend or one of their dates on that friend's page.

6Ads

• In the Free plan, in the signed-in part of the app in the browser, we show Google AdSense ads (publisher ID ca-pub-4256794540091573). No ads are shown on the sign-in screen, the sign-up screen or on this page.
• The Google ad script loads in your browser and may store cookies and identifiers in order to select ads and measure how well they work. In this respect Google is an independent controller of your data.
• We do not pass your first name, email address, phone number or gift list to Google.
• Google's rules are set out at policies.google.com/technologies/partner-sites, and you can change your own ad settings at adssettings.google.com.
• In the European Economic Area, the United Kingdom and Switzerland, Google may ask you in the app for your consent to cookies and personalised ads. Without your consent it shows non-personalised ads. You can change or withdraw your consent in Settings (“Privacy and cookie settings”).
• In the app from Google Play (Android), in the Free plan, we may show Google AdMob ads. Google’s advertising software in the app may read the device’s advertising ID and basic data about the device and the app in order to show ads, select them and measure how well they work; in this respect Google is an independent controller. You can reset or delete the advertising ID in your Android settings.
• In the Standard plan we do not show ads.

7What we do not do with your data

• We do not sell your data.
• In the app we do not use external analytics or tracking tools — apart from the Google ads described in section 6. We count simple statistics (the number of accounts, the days the app is used, website visits and visits from campaign links) ourselves, on our own server and in aggregate; the only external statistics tool is Google Analytics on the prezentos.apps-net.pl website (section 17).
• We do not collect device location data. For visit statistics we determine only an approximate location (country, region and city) based on a shortened IP address (section 17).
• We do not ask for access to your photos or your microphone. Only the app from Google Play asks for access to your contacts — Android’s permission covers all of them, but the app uses it only to look up the number of a person you invited (section 4).
• We do not store your password in plain text.
• Your gift list stays out of reach of others until you choose who can see it.
• We do not look through your ideas or notes — and once you turn on encryption, we are unable to read them.
• We do not see or store your full card number or CVC — you enter them only on the payment provider’s page (section 18).

8Who we share your data with

• Other PrezentOS usersA signed-in user who searches for your number sees your first name and phone number. Your friends see your first name and phone number, as well as which of their friends are also your friends. The people you share your list with see your first name and your gift list. Your friends see the dates you enter about yourself — all your friends or only the ones you choose. Your friends see your e-mail address only if you turn on “Friends see my e-mail” in Settings — by default nobody sees it.
• Authorised people on our sideThe people who run the app on our side can see in the administration panel: first name, email address, phone number, the date the account was created and the dates of sign-ins, the days the app was used, devices with notifications turned on (device type and date), whether the account was created from an invitation and whether it has encryption turned on, and counts (of friends, invitations, list requests, reservations, shares, gifts, ideas and date notes) — without the content of gift lists, ideas and notes. Every action they take on an account (notification, block, deletion) is recorded in a log (section 10).
• GoogleFor the purpose of showing AdSense and AdMob ads (section 6) and Google Analytics statistics on the prezentos.apps-net.pl website (section 17).
• The payment provider (Mollie B.V.)When you buy Standard: the first name and e-mail address from the account and the transaction data; the payment takes place on the provider’s page (section 18).
• The invoicing system, KSeF and the accounting firmThe invoice details and transaction data — for the purpose of issuing the invoice, sending it to the National e-Invoice System and handling the accounting (section 18).
• Shops and search engines you open yourselfThe “Search in a shop” button in the gift form opens the page of the shop or search engine you choose (e.g. Google, Allegro) and passes it the gift name as the search phrase. This happens only when you choose a shop yourself — it is the only case in which a gift name reaches such a service. From then on, that service’s privacy policy applies. The link you add to a gift is saved together with it.
• Push notification providersA notification reaches you through the servers of the maker of your browser or system (e.g. Google, Mozilla, Apple) — without them it cannot be delivered.
• Hosting providersThe app server and the database are hosted by OVH Sp. z o.o. in a data centre in Warsaw. Backups are made on that server (before every app update) and on our own infrastructure, also on Polish territory. Both the server and the backups are in Poland, and therefore in the European Economic Area — your data is not transferred outside the EEA. The exception is Google Analytics statistics on the prezentos.apps-net.pl website (section 17).
• Competent authoritiesOnly in cases where the law requires it.

Apart from the parties listed above, we do not pass your data to anyone.

9On what basis we process your data

• Performance of a contract — Art. 6(1)(b) GDPRYour account (including signing in with a password or a passkey), gift list, ideas, important dates, friends, invitations, sharing, reservations, list and date requests, occasion reminders and data encryption, and — when you buy Standard — payment, renewal, discount coupons and refunds in the situations described in the Terms of Service. Without this data the app cannot work.
• Legal obligation — Art. 6(1)(c) GDPRIssuing and keeping invoices and accounting and tax documents after Standard is bought (section 18).
• Your consent — Art. 6(1)(a) GDPRPush notifications, showing your e-mail address to friends (Settings → “Friends see my e-mail”), picking contacts from your phone, looking up the number of a person you invited in your phone’s contacts (app from Google Play), Google Analytics cookies on the prezentos.apps-net.pl website (section 17) and — if you agree to this in the Google dialog — cookies and personalised ads. You can withdraw your consent at any time.
• Our legitimate interest — Art. 6(1)(f) GDPRSecurity and upkeep of the app (technical logs, the limit on sign-in attempts, the administrator action log), statistics on the operation of the service (days the app is used), statistics on website visits and on the effectiveness of promotion (section 17), countering abuse (blocking accounts, abuse in payments), pursuing and defending claims arising from payments, and showing the non-personalised ads that fund the app. Also the cookieless page-view signals the website sends to Google Analytics before you decide on consent (section 17).

10How long we keep your data

• Account data and content (gifts, ideas, important dates, friends, invitations, shares, reservations, list and date requests, encrypted data and keys) — for as long as the account exists. When the account is deleted, they are deleted with it.
• Backups (daily ones and those made before every app update) — 60 days. During that time the data may still be present in a backup, which we use only to restore the system after a failure.
• Technical logs — 60 days. Service operation logs (without email addresses; accounts are identified by number) are continuously overwritten with newer entries, usually within a few weeks.
• Days you used the app — 13 months at most.
• Administrator action log — 24 months. An entry contains the account number, the type of action, the date and the reason given by the administrator (and, for a notification, its content); it does not contain the first name, email address or phone number.
• Failed sign-in attempt counter — only in the server's memory, not in the database; it disappears at the latest when the server is restarted (at every app update).
• The phone number and the first and last name of a person you invited — until they sign up or you cancel the invitation (cancelled invitations are deleted after one day), for no longer than 12 months from the invitation.
• Statistics on website visits and visits to the app, and weekly sign-up counters (section 17) — for as long as we keep statistics, including in backups; they contain no IP address or account data. The raw server log they are created from — 60 days.
• Reminder settings — until they are changed or the account is deleted; the record of reminders sent — 400 days from the date of the occasion; the daily dispatch marker — 60 days.
• Reminder card codes — 30 days from last use; the record of reminders about an empty list — 30 days; the history of sends for a list request or a date question — together with the request or question.
• Invoices and payment documents for Standard — for the period required by law (as a rule 5 years from the end of the year in which the tax obligation arose), also after the account is deleted; Standard status and the record of reminders about the end of the period — together with the account.

11How to delete your account and all your data

Deletion is immediate and irreversible. The following are removed from the database: your gifts together with the occasions assigned to them, ideas, important dates (including those you entered about yourself), reservations, invitations, list and date requests, list shares (in both directions), friend connections (in both directions), saved notification subscriptions, reminder settings and the reminder record, the days you used the app, encrypted data and keys, your profile (first name and phone number) and your sign-in details. We delete entries about you in other people's reminder records within 24 hours. After deletion you can no longer sign in, and your phone number is released, so a new account can be created with it.

If you have Standard with renewal, we switch renewal off before deleting the account so that your card is no longer charged; if that fails, the deletion is interrupted and the account stays untouched. Invoices and payment documents remain in the payment service for the required time (section 18), and in the app their link to the account is removed.

If you cannot sign in to the app, please contact us at kontakt@apps-net.pl — we will delete the account at your request once we confirm that it belongs to you.

12Account blocking and deletion by us

We may block or delete an account when it is used for abuse (e.g. sending spam, harassing other people or impersonating them) or for breaking the law, or when the user themselves asks us to.

• A blocked account cannot sign in and does not appear in the friend search. When someone tries to sign in, we show a notice about the block together with a contact address, and on devices where the account is signed in, the app shows a block screen instead of its content.
• The data of a blocked account remains intact — including lists previously shared with friends. You can delete the account straight away from the block screen on a device where you are signed in (the “Delete account” button); if you do not have such a device, you can request deletion by email (section 11).
• When we delete an account, we delete the same data as when you delete it yourself (section 11). An entry about the event itself remains in the administrator action log — with the account number and the reason, without the first name, email address or phone number (section 10).
• We have no control over data that has already reached other people — e.g. the invitation messages you have sent.

13Your rights

You have the right to request:

• access to your data and a copy of it,
• rectification of data that is wrong or out of date,
• erasure of your data,
• restriction of processing,
• objection to processing based on our legitimate interest,
• transfer of your data to another service,
• withdrawal of consent (notifications, contacts, personalised ads, Google statistics on the website) — without affecting the processing carried out before it was withdrawn.

You can exercise the right to erasure yourself in the app (section 11). You can object to visit statistics by turning on the Global Privacy Control or Do Not Track signal in your browser (section 17). For anything else, please contact us at kontakt@apps-net.pl — we will reply within one month at the latest.

The right to erasure does not cover invoices and accounting documents that we must keep by law (Art. 17(3)(b) GDPR) — section 18.

Changing your first name and phone number is not yet something you can do on your own in the app. Once you tell us, we will make the correction manually.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).

14People under 18

PrezentOS is not intended for people under 18. If we learn that an account was created by someone younger without a guardian's consent, we will delete it.

15Security

• The connection to the app is encrypted (HTTPS).
• Your password must be at least 8 characters long and cannot be one of the most common passwords. We store only its irreversible hash or — with encryption turned on — the hash of the sign-in key derived from your password on your device.
• We verify every request for gifts, friends and shares on the server side — only someone holding a valid sign-in token gets to see the data.
• After several failed sign-in attempts in a row, the next one can be made only after a short wait — from 30 seconds to 15 minutes. The account is not blocked as a result. We also limit the number of sign-in attempts from individual IP addresses.
• You can encrypt your ideas and notes about your friends' dates on your device (section 16).

No system is one hundred percent secure. If you notice anything wrong, please contact us at kontakt@apps-net.pl.

16Encryption of ideas and notes

You can encrypt your gift ideas and notes about your friends' dates on your device (Settings → Data encryption). The key is created on your device and is protected by your password — and, if you sign in with your fingerprint or face, also by the passkey on your phone. From then on only encrypted data reaches the server — and therefore the backups — and we are unable to read it without your password or your recovery code.

• Encryption covers gift ideas and notes about your friends' dates. Your gift list, the dates you enter about yourself, friends, shares and reservations remain unencrypted, because they have to be readable by the people you show them to.
• When you turn on encryption, you will receive a recovery code. We show it only once and do not store it — we save only its irreversible hash and a copy of the key encrypted with it. With the code you can set a new password if you forget your current one (sign-in screen → “Forgot your password?”). You can generate a new code in Settings; the previous one then stops working.

• Setting a new password with your recovery code does not sign out your other devices, but it removes all your passkeys — you will then need to turn on signing in with your fingerprint or face again.
• Encryption protects the data stored on the server and in backups — including from being viewed by the administrator. Backups made before encryption was turned on still contain this data in plain text for the period given in section 10. Encryption does not replace securing the device itself: on an unlocked device with the app signed in, the data is visible.
• Encryption cannot currently be turned off — the data remains encrypted until the account is deleted.

17Statistics on website visits and visits to the app

When you open the prezentos.apps-net.pl website (including this document) or enter the app from a campaign link (an address tagged with utm_…, e.g. utm_source=instagram), our server records that page view for aggregate statistics. The purpose: to know how many people visit us and which promotion channels work.

• We record: the address of the page visited with the campaign tag (without the invitation code or other link parameters), the domain of the page you came from, the type of browser, operating system and device, the browser language, an approximate location (country, region and city) and the time of the page view.
• We shorten the IP address before it reaches the statistics tool (we remove its final part). The shortened address is used to determine an approximate location and — together with the browser type — to recognise successive page views within the same visit. The IP address itself is not stored in the statistics, and the visit pseudonym changes every day, so visits from different days cannot be linked to one another.
• For this we use no cookies, no statistics script and no identifiers stored in the browser, and we do not link visits to your account. The website remembers in your browser your animation choice, your decision about Google statistics and — until you close the tab — the point where you stopped scrolling; it sets Google Analytics cookies only with your consent (below).
• When you create an account, we increase the weekly sign-up counter: the week, the type of app (browser, app installed from the website or from Google Play) and — if you came from a campaign link or an invitation — the campaign tag. The tag is present only in the page address and in the memory of the open tab — the app does not save it on your device — and it reaches the server only together with the sign-up form. We do not save the campaign with your account, and the counter contains no account number or any other data about you.
• If your browser sends the Global Privacy Control or Do Not Track signal, we do not count your visits, and we count your sign-up without the campaign tag and the type of app. We also leave out automated traffic (bots).
• The basis is our legitimate interest (Art. 6(1)(f) GDPR) — assessing how the website works and which promotion channels bring in new users. The statistics tool runs on our server, which is provided by OVH (section 8); the data does not reach any external analytics service. Google Analytics on the website is a separate tool — we describe it below.
• We keep the records in the statistics tool, their backups and the weekly sign-up counters for as long as we keep statistics — we do not delete them after a set period. We delete the raw server log they are created from after 60 days (section 10).
• You can object to your visits being counted (section 13). Because we do not know which records concern you, we are unable to find or delete them individually (Art. 11 GDPR); you can give effect to your objection for the future yourself by turning on the Global Privacy Control or Do Not Track signal in your browser. If you have any questions, write to kontakt@apps-net.pl.
• The Google Play link on the website contains a campaign tag. Google is a separate controller of the data collected in Google Play; from Google we receive only aggregate figures (e.g. how many people from a given campaign visited the app's listing and installed it).

Google Analytics on the prezentos.apps-net.pl website. The prezentos.apps-net.pl website itself — not the documents under /docs/ and not the app — also uses Google Analytics 4. On your first visit the website asks for your consent to Google statistics; you can change your decision at any time with the “Privacy settings” link in the website footer.

• Before you decide — and if you refuse — Google Analytics works without cookies: it stores nothing in your browser and sends Google only a page-view signal (including the address of the page and of the page you came from, the type of browser and device, the language, an approximate location and the time) with no identifier that would let your page views be linked. Google uses such signals to estimate total visit numbers. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) — knowing how many people visit the website. If your browser sends a Global Privacy Control or Do Not Track signal, the website does not start Google Analytics at all before you consent.
• Once you consent, Google Analytics stores the cookies _ga and _ga_ZHQ9EC6KJT with a random identifier in your browser (valid for up to 2 years) to recognise further visits from the same browser, and also sends Google information on how you use the website (e.g. scrolling and clicks on links leading off the website). The cookies apply only to the prezentos.apps-net.pl address — the app does not see them. The legal basis is your consent (Article 6(1)(a) GDPR and Article 399 of the Polish Electronic Communications Law).
• We do not link Google Analytics data to your PrezentOS account, we do not enable Google signals and we do not use this data for advertising (ad storage and ad personalisation are always switched off in the tag). Google Analytics 4 does not store IP addresses.
• The data is processed for us by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) as a processor; it may also reach Google LLC in the USA. The transfer is based on the European Commission’s adequacy decision (the EU-US Data Privacy Framework, in which Google LLC participates) and on standard contractual clauses. Google’s policy: policies.google.com/privacy.
• Google keeps data linked to the identifier for 2 months, and aggregate reports for as long as we keep statistics. You can withdraw your consent at any time with the “Privacy settings” link in the website footer — the website then deletes the Google Analytics cookies; withdrawal does not affect processing carried out before it.

18Payments and invoices for Standard

This section applies only to people who buy Standard on the prezentos.com website. The Free plan requires no payment data.

What data we process when you buy

• Invoice details — first and last name or company name, address (street, town, postal code) and — for a company only — the tax number (NIP). You enter them when you buy; they are used to issue the VAT invoice.
• First name and e-mail address from the account — we pass them to the payment provider, which creates your payer profile (e.g. Przelewy24 requires the payer’s e-mail address).
• Transaction data — amount, currency, period, date, payment method (card, BLIK, Przelewy24), status, identifiers of the payment, the payer and the subscription at the provider, information about renewal and the date of the next charge, and about a refund (in the situations described in the Terms of Service).
• Discount coupon — if you use one: the coupon code, the amount of the discount and the fact that your account has used it (a coupon works once per account and within a set limit of uses).
• Saved-card token — only for renewals: the card brand, the last four digits and the expiry date. We do not have the full card number or the CVC: you enter them only on the payment provider’s page.
• Consent to start the service right away — we record that you gave it when ordering (with the loss of the right of withdrawal, Terms of Service section 7), together with the date and time.
• Standard status in the account — the end date of the period, whether renewal is on, and a record of the reminders about the end of the period that were sent (type and date).

Data on payments and invoices is kept by our payment service — a separate database on our server in Poland (section 8), not accessible to others. The app database holds only: the end date of the period, whether renewal is on, payment identifiers and the record of reminders.

What for and on what basis

• performance of a contract — buying, switching on and renewing Standard, discount coupons and refunds in the situations described in the Terms of Service (Art. 6(1)(b) GDPR);
• legal obligation — issuing and keeping invoices and accounting and tax documents (Art. 6(1)(c) GDPR);
• our legitimate interest — pursuing and defending claims, preventing abuse in payments (Art. 6(1)(f) GDPR).

Providing the invoice details is voluntary, but without them we cannot sell Standard — the law requires an invoice.

Who we share it with

• Mollie B.V. (Amsterdam, the Netherlands) — the payment provider. It processes payment data as a separate controller: it is a payment institution with its own obligations (including under anti-money-laundering rules); its rules: mollie.com/privacy. Mollie is established in the European Economic Area; if it transfers data outside the EEA, it does so on the terms described in its policy.
• The a-financier invoicing system — our own system in which we issue invoices (invoice details and amount); it runs on our infrastructure and we do not make it available to anyone.
• The National e-Invoice System (KSeF) — a system run by the Minister of Finance, to which we send invoices if the rules require it or when we choose to send them there; an invoice in KSeF contains the buyer’s details from the invoice.
• An external accounting firm — access to invoices and payment documents for the purpose of accounting services, under a data processing agreement.
• Competent authorities — only where the law requires it (as in section 8).

How long we keep it

• Invoices and payment documents — for the period required by tax and accounting law, as a rule 5 years from the end of the year in which the tax obligation arose; it may be longer, e.g. if the limitation period is suspended. This also applies after the account has been deleted.
• Card token — until renewal is switched off or the account is deleted; at the payment provider — under its rules.
• Standard status and the record of reminders in the app database — together with the account.

The right to erasure (section 13) does not cover invoices and accounting documents that we must keep by law (Art. 17(3)(b) GDPR). Deleting the account removes, in the app, the link between the account and the payments; the accounting documents stay in the payment service only for the required time.

We do not make automated decisions, including profiling, based on payment data. The payment provider may use its own abuse-detection mechanisms — it describes them in its policy.

19Changes to this policy

If this policy changes, we will publish the new version at the same address and update the date at the top of the document. We will announce any significant changes in the app.

20Contact

Please send questions about your data, requests and reports to kontakt@apps-net.pl.

Permanent address of this document: prezentos.apps-net.pl/docs/en/privacy-policy/