Back to home

Privacy Policy

Version 1.7 · Last updated 24 October 2026

These terms are being finalised and are pending a final professional legal review. If anything here is unclear, contact us and we will be happy to help.

This Privacy Policy explains what personal data Expat Essentials Poland processes, why we process it, the main legal bases, who supports the service, how long data is kept and the rights available to you.

Controller

The controller is Łukasz Mucek, operating Expat Essentials Poland, plac Piastów 3/5, 59-100 Polkowice, Poland. Privacy contact: support@expatessentials.pl. Phone: +48 732 252 662.

Data we may process

  • Account data — name, email, authentication information, email-verification/password-reset data and Google sign-in information where Google login is used.
  • Profile and Poland situation — citizenship, residence/legal-stay information, city or voivodeship, goals, worries, relevant dates and details about work, housing, health insurance, PESEL, address registration and family/dependants where you provide them.
  • Documents — files you upload, extracted text, document metadata, interpretations and structured facts derived from the file.
  • Plan, case and workflow data — guide progress, confirmed facts, cases, deadlines, actions, reminders, case events and related state.
  • Assistant and AI requests — messages, conversation context, document content and relevant profile/workflow context required to provide the requested feature.
  • Payments and access — Stripe customer, subscription, checkout session and payment identifiers; purchase status; EEP PLUS entitlement; AI Action allowance/top-up records; and terms/consent records. EEP does not store your full payment-card number.
  • Support and communications — support requests, transactional/service emails, reminder delivery records and marketing consent where you choose to opt in.
  • Waiting-time board and karta pobytu tracker — if you choose to share them: your voivodeship office, permit type and dates (no name, PESEL or case number). The tracker itself is saved on your device. If you turn on tracker reminders, we keep your e-mail address linked to that anonymous case until you unsubscribe or add your decision.
  • Technical and security data — IP address, browser/user-agent, request/activity information, authentication and security events.

EEP PLUS and AI Action purchases

When you subscribe to EEP PLUS or buy an AI Action top-up, Stripe processes the payment and returns identifiers and payment/subscription status to EEP. We use those records to activate access, maintain the monthly entitlement, account for included and purchased AI Actions and support billing or refund issues.

The acceptance of purchase terms and any immediate-performance acknowledgement is recorded with a version and timestamp so the purchase flow can be evidenced later.

Poland Move Check

Poland Move Check can be bought separately without an EEP PLUS subscription and, where supported, without an EEP account. For a paid report we process the purchase email, submitted relocation profile, consent/purchase record, payment identifiers, generated report and the information needed to provide private report access.

The report input is used with OpenAI to generate the report. For research, the report uses the web search built into the OpenAI API: short search queries about Polish rules and costs are sent through OpenAI, not your name or e-mail address. We do not use a separate search provider. Stripe receives payment/order metadata, not the report answers themselves.

Raw report input is removed after processing, failed processing or checkout expiry according to the product workflow. The encrypted report remains with the order until erased or otherwise removed under the product/account rules. Minimal purchase and consent records may be kept where needed for accounting, complaints and legal obligations.

Why we process data

  • Performance of the contract — to create and operate your account, personalised plan, assistant, documents, reminders, purchased subscription, AI Actions and paid reports.
  • Steps requested before entering a contract — for example preparing a checkout or report order.
  • Legal obligations — for example accounting, tax and consumer-law records where they apply.
  • Legitimate interests — security, fraud prevention, service reliability, abuse prevention and protecting legal claims, balanced against your rights.
  • Consent — optional analytics and optional marketing email.

Service and transactional emails

Account verification, security messages, receipts, service reminders, unfinished-flow reminders, case/deadline reminders and other messages needed to operate features you use are service communications, not marketing. Where the product provides notification controls, we apply those controls to eligible reminder categories. Marketing email is sent only after separate opt-in.

Providers and recipients

We use the providers below to run EEP. We do not sell personal data. The exact data sent depends on the feature you choose to use.

  • Vercel — Hosting and delivery of the Expat Essentials Poland web application, API routes and scheduled jobs.
    Data: Account and request data processed by the application; Technical request metadata and server logs
    Location: Hosting region Frankfurt, Germany (fra1); Vercel Inc. is a US company. Transfer safeguard: EU–US Data Privacy Framework and/or Standard Contractual Clauses.
  • Prisma Postgres (Prisma Data, Inc.) — Managed PostgreSQL database: persistent storage of account, profile, plan, case, consent and application records in the production database.
    Data: Account and profile data; Plan, case and workflow records; Consent, activity and purchase metadata
    Location: AWS eu-central-1, Frankfurt, Germany; Prisma Data, Inc. is a US company. Transfer safeguard: EU–US Data Privacy Framework and/or Standard Contractual Clauses.
  • Cloudflare R2 — Private object storage for uploaded documents and files using an S3-compatible API.
    Data: Uploaded documents and files; File metadata
    Location: Cloudflare global network; Cloudflare Inc. is a US company. Transfer safeguard: EU–US Data Privacy Framework and/or Standard Contractual Clauses.
  • OpenAI — AI processing for the assistant, document interpretation, official-letter decoding, report generation and related AI features, including the web search built into the OpenAI API that Poland Move Check uses for research queries.
    Data: Document text submitted for interpretation; User questions / assistant messages; Relevant profile or workflow context required for the requested feature; Derived structured facts and report inputs
    Location: USA. Transfer safeguard: EU–US Data Privacy Framework and/or Standard Contractual Clauses.
  • Stripe — Payment processing, subscription billing, one-time purchases, customer portal access and payment-status confirmation.
    Data: Payment card details (handled entirely by Stripe); Billing and customer metadata; Subscription, checkout session and payment identifiers
    Location: EU (Stripe Payments Europe, Ireland) and USA. Transfer safeguard: EU–US Data Privacy Framework and/or Standard Contractual Clauses.
  • Brevo — Transactional and service email delivery and — only with explicit opt-in — marketing email.
    Data: Email address; Name (if provided); Transactional message and delivery metadata
    Location: France / EU. Transfer safeguard: No transfer outside the EEA for storage; any sub-processor transfers under Standard Contractual Clauses.
  • Google (Sign-In, Analytics & Ads) — Optional Google sign-in (OAuth). Google Analytics 4 uses Consent Mode: analytics and advertising storage stay denied until you choose. A cookieless page view may include ad-click and campaign parameters that were already in the landing URL. Other URL parameters are removed. Advertising cookies and the Google ads tag run only after marketing consent, when an ads tag is configured. While ad storage is denied, ad click identifiers are redacted from advertising requests.
    Data: Google account email / profile used for sign-in; Usage events and technical analytics data; cookieless pings may include landing-page ad-click parameters (gclid, gbraid, wbraid, gad_source) and utm parameters; Ad click and conversion measurement after marketing consent
    Location: EU and USA. Transfer safeguard: EU–US Data Privacy Framework and/or Standard Contractual Clauses.
  • Meta Platforms — Advertising measurement with the Meta Pixel and Conversions API, only after marketing consent, so ad campaigns can count visits and purchases. The pixel library is not loaded at all until you grant marketing consent; no events are sent and no advertising cookies are set before that.
    Data: Cookie identifiers (_fbp, _fbc), IP address and browser type after marketing consent; Page and product views on the MOS package pages, checkout starts and purchases (value, currency and product id); Hashed email address on a consented checkout or purchase event
    Location: Ireland (Meta Platforms Ireland) and USA. Transfer safeguard: EU–US Data Privacy Framework and/or Standard Contractual Clauses.
  • Google Cloud Vision — OCR processing for supported document-reading features when this provider is used.
    Data: Images or document pages submitted for OCR
    Location: EU and USA. Transfer safeguard: EU–US Data Privacy Framework and/or Standard Contractual Clauses.
  • PDF.co — PDF processing and form/document generation for supported features when this provider is used.
    Data: Document content required for the requested PDF operation
    Location: Outside the EEA (provider infrastructure). Transfer safeguard: Standard Contractual Clauses.
  • Web Push infrastructure (VAPID) — Optional browser push notifications for reminders after the user enables them.
    Data: Push subscription endpoint; Notification content required for the reminder
    Location: Your browser vendor's push service (e.g. Google, Mozilla, Apple), which may be outside the EEA. Transfer safeguard: The push service chosen by your browser; we send only the reminder text and an endpoint id.

Current hosting and storage

The EEP application and API run on Vercel. User files are stored in private Cloudflare R2 object storage using its S3-compatible interface. New private document uploads are encrypted by EEP with authenticated AES-256-GCM encryption before the stored bytes leave the application runtime. Document downloads are owner-checked by EEP and streamed through the authenticated application instead of exposing a direct R2 object URL. Persistent account and product data is stored in a Prisma Postgres database hosted in the AWS eu-central-1 region (Frankfurt, Germany). Abacus.AI is not part of the current production runtime or AI-processing stack.

International transfers

Our application and database run in Frankfurt, Germany. Some providers are US companies or may process data outside the European Economic Area. For each provider, the list above names where the data is processed and the safeguard used. For US providers, this is the EU–US Data Privacy Framework (for companies certified under it) and/or the European Commission's Standard Contractual Clauses (art. 45 and art. 46 GDPR). You can ask us for a copy of the relevant safeguards.

Automated decisions

We use AI to explain documents, generate guidance and sort your situation into likely routes and deadlines. We do not make decisions that have legal or similarly significant effects on you solely by automated means within the meaning of art. 22 GDPR. Decisions about your residence, work or benefits are made by the competent offices and institutions. If you think an automated result is wrong, contact us and a person will review it.

Documents with sensitive information

Official letters and documents you upload may contain sensitive information, for example health data in a medical certificate or information about criminal records. Please upload only documents you need us to read, and black out details you don't need explained. If you choose to upload such a document, we process it only to give you the explanation or feature you asked for, based on your explicit consent (art. 9(2)(a) GDPR). You can withdraw that consent at any time by deleting the document. We do not use these documents for advertising or analytics.

Retention

  • Account and core plan data — while the account exists and as needed to provide EEP, except records that must be kept longer by law.
  • Uploaded documents — until you delete them or delete your account. Deleting your account also deletes your stored files.
  • Official-letter decoder temporary result — normally expires after approximately 10 minutes; the saved document itself follows the document-retention rule above.
  • Activity/security logs — generally around 90 days unless needed longer for a security incident, abuse investigation or legal obligation.
  • Support requests — generally up to 24 months after resolution unless a longer period is justified for claims or legal obligations.
  • Payment, billing, purchase and terms records — for 5 years from the end of the calendar year in which the payment was made (Polish tax and accounting law), and longer only while a complaint or legal claim is open.
  • Marketing e-mail — until you withdraw consent or unsubscribe. After that we keep only your e-mail address on a suppression list, so that we don't write to you again.
  • Backups — deleted data can remain in our database provider's encrypted backups until those backups are overwritten on a rolling basis. Backups are used only to restore the service after a failure.

Deleting documents and derived data

Deleting a document removes the stored file and its extracted text, but confirmed facts, case events, deadlines and plan information already saved separately may remain. You can correct relevant facts in EEP, use account privacy controls, delete your account where available or contact us for a broader request.

Your rights

Subject to the conditions in applicable data-protection law, you may have rights to access, correction, deletion, restriction, objection and portability, and the right to withdraw consent where consent is the legal basis. Withdrawal of consent does not affect processing that was lawful before withdrawal.

You also have the right to lodge a complaint with a competent supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), Warsaw, Poland.

Cookies and analytics

Optional analytics storage stays off until you consent. The cookie banner records whether it was shown, accepted or declined as a Google consent-mode event. Until you accept analytics, that event is a cookieless ping with no analytics cookie and no email address. A separate cookieless page view may include ad-click and campaign parameters that were already in the landing URL; other query parameters are removed. While advertising storage is denied, ad click identifiers are redacted from advertising requests. Optional advertising measurement (Meta and, when configured, Google ads) stays off until you grant marketing consent in the same cookie banner. The Meta Pixel library is not loaded at all until you accept marketing, and it sends no events and sets no advertising cookies before that. Essential session, security and product storage can operate without either consent. Details are in the Cookie Policy.

Contact

For privacy questions or requests, email support@expatessentials.pl or write to plac Piastów 3/5, 59-100 Polkowice, Poland.

Privacy Policy — Expat Essentials Poland