Legal document
Privacy Policy
Effective 20 October 2026 — compliant with the GDPR (Regulation EU 2016/679)
1. Data Controller
The controller of your personal data is Solverte spółka z ograniczoną odpowiedzialnością, with its registered office at al. Bolesława Krzywoustego 4/1, 40-870 Katowice, VAT No.: 6343006519 (hereinafter: Controller).
For matters relating to personal data protection, you may contact us at: kontakt@prawnix.pl.
2. What Data We Process and Why
2.1 User account data
Scope: email address, first and last name (optional), password hash (stored by Supabase Auth).
Purpose: provision of services — registration, login, account management.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
2.2 Document content (order data)
Scope: data provided by the User during document generation (e.g., names of parties, amounts, dates, case numbers). This data may include personal data of third parties involved in the proceedings.
Purpose: generating a document draft in accordance with the User's instructions.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interests — fulfilling the ordered service).
Data relating to criminal offences: In a criminal complaint (zawiadomienie o przestępstwie) or an appeal against the discontinuance of proceedings (zażalenie na umorzenie postępowania), the User may provide data relating to criminal offences and to third parties (Art. 10 GDPR). We process such data solely to prepare the document at the User's request (Art. 6(1)(b) GDPR), without profiling and without using it to train models; it is retained for the same period as other documents.
Note: The content of the order is transmitted to the Anthropic, Inc. API (USA) for document generation. See details in section 4.
2.3 Billing data
Scope: payment transaction data (amount, date, status) processed by Stripe Payments Europe, Ltd. The Controller does not store payment card data.
Purpose: processing payments, issuing VAT invoices, managing subscriptions.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (legal obligation — tax and accounting regulations).
2.4 Technical data and logs
Scope: IP address, browser type, visit time, session identifiers, application error logs.
Purpose: ensuring Service security, error diagnostics, preventing abuse.
Legal basis: Art. 6(1)(f) GDPR (legitimate interests of the Controller — security and stability of the service).
2.5 Deadline reminders (deadline calculator)
Scope: email address, deadline date, deadline description, hashed IP address.
Purpose: sending the single deadline reminder you request in the calculator, after you confirm the address via the link in our message. The address is not used for anything else, including marketing.
Legal basis: Art. 6(1)(b) GDPR (service provided at your request).
Retention: 30 days after the deadline; unconfirmed requests — 48 hours. You can delete it earlier with the link in every message.
Recipient: Resend, Inc. (email delivery).
2.6 Messages after a free document
Scope: account email address, document type.
Purpose: one reminder or suggestion of the next step in the same matter.
Legal basis: consent — Art. 6(1)(a) GDPR and Art. 398 of the Polish Electronic Communications Law. You can withdraw consent at any time via the link in the message.
Retention: until the message is sent or consent is withdrawn.
2.7 Preventing abuse of free documents
Scope: a pseudonymous digest (HMAC-SHA256 with a secret key) of your email address after normalisation — lowercase, for Gmail without dots and without the part after “+”, for a few other providers without the part after “+” — and the date of the free generation. At registration we also check whether the address domain is on a list of disposable-mailbox domains; the result of that check is not stored.
Purpose: enforcing the free-document limit per mailbox, including when someone opens further accounts on variants of the same address or deletes the account and registers again; one account per mailbox; refusing registration from disposable addresses.
Legal basis: Art. 6(1)(f) GDPR (legitimate interests of the Controller — preventing abuse of the free service). You may object (Art. 21 GDPR).
Retention: 30 days after the last free generation. The digest is not erased together with the account (otherwise deleting the account would reset the limit), but after deletion it is no longer linked to the account and it is removed automatically after 30 days.
3. Retention Periods
- Account data: for the duration of the account + 3 years after deletion (for potential claims).
- Document content (history): for the duration of the account. Free Plan — 7-day history. PRO Plan — unlimited.
- Billing data and invoices: 5 years from the end of the tax year in which the invoice was issued (statutory accounting requirement).
- Technical logs: up to 12 months.
- Deadline reminders: 30 days after the deadline; unconfirmed — 48 hours.
- Email digest (free-document limit): 30 days after the last free generation, also after the account is deleted.
4. Recipients — Data Processors
Your data may be transferred to the following processors acting under data processing agreements:
| Entity | Processing purpose | Country / mechanism |
|---|---|---|
| Vercel, Inc. | Application hosting, content delivery (edge functions) | USA (SCC) |
| Supabase, Inc. | Database, authentication | USA (SCC) |
| Anthropic, Inc. | AI document generation | USA (SCC) |
| Stripe Payments Europe, Ltd. | Payment processing, invoices | EU / USA (SCC) |
| Resend, Inc. | Transactional email delivery | USA (SCC) |
| Upstash, Inc. | Rate limiting, short-lived verification code storage | USA (SCC) |
| Functional Software, Inc. (Sentry) | Application error monitoring (PII is filtered before transmission) | USA (SCC) |
SCC — Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c) GDPR) as a safeguard mechanism for data transfers to third countries.
Separately from the processors listed above: for traffic and advertising measurement we use Google Analytics 4 and Google Ads (Google Ireland Limited, Ireland; onward transfer to Google LLC in the USA under the European Commission's adequacy decision — the EU-US Data Privacy Framework), and, once you give consent, the Meta Pixel (Meta Platforms Ireland Limited). In that respect Google and Meta do not act solely as processors — they decide on some of the processing purposes themselves and therefore act as independent controllers or joint controllers. Section 6 describes what data is transmitted before and after consent.
This list is kept up to date. For questions regarding a specific processor, please contact kontakt@prawnix.pl.
5. Your Rights
You have the following rights regarding the processing of your personal data (Arts. 15–21 GDPR):
- Right of access — you may request information about the data being processed and obtain a copy (Art. 15 GDPR).
- Right to rectification — you may request correction of inaccurate or completion of incomplete data (Art. 16 GDPR).
- Right to erasure — you may request deletion of your data ("right to be forgotten") in the cases set out in Art. 17 GDPR.
- Right to restriction of processing — in the situations specified in Art. 18 GDPR.
- Right to data portability — to receive your data in a structured, machine-readable format (Art. 20 GDPR).
- Right to object — to processing based on legitimate interests (Art. 21 GDPR).
Right to lodge a complaint: you may file a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.
To exercise any of these rights, write to: kontakt@prawnix.pl. We respond within 30 days of receiving the request.
6. Cookies
- The Service uses cookies and similar tracking technologies.
- Necessary cookies (no consent required) — files required for the Service to function: authentication session, language preferences, Terms acceptance.
- Analytical and statistical cookies — require your consent. They allow us to analyse how the Service is used in order to improve it.
- Cookieless measurement — the Google measurement script also loads when you do not give consent. In that case we neither write nor read any cookies, and a single request without identifiers reaches Google: your IP address, browser information and the address of the page you are viewing. Advertising click identifiers are stripped from that request. The data is used solely to estimate visit and order counts statistically — we build no profile from it and do not recognise you on later visits. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in measuring the effectiveness of our own advertising. You may object under Art. 21 GDPR by writing to kontakt@prawnix.pl. Once you give consent, measurement operates in full, with cookies.
- You may manage cookie settings in your browser preferences. Disabling necessary cookies may prevent you from using the Service.
- Legal basis: Art. 5(3) of the ePrivacy Directive and Art. 6(1)(a) GDPR (consent) for optional cookies.
7. Data Security
We apply appropriate technical and organisational measures to protect your personal data, including: data transmission encryption (TLS/HTTPS), role-based access controls, row-level security policies in the database, regular backups, and security monitoring.
We maintain a record of cookie consents in accordance with Art. 7(1) GDPR — each acceptance or rejection is logged with a timestamp, policy version, language, and an irreversible hash of the device identifier (IP hash), enabling us to demonstrate consent to the supervisory authority on request.
Sensitive operations (account deletion, data export) are protected by a one-time verification code sent to the email address associated with the account.
8. Changes to This Privacy Policy
The Controller reserves the right to update this Policy. We will notify registered Users of material changes by email at least 14 days in advance. The current version is always available at prawnix.pl/privacy.
This Policy takes effect on 20 October 2026.