EZINDRA Privacy Policy

This Privacy Policy applies to users outside Poland. The controller for the processing described in this Policy is Albert Fiksak, Długa 8a 32-830 Wojnicz (the "Operator"). Privacy requests and complaints may be sent to contact@ezindra.com.

Because the Operator is established in Poland, the GDPR applies to processing carried out in the context of that establishment regardless of where the user is located or whether the processing takes place in the Union. Mandatory privacy laws that apply to a particular individual or processing activity may grant additional rights or impose additional requirements, which apply to the extent required by law.

This Policy covers personal data for which the Operator determines the purposes and means of processing, including account, service, security, support and subscription-related data.

Where a user enters personal data of customers or other persons and determines the purposes and means of that processing, the user acts as controller and the Operator acts as processor to the extent necessary to provide EZINDRA. The Data Processing Agreement (DPA) governs that processing relationship.

We may process data provided directly by the user, including email address, display name, account and profile information, service settings, correspondence, support requests and content submitted to AI Support.

When EZINDRA is used, we also generate or receive technical and security data, including authentication and session information, IP address, approximate country derived from the connection, device, browser and operating-system information, subscription status, records of service operations, error information and records of privacy choices. These data may be processed independently of optional analytics consent where needed for security, diagnostics and session operation. Use of data for optional analytics or measurement takes place only after the user makes the relevant choice.

If the user signs in through an external authentication provider, such as Google, or uses a paid subscription, we may receive data from that provider or Paddle as needed to create or link the account, confirm the transaction and operate the subscription.

We process personal data only for specified purposes and only to the extent necessary for those purposes. Under the GDPR, the principal legal bases are:

• performance of the service agreement and steps requested before entering into it — including account creation, authentication, provision of EZINDRA features, including AI Support activated at the user's request, subscription administration, user-requested operations and support — Article 6(1)(b) GDPR;
• compliance with legal obligations — including accounting, tax, regulatory or legally binding authority requirements where applicable — Article 6(1)(c) GDPR;
• legitimate interests — including account and session security, service security, diagnostics, prevention of abuse and fraud, service reliability, communications, necessary compliance records and the establishment, exercise or defence of legal claims — Article 6(1)(f) GDPR; the interests pursued include the safe and reliable operation of EZINDRA and protection of the Operator's and users' rights;
• consent — for optional analytics and Google advertising or conversion measurement where the user gives the relevant consent — Article 6(1)(a) GDPR. Consent may be withdrawn at any time without affecting processing that was lawful before withdrawal.
• consent — for optional commercial and marketing emails from EZINDRA about news, features, tips and offers. Marketing consent is not required to use the service and may be withdrawn at any time in account settings or through the unsubscribe link in a message.

When the user uses AI Support, the message content, recent conversation context, language and current application screen or path are sent to Google Gemini to the extent needed to generate a response about using EZINDRA. AI Support does not automatically access client data, quote contents or other data stored in the account beyond information the user enters into the conversation and the stated technical context. Users should not submit client data, passwords, payment card data or other confidential information to AI Support.

EZINDRA may store minimal AI Support usage metadata needed for abuse prevention, limits and cost control. These logs do not contain question or answer content.

PostHog, Google Analytics 4 and optional Google advertising or conversion measurement are used only in accordance with the user's privacy choices described in the Cookie Policy and Privacy Settings. With analytics consent, PostHog may receive a pseudonymous EZINDRA account identifier to link analytics events across sessions and support error diagnostics. EZINDRA does not provide PostHog with the account email address, client data or form/quote contents for this purpose.

Personal data may be disclosed to providers of hosting, database and authentication, email, security, technical support, analytics and AI services only to the extent needed for the relevant function. The current provider list and their basic roles are published on the Providers, Subprocessors and Infrastructure page.

Paddle acts as Merchant of Record for paid transactions and as an independent controller where it determines how buyer data is processed for transactions, taxes, payments, refunds, fraud prevention and its legal obligations.

Data may also be disclosed to professional advisers, courts, public authorities or other authorised recipients where required by law or reasonably necessary for the establishment, exercise or defence of legal claims.

Technology providers may process personal data in the EEA and outside the EEA. The current list of principal countries and regions in which services used by EZINDRA process or receive data is published on the Providers, Subprocessors and Infrastructure page. For globally distributed services, the principal regions are identified and current provider information is linked where an exhaustive list of every location is not practicable.

Depending on the provider, processing location and transfer basis, transfers of personal data outside the EEA may rely, in particular, on a European Commission adequacy decision or on appropriate safeguards under Chapter V GDPR, such as Standard Contractual Clauses.

Information about the transfer basis and safeguards used, including how to obtain a copy of them or where they have been made available, may be obtained at contact@ezindra.com.

Additional cross-border transfer requirements imposed by other applicable privacy laws remain applicable to the relevant processing to the extent required by those laws.

Account and service data is retained while the account is used and afterwards only for as long as required by law or reasonably necessary for billing, security and the establishment, exercise or defence of legal claims.

Transaction records and documentation that must be retained by law are kept for the applicable statutory period. Support requests and correspondence are kept for as long as needed to handle the matter and related claims. Raw session metadata used for security and diagnostics is normally deleted 365 days after the last activity of the relevant session; data linked to a specific incident, abuse investigation or claim may be retained longer where necessary for that purpose.

Records of consent, withdrawal and acceptance of legal documents may be kept as needed to demonstrate compliance and defend claims. Personal data processed by the Operator on a user's behalf as processor is returned or deleted in accordance with the DPA.

Under the GDPR baseline, individuals may request access, correction, deletion, restriction and portability of personal data and withdraw consent at any time where processing is based on consent. Requests may be sent to contact@ezindra.com.

Right to object. Where personal data is processed on the basis of legitimate interests under Article 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation. If you object, the Operator will no longer process the personal data for that purpose unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

Individuals may also lodge a complaint with the supervisory or privacy authority competent for them. Exercising a right does not affect processing that was lawful before an effective withdrawal, objection or other request.

Mandatory privacy laws may grant individuals additional or differently named rights or may impose additional requirements on the Operator. Where such law applies to the relevant individual and processing, those mandatory rights and requirements apply in addition to this Policy and are not limited by it.

Depending on the applicable law, additional requirements may concern, for example, local or language-specific notices, methods for exercising rights, cross-border disclosures, or contact details of a locally required representative or privacy contact. Any jurisdiction-specific notice or addendum provided by EZINDRA for an affected jurisdiction forms part of this Policy for the individuals to whom it applies.

Requests under applicable privacy laws may be sent to contact@ezindra.com. This does not limit any other method of exercising rights where applicable law requires one.

Data marked as required for registration, authentication, account setup or subscription management is necessary to enter into or perform the relevant service relationship. Without it, the relevant account or function may not be available.

Optional analytics and Google advertising or conversion measurement are not required to use EZINDRA's core functions.

The Operator does not make decisions about users that produce legal or similarly significant effects solely by automated means. If such processing is introduced in the future, the information and safeguards required by applicable law will be provided before it begins.

Necessary technologies are used to operate and secure the service as described in the Cookie Policy. Optional analytics and advertising or conversion measurement are enabled only in accordance with the user's choices. Optional choices can be changed or withdrawn in Privacy Settings.

The Operator applies technical and organisational measures appropriate to the risk and follows data-minimisation principles. This Policy may be updated when processing practices, applicable law or providers relevant to transparency obligations change. Material changes are communicated as required by law.

Mandatory rights and protections under applicable local law are not limited by this Policy.