Sbrain Privacy Policy

1. Data controller

The controller of personal data relating to Accounts and the operation of Sbrain is Grzegorz Rydzkowski, a sole trader, ul. Starogardzka 31, 80-180 Borkowo, Pomorskie, Poland, tax identification number (NIP): 9571001084, statistical identification number (REGON): 38825947300000.

For privacy enquiries, email contact@owline.pl.

2. Data we process

• Account data — full name, email address, encrypted or hashed authentication data, verification status, plan and settings.
• User content — tasks, notes, client and contact details, projects, estimates, financial information, attachments and other data voluntarily stored in the Application.
• Billing data — customer and subscription identifiers, plan status, billing dates and information necessary to handle payments. Full payment card details are handled by Paddle and do not reach Sbrain.
• Technical and security data — IP address, browser and device information, timestamps, API key and webhook metadata, and events needed to protect the Account, diagnose issues and prevent abuse.
• Correspondence — messages, complaints and support requests, together with information needed to respond.
• Optional feature data — web push subscriptions and approximate coordinates used to retrieve weather information. Once permission is granted, coordinates are rounded to two decimal places, stored in the browser and reused until the location is changed or site data is cleared. They are not stored in the Account.

3. Purposes and legal bases

• Creating an Account and providing the service — performance of a contract or taking steps before entering into a contract (Article 6(1)(b) GDPR).
• Billing, accounting and legal obligations — compliance with legal obligations (Article 6(1)(c) GDPR).
• Security, abuse prevention, diagnostics and legal claims — the Controller’s legitimate interest in protecting the Application, Users and the Controller’s rights (Article 6(1)(f) GDPR).
• Handling questions and complaints — performance of a contract, a legal obligation or a legitimate interest in responding, depending on the nature of the request (Article 6(1)(b), (c) or (f) GDPR).
• Notifications and weather — providing a feature enabled at the User’s request (Article 6(1)(b) GDPR), subject to permissions granted in the browser or device.

Providing the information required at registration is voluntary but necessary to create an Account. Other data is provided voluntarily, depending on the features used.

4. Other people’s data entered by the User

The User may store data about their clients, contacts or other people in Sbrain. In that context, the User determines the purposes and legal bases for using the data, and the Controller processes it technically to provide the service. The User is responsible for obtaining the data lawfully and fulfilling obligations towards the individuals concerned.

Special categories of personal data and data about criminal convictions and offences should not be entered in the Application unless necessary, lawful and appropriately protected by the User.

5. Recipients of data

Data may be entrusted or disclosed only to the extent necessary to:

• hosting, infrastructure, email, backup and technical support providers;
• Paddle, in connection with purchasing and managing the Pro Plan; Paddle also acts as an independent controller for payment data and merchant obligations;
• web push technology providers and browser or operating system vendors if the User enables notifications;
• Open-Meteo and BigDataCloud, for approximate coordinates needed to return weather information and the place name respectively, without transmitting Account data;
• people and services selected by the User when using list sharing, public estimate links, API keys or webhooks;
• legal advisers, accountants or public authorities where necessary to comply with a legal obligation or protect legal claims.

The Controller does not sell personal data or disclose it for other parties’ advertising.

6. Transfers outside the EEA

Some technology providers may process data outside the European Economic Area. In that case, transfers take place under a European Commission adequacy decision, standard contractual clauses or another mechanism permitted by the GDPR. Information about the safeguards used is available from the Controller’s contact address.

7. How long we keep data

• Account data and User content — for the duration of the agreement and, after Account deletion, for the time technically necessary to remove them from backups.
• Billing data and legally required documents — for the periods required by tax, accounting and billing laws.
• Correspondence and data needed for legal claims — until the matter is closed and then until the applicable limitation period expires.
• Security logs — for the time necessary to detect abuse, determine the causes of an incident and protect legal claims, no longer than justified by the purpose of processing.
• Web push data — until notifications are disabled, the subscription is removed or it is found to be inactive.
• Weather data — rounded coordinates remain in browser storage until the location is changed or site data is cleared; weather results are cached on the server for up to 30 minutes, and place names together with their coordinate keys for up to 30 days.

Data may be kept longer if required by law, the protection of legal claims or an order from a competent authority.

8. Cookies and device storage

Sbrain uses technically necessary cookies and browser storage to maintain a secure session, protect requests, remember the selected theme, language and last weather location, and operate the Application. Blocking them may prevent sign-in or the use of some features.

On the public pages (home page, Terms, Privacy Policy) Sbrain uses Google Analytics 4, provided by Google Ireland Limited, only with your consent (art. 6(1)(a) GDPR, art. 173 of the Polish Telecommunications Law). Until you consent, the tool sets no cookies (Consent Mode). After consent it sets the _ga and _ga_* cookies (up to 2 years), IP addresses are truncated, and statistics are retained in Google Analytics for 2 months. Google may process this data outside the EEA under standard contractual clauses.

Your decision is stored in the sbrain_consent cookie (12 months). You can withdraw or change it at any time through the “Cookie settings” link in the page footer. No analytics or advertising tools run inside the signed-in Application. Sbrain does not use advertising cookies.

9. Your rights

To the extent provided by the GDPR, you have the right to:

• access your data and receive a copy;
• rectify your data;
• have your data erased;
• restrict processing;
• port data processed by automated means on the basis of consent or a contract;
• object to processing based on a legitimate interest;
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of earlier processing.

Requests can be sent to contact@owline.pl. To protect your data, the Controller may ask you to verify your identity.

Anyone who believes their data is being processed unlawfully may lodge a complaint with the President of the Polish Personal Data Protection Office: uodo.gov.pl.

10. Security

The Controller uses appropriate technical and organisational measures, including access controls, encryption in transit, protection of authentication data and restricted data access. No system can eliminate all risk. Suspected security incidents should be reported to the contact address without sending passwords, tokens or recovery codes.

11. Automated decisions and profiling

Data is not used to make decisions about the User based solely on automated processing that produce legal or similarly significant effects. Sbrain does not profile Users for advertising purposes.

12. Changes to this Policy

This Policy may be updated when features, providers or the law change. The current version will always be available on this page. Users will be appropriately informed of changes that materially affect how their data is processed before those changes take effect.