Techbool privacy notice

Version: 2026-10-28. Effective from 28 October 2026.

1. Controller and contact

The controller is Paweł Kopytko, operating Techbool. Address: Niedźwiedza 72, 32-854 Porąbka Uszewska, Poland. NIP: 8692010130. Email: service@techbool.com. Telephone: +48 791 172 155. Use this contact for privacy questions and rights requests.

2. What we process and why

Account data includes your name, email, password hash, verification/reset-token digests, opaque session digests and account timestamps. We use these to create and administer the account, authenticate you, verify your email and recover access. The basis is performing the account/service contract or taking requested steps before it (GDPR Article 6(1)(b)). We never store your plaintext password in the account database. Workspace data includes imported aggregate monthly figures, source names, assumptions, saved scenarios and analyses. We process it to provide the features you request, under Article 6(1)(b). Do not upload customer/employee-level personal information, sensitive records or card data; this workspace is intended for aggregate financial planning. For paid plans we process account-to-Stripe customer/subscription references, payment status, plan, billing period, accepted terms version, immediate-start request, withdrawal requests and provider event identifiers. Stripe collects card/payment details on its own pages; Techbool does not receive your full card number. Contract administration relies on Article 6(1)(b); legally required tax/accounting records rely on Article 6(1)(c). Security and operations data can include request time, route, status, IP address at the proxy, a hashed client identifier, rate-limit counters and delivery/failure records. Our legitimate interest under Article 6(1)(f) is preventing abuse, investigating faults and maintaining the service. Support correspondence is used to answer your request and document its resolution, based on the relevant contract, legal obligation or legitimate interest. We do not make decisions with legal or similarly significant effects solely by automated profiling. A scenario simulation is a calculation requested by you.

3. Providers and international processing

OVHcloud provides the server and email transport; Cloudflare provides proxy/CDN, DNS and security services; Stripe provides hosted checkout, subscription management, payment processing and billing records. Access is limited to what each service needs and subject to the relevant contractual terms. Stripe may act as an independent controller for payment, fraud-prevention and regulatory purposes. The production server is hosted in the EU. Cloudflare and Stripe operate internationally, so processing outside the EEA may occur under their applicable transfer arrangements, such as an adequacy decision or standard contractual clauses where required. You can request information about the safeguards from us and review the providers' privacy notices. We do not sell your account or workspace data to advertisers.

4. Cookies and browser storage

Techbool uses an essential HttpOnly session cookie for sign-in. A normal session expires after 12 hours; Keep me signed in extends it to seven days. Signing out revokes the session. These cookies are needed for the service you request, not advertising. Current public pages do not embed advertising or optional analytics trackers. If we introduce optional tracking, we will first update the notice and obtain consent where required. Your browser may separately retain downloaded CSV/JSON files or printed reports; you control those copies.

5. Retention and deletion

Account and workspace data are kept while the account remains open. You can delete individual saved items or delete the account from its settings. Active account-owned datasets, scenarios, analyses, sessions and tokens are then removed. Deleted data may remain in restricted rotating backups for up to seven days before expiry. Restoring a backup requires reapplying deletions made after that backup, using the deletion ledger, before the restored data is served. Verification links expire after 24 hours and reset links after 30 minutes. Expired tokens and sessions are purged by maintenance; abuse counters normally expire after 15 minutes. Technical application logs rotate under bounded storage and access is restricted. Operational monitoring keeps recent incident state. Transactional email queue content is removed 30 days after successful delivery; failed messages are retained for at most 90 days for investigation. We minimize what is included in logs and email. Billing, contract, complaint or dispute records may need to remain separately after account closure for the applicable legal retention or claim period. Polish tax/accounting records, where required, are generally retained for five years counted under the relevant tax rules; other evidence is retained only as long as needed for the particular obligation or claim. Stripe may retain its own records under its legal duties. We do not promise deletion of records that must lawfully be preserved. Data that is no longer necessary is deleted or anonymized.

6. Your choices and rights

Subject to the legal conditions, you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. Providing account information is necessary to operate the account; paid checkout additionally requires payment/billing details. You can choose Free without a card. Email service@techbool.com with your request. We may verify identity proportionately and normally reply within one month. You may complain to the Polish supervisory authority, the President of UODO (https://uodo.gov.pl), or another competent supervisory authority, including where you live or work. You do not have to complain to us first.

7. Protecting your information

We use encrypted transport, hashed passwords and session tokens, account ownership checks, restricted credentials and encrypted backups. Operational access is limited to maintaining and supporting the service. No service can promise absolute security. Please keep your device and email account secure, sign out on shared devices and notify us promptly of suspected misuse. We will assess and handle personal-data breaches under the applicable notification requirements.

8. Changes

This version describes the current service. Material changes will be explained through the website and, where appropriate, a transactional account notice before they apply. Historic contract versions remain available with the relevant subscription confirmation.