Privacy Policy

registration and user account management - the legal basis for processing is the necessity for the performance of a contract to which the data subject is party (Art. 6(1)(b) GDPR)

email address verification - the legal basis for processing is the legitimate interest of the controller (Art. 6(1)(f) GDPR), consisting in ensuring the security of user accounts

analysis of technical drawings uploaded by the User - the legal basis for processing is the necessity for the performance of a contract (Art. 6(1)(b) GDPR). PDF files with technical drawings are processed by external Google services for analysis in accordance with ISO standards

storage of technical drawing files and analysis results - the legal basis for processing is the necessity for the performance of a contract (Art. 6(1)(b) GDPR), enabling the User to access the history of analyses and uploaded files

management of Service usage limits (FREE/PRO/ENTERPRISE plans) - the legal basis for processing is the necessity for the performance of a contract (Art. 6(1)(b) GDPR)

sending email notifications (account verification, analysis completion notifications) - the legal basis for processing is the legitimate interest of the controller (Art. 6(1)(f) GDPR), consisting in communication with Users

responding to inquiries submitted via the contact form - the legal basis for processing is the necessity for taking steps at the request of the data subject prior to entering into a contract (Art. 6(1)(b) GDPR) and the legitimate interest of the controller (Art. 6(1)(f) GDPR), consisting in handling correspondence

establishing, pursuing or defending against claims - the legal basis for processing is the legitimate interest of the controller (Art. 6(1)(f) GDPR), consisting in protecting its rights

analytical and statistical purposes - the legal basis for processing is the legitimate interest of the controller (Art. 6(1)(f) GDPR), consisting in analyzing Users' activity in the Service in order to improve the functionalities offered

fulfilling legal obligations incumbent on the controller - the legal basis is Art. 6(1)(c) GDPR.

• first and last name (optional),
• email address,
• password (stored in hashed form using bcrypt algorithm),
• company name and company identifier (company_id),
• subscription plan (FREE/PRO/ENTERPRISE) and analysis usage counter,
• PDF files containing technical drawings uploaded by the User,
• results of technical drawing analyses,
• IP address,
• web browser and operating system data,
• information about activity in the Service (e.g., visited pages, time spent in the Service, analysis history).

Providing personal data for registration and use of the Service is voluntary, however necessary for concluding a contract and using the technical drawing analysis services.

Uploading PDF files with technical drawings is voluntary, however necessary for performing the analysis.

Google LLC - for the purpose of performing technical drawing analysis. Only images of technical drawings (PNG) are transmitted for analysis in accordance with ISO standards. Data is processed in accordance with Google's privacy policy

Resend Inc. - email service provider used for sending notifications (account verification, analysis completion notifications)

Railway Corp. - hosting service provider on whose infrastructure the application is run and Users' data is stored (servers located in the European Union)

entities providing services to STUPAK Serwis, including IT service providers, accounting firms

entities authorized to obtain data under applicable law.

Transfer of data outside the European Economic Area (EEA): Data may be transferred to the USA in connection with the use of Google services (drawing analysis) and Resend (email). Data transfer is carried out on the basis of appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission or other mechanisms compliant with the GDPR.

• Passwords are stored in hashed form using bcrypt algorithm (impossible to read),
• Authentication is performed using JWT (JSON Web Tokens) with limited validity period,
• PDF files and drawing images are stored in an isolated directory on the server and are not publicly accessible. Access to files requires authentication and is restricted exclusively to the file owner,
• Connection to the Service is encrypted using HTTPS protocol (SSL/TLS),
• PDF file validation - each uploaded file is verified for type, size and integrity before processing,
• Security middleware - CSRF protection, security headers (HSTS, CSP, X-Frame-Options),
• Rate limiting - limitation of login attempts (5 attempts per 60 seconds) to protect against brute-force attacks.

• access their personal data,
• rectification of their personal data,
• erasure of their personal data (“right to be forgotten”),
• restriction of processing of their personal data,
• portability of their personal data,
• object to the processing of personal data,
• withdraw consent to the processing of personal data at any time (without affecting the lawfulness of processing based on consent before its withdrawal),
• lodge a complaint with the supervisory authority (President of the Personal Data Protection Office).

To exercise their rights, the User may contact STUPAK Serwis:

by post at: ul. Rzeczna 84, 55-003 Nadolice Wielkie

by email at: [email protected]

• User account data (email, password, subscription plan) is retained for the entire duration of the contract, and after its termination for the period resulting from legal provisions (e.g., accounting, tax obligations),
• PDF files and technical drawing images are retained until deleted by the User or for the period resulting from account activity (e.g., until the account is deleted),
• Analysis results are retained until deleted by the User or for the period resulting from account activity,
• Contact form data is retained for the period necessary to respond to the inquiry, and subsequently for the correspondence archiving period,
• Data processed for analytical and statistical purposes is retained until an effective objection is raised.