Privacy Policy
Polski · Українська · Русский · English
This is a reference translation for convenience. The legally binding text is the Polish version; in case of any discrepancy the Polish version prevails. Draft: before sales open, the controller's details are still pending.
1. Controller
The controller of personal data is [IMIĘ I NAZWISKO], a sole trader (autónomo) in Spain, NIF [NIF], [ADRES W HISZPANII], e-mail: kontakt@taktona.com. We have not appointed a data protection officer; for matters concerning personal data please write to the e-mail address above.
2. What data we process and why
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account: a random identifier (only its hash is stored in our database), creation date, chosen language | Access to the Panel and results | Art. 6(1)(b) GDPR (contract) | until the account is deleted |
| Voluntarily provided contact for regaining access (e-mail or phone) | Regaining access, notification that the report is ready (without the content of the findings) | Art. 6(1)(b) GDPR | until the account or the contact is deleted |
| Login e-mail address (confirmed by code), hash of the login code, number of attempts, IP address | Passwordless login to the Panel, notifications, abuse prevention | Art. 6(1)(b) and (f) GDPR | e-mail: until the account is deleted; codes: 30 days |
| Questions asked in the Panel (content, related finding, answers) | Handling questions and complaints | Art. 6(1)(b), (c) and (f) GDPR | 3 years |
| Links to the Report without login (token hash, expiry date) | Passing the Report to a contractor at the User's request | Art. 6(1)(b) GDPR | until revoked or 30 days after expiry |
| Address of the analysed website, analysis results (Puls, Score), screenshots of pages, report | Performance of the service | Art. 6(1)(b) GDPR | Puls: 72 hours; Score: 12 months |
| E-mail address to which a verification code was sent, hash of the code, number of attempts | Confirmation of website ownership, abuse prevention | Art. 6(1)(b) and (f) GDPR (security) | 30 days |
| Account event log (login, link change, code sending), IP address | Security, investigating reports | Art. 6(1)(f) GDPR | 90 days |
| Payment data (name, e-mail, country, card data) | Purchase of the service | Separate controller: Paddle (merchant of record) | under Paddle's rules |
| E-mail enquiries | Handling enquiries and complaints | Art. 6(1)(b), (c) and (f) GDPR | 3 years |
| E-mail address sent with a request for a one-time notification about a new service | One notification when the service becomes available | Art. 6(1)(a) GDPR (consent, which can be withdrawn) | until the notification is sent or consent is withdrawn |
We do not conduct direct marketing and do not profile users. We do not send messages such as "we found problems on your website" to addresses obtained from websites.
3. Third-party data on analysed websites
When analysing a website, we process its publicly accessible content. It may contain personal data of third parties: the name of the business owner, contact details, data in the website's terms or privacy policy. The legal basis is our legitimate interest and the user's interest in performing the ordered analysis (Art. 6(1)(f) GDPR). We process only public content, respecting the robots.txt file and request limits; this data is not combined into profiles of persons and is not used for other purposes. The full report with findings is made available only to a person who has confirmed control of the website. Information for persons whose data may appear on analysed websites is provided on the GDPR notice (Article 14) page.
4. Recipients of data
| Entity | Role | Scope | Location |
|---|---|---|---|
| Paddle.com Market Ltd | Seller (merchant of record), separate controller of payment data | purchase and payment data | United Kingdom (EC adequacy decision) |
| Anthropic, PBC | Processor: analysis of website content by AI models | content of analysed websites | USA (EU-U.S. Data Privacy Framework / standard contractual clauses); data is not used to train models |
| Server provider (application server, and hosting of the website and the kontakt@ mailbox) | Processor: servers of the Service | all Service data | Netherlands (EU) |
| Resend, Inc. | Processor: sending transactional messages (codes, notifications) | e-mail address, message content | USA (DPF / SCC) |
| Cloudflare, Inc. | Processor: protecting the form against bots (Turnstile) | technical browser signals | USA / EU (DPF) |
We do not transfer data to anyone other than the entities listed; to public authorities only on the basis of legal provisions.
5. Cookies and tracking tools
The Service uses only necessary session cookies in the Panel (to keep you logged in); we do not use analytics or advertising tools and do not load tracking scripts, so we do not display a consent banner. Fonts and assets are loaded from our own servers. The Paddle checkout window uses its own necessary cookies.
6. Your rights
You have the right to access your data, to rectify, erase and restrict its processing, to data portability, and to object to processing based on legitimate interest. Send your request to kontakt@taktona.com; we respond within one month. You also have the right to lodge a complaint with a supervisory authority: in Poland, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl); in Spain, the Agencia Española de Protección de Datos (aepd.es).
7. Automated processing
The report is produced automatically, including with the use of artificial intelligence, and is marked as such. The report does not produce legal effects concerning persons and does not similarly significantly affect them within the meaning of Art. 22 GDPR: it is informational material for the person who ordered an analysis of their own website. Findings of the highest severity are reviewed by a human before the report is released.
8. Security
Connections are encrypted (HTTPS). Only hashes of account identifiers and codes are stored in the database. Reports are accessible only to the person holding the link to the Panel after confirming ownership of the website. Reports and analysis data are deleted automatically after the periods set out in section 2.
9. Changes
We inform about material changes to this policy in the Service. Version: 0.1, date: 23.10.2026.