Privacy Policy
Last updated: 2 November 2026
Draft — pending legal review
This document is a working draft and has not yet been reviewed by a lawyer. Text in [SQUARE BRACKETS] is a placeholder that will be completed before Altanik accepts paid customers.
Hosted in the EU (Frankfurt). Product capture runs on your device. We never sell or mine your or your clients’ data.
To let you reach your work from any device and share it with clients, your lists, projects and client details are stored on our servers. This policy explains what we process, why, where it is stored and how you control it.
1. Who is responsible
The controller of the personal data described in this policy is [COMPANY NAME — JDG registered name], NIP [NIP], REGON [REGON], [REGISTERED ADDRESS], Poland (“Altanik”, “we”). Contact for all privacy matters: [CONTACT EMAIL].
When designers add their clients’ details to Altanik, the designer is the controller of that data and we process it on their behalf under our Data Processing Agreement. If you are a designer’s client, please contact the designer first; we will help them respond to your request.
2. What data we process
Depending on how you use Altanik, we process:
- Account data — name, email address, password (stored only as a hash), studio name, role, language and two-factor settings.
- Billing data — Paddle, our merchant of record, collects your payment details. We receive only your plan, subscription status, billing email, country and VAT ID; we never see your full card number.
- Workspace content — projects, lists, products, images, files, comments, messages and tasks you or your team create.
- Client data you add — names, contact details and project addresses of your clients, which we process as your processor.
- Share-link activity — when a client approves or comments through a share link, we store the name they enter, their decision, the date and a snapshot of the item and price.
- Share-link views — so a designer can see whether a shared list was opened and is being read, we record when the share page is open (a ping every 30 seconds while it is visible) under an anonymous code derived one-way from the network part of the IP address, the browser type, the link and the day; the IP address and browser details themselves are not stored, and these records are deleted after 180 days. To mark items added or changed since a client's last visit, the share page keeps a random identifier in the client's browser and we store only a one-way code derived from it for that link, with the titles of the items they last saw and fingerprints (hashes) of their details, prices and quantities, also deleted after 180 days.
- Technical data — IP address, browser type and request logs, used for security and troubleshooting, kept for [LOG RETENTION PERIOD].
- Emails — the messages we send you (sign-in, security and notifications) and your replies to support.
3. The browser extension
Product extraction runs locally in your browser, including the AI model. We do not collect your browsing history, and the pages you visit are not sent to us. Only the item you choose to save — for example its title, price, images, source link and the fields you edit — is sent to your Altanik account.
On first use, the extension downloads AI model files from the Hugging Face / MLC content delivery network. This is an ordinary file download: no Altanik user data is sent, although, as with any download, the network can see your IP address.
4. Why we process data and on what legal basis
- To provide the Service you signed up for — performance of a contract (Art. 6(1)(b) GDPR).
- To keep accounts and the Service secure, prevent abuse and fix errors — our legitimate interest (Art. 6(1)(f)).
- To send service emails such as sign-in links, security alerts and notifications you enabled — performance of a contract (Art. 6(1)(b)).
- To keep billing and tax records required by Polish accounting and tax law — legal obligation (Art. 6(1)(c)).
- To understand aggregate usage of our public website through cookieless Cloudflare Web Analytics — our legitimate interest (Art. 6(1)(f)).
- To send product news, only if you opt in — consent (Art. 6(1)(a)), which you can withdraw at any time.
5. AI features
Altanik’s AI features run on your device. Fields and summaries produced by AI are labelled as AI-generated. We do not use your data or your clients’ data to train AI models, and we do not make automated decisions that have legal or similarly significant effects on you.
7. Where your data is stored
All personal data is stored in the EU: our application and database run on servers in Frankfurt, Germany, and uploaded files and backups are kept with our object-storage provider [STORAGE PROVIDER] in an EU region.
Some providers, such as our content delivery network Cloudflare, may process data outside the EEA in transit. Such transfers rely on an adequacy decision (for example the EU–US Data Privacy Framework or the UK adequacy decision) or on the European Commission’s Standard Contractual Clauses.
If you are located outside the EU, your data is transferred to and stored in the EU. The UK, Canada and New Zealand recognise the EU as providing adequate protection. [TO CONFIRM: privacy impact assessment for customers in Québec under Law 25.]
8. How long we keep data
- Account and workspace data — for as long as your account exists. After deletion it is removed from live systems and purged from backups within 30 days.
- Billing records — for the period required by Polish tax law (generally five years from the end of the year in which the tax became due).
- Security logs — [LOG RETENTION PERIOD].
- Marketing consent — until you withdraw it.
9. Security
We protect data with measures including:
- encryption in transit (TLS) and at rest (encrypted storage volumes);
- row-level security on every database table, so each workspace can only reach its own data;
- private file storage with short-lived signed URLs;
- optional two-factor authentication;
- production secrets kept out of source code;
- nightly encrypted off-site backups with 30-day retention;
- a documented breach procedure, including notifying the supervisory authority within 72 hours where required.
10. Your rights
You have the right to access, rectify and erase your data, to restrict or object to its processing, to data portability, and to withdraw consent at any time. You can export your data (JSON, Excel and a ZIP of your files) and delete your account yourself in Settings. For anything else, write to [CONTACT EMAIL]; we reply within one month. When you delete your account or organization, the data is removed from our live systems at once, and backups that still contain it age out and are permanently purged within 30 days.
You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw), or the authority in your country of residence.
12. Children
Altanik is a professional tool and is not directed at children. We do not knowingly collect data from anyone under 16.
13. Changes to this policy
We will update this policy when our processing changes and notify you by email or in the app about material changes.