Privacy Policy (GDPR)
Last updated: July 2026
This policy describes how we process personal data of Dutki users under GDPR.
1. Data controller
The controller is Marek Galarowicz Usługi Informatyczne, Myśliwska 66D/31, 30-718 Kraków, Poland, Tax ID (NIP): 7352850824, email: kontakt@dutki.app. No Data Protection Officer has been appointed — contact the controller directly for GDPR matters.
2. Data we process
Account data: email, password hash, preferred language (from User). Financial data: budget plans, balances, amounts, currencies, notes (entered manually). Subscription: plan status, Stripe identifiers, billing period. Technical: server logs, IP address, user agent, session identifiers. Consents: terms acceptance, cookie settings. We do not fetch bank data. We do not log financial amounts to analytics tools.
3. Purposes and legal bases (Art. 6 GDPR)
Account creation and Service delivery — Art. 6(1)(b) (contract). Payments and invoices — Art. 6(1)(b) and (c). Security, rate limiting, abuse prevention — Art. 6(1)(f) (legitimate interest). Error monitoring (Sentry) after cookie banner consent — Art. 6(1)(a) (consent). Transactional emails — Art. 6(1)(b). Accounting retention — Art. 6(1)(c).
4. Recipients (processors)
Supabase Inc. — database, authentication (EU, Frankfurt). Vercel Inc. — hosting and anonymized web analytics (EU). Stripe Payments Europe, Ltd. — payments, invoices (EU, transfers to USA with standard contractual clauses). Resend Inc. — transactional email (USA, SCC). Functional Software Inc. (Sentry) — error monitoring after consent (USA, SCC). PostHog Inc. — product analytics after consent (EU, Frankfurt). Upstash Inc. — rate limiting if configured (EU/USA, SCC). We have data processing agreements with these providers.
5. Retention
Account and financial data: until Account deletion by User or on request. Stripe billing data: per tax obligations (usually 5 years). Technical logs: up to 90 days unless longer needed for incident investigation.
6. Your rights
You have the right to access, rectify, erase, restrict processing, data portability, object to processing based on Art. 6(1)(f), and withdraw consent (without affecting prior lawful processing). Data export (CSV): Settings → Export. Account deletion: Settings → Delete account. Other requests: kontakt@dutki.app — response within 30 days.
7. Supervisory authority
You may lodge a complaint with the Polish Data Protection Authority (Prezes UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl). EU consumers may also contact their local authority.
8. Security
We use HTTPS encryption, per-user data isolation (RLS), sensitive field scrubbing in Sentry, and do not log amounts to analytics.
9. Voluntary data provision
Providing email and financial data is necessary to use the Service. Without it, we cannot provide the Service.
10. Cookies
Details in the Cookie Policy (/cookies). Essential session cookies (Supabase) work without consent; error monitoring requires consent in the banner.