This Privacy Policy explains what personal data Expat Essentials Poland collects, why, on what legal basis, who we share it with, how long we keep it and your rights. It reflects how the service actually works.
Who is responsible (controller)
Łukasz Mucek, operating Expat Essentials Poland, Plac Piastów 3/5, 59-100 Polkowice, Poland. Contact for privacy matters: [email protected], phone +48 732 252 662.
What data we process
Depending on how you use the service, this may include:
- Account — name, email, authentication information, email verification / password-reset information, and Google sign-in information where you use it.
- Profile & situation — nationality / citizenship, residence and legal-stay information, city / voivodeship, your goals, worries and notes, relevant dates, and employment, housing, insurance and PESEL-related status where you provide it, plus household / dependent information.
- Documents — files you upload, text extracted from them, detected language, document metadata and interpretations.
- Case & plan intelligence — confirmed facts, candidate facts, deadlines, cases, case events, actions and workflow state.
- Assistant — your messages, conversation history and relevant context.
- Family / dependents — information you, as an adult account holder, choose to provide for family-related features, which may include a child’s birth year, nationality, legal status and PESEL / school-related status where relevant.
- Support — the email, message, category and status of your support requests, and limited technical context where it is actually collected.
- Technical & security — IP address, browser user-agent and activity / security information.
- Payment — Stripe customer / session / payment identifiers and your entitlement status. Your full card details are handled by Stripe and are not stored by us.
- Consents — your analytics consent, marketing consent, Terms acceptance and immediate-performance acknowledgement, with the relevant timestamp, version and context.
Why we use your data and our legal bases
- To provide the service you ask for (your account, plan, documents, assistant, purchases) — performance of our contract with you.
- To take steps you request before a contract (for example preparing a purchase).
- To meet legal obligations (for example accounting and tax records for purchases).
- For security, fraud prevention and protecting the service — our legitimate interests, balanced against your rights.
- Optional analytics — only with your consent.
- Optional marketing email — only with your consent.
Analytics and marketing are optional. Refusing them does not prevent you from using the essential parts of the service. Transactional and service emails (such as verification, receipts and reminders) are necessary to provide the service and are separate from marketing.
Service providers we share data with
We use the following providers to operate the service. We do not sell your personal data.
- OpenAI — AI processing for document interpretation, the assistant, official-letter decoding and related features.
Data: Document text submitted for interpretation; User questions / assistant messages; Derived structured facts - Abacus.AI — AI processing for the chat assistant, copilot, form assistance, simulations and related features.
Data: User questions / chat messages; Contextual prompt data - Stripe — Payment processing for the one-time Complete Poland Plan purchase.
Data: Payment card details (handled entirely by Stripe); Billing metadata; Purchase / checkout session identifiers - Brevo — Transactional email delivery and — only with explicit opt-in — marketing email.
Data: Email address; Name (if provided); Email delivery metadata - Google (Sign-In & Analytics) — Optional Google sign-in (OAuth) and, only after analytics consent, privacy-preserving usage analytics (GA4).
Data: Google account email / profile (sign-in only); Anonymous usage events (paths, behaviour — no personal content), only after consent - Object storage (Amazon S3) — Private storage of uploaded documents and files.
Data: Uploaded documents and files; File metadata - Web Push (VAPID) — Optional browser push notifications for reminders, only after the user enables them.
Data: Push subscription endpoint; Notification content (reminder titles)
International transfers
Some of these providers may process data outside the European Economic Area. Where that happens, we rely on appropriate safeguards (such as the providers’ standard contractual clauses or equivalent measures) to protect your data. Contact us if you would like more detail.
How long we keep it
- Account and core plan data — while your account exists and as needed to provide the service; after account deletion it is deleted, except anything we must keep by law.
- Uploaded documents — until you delete them, your account is deleted, or another stated rule applies.
- Official-letter decoder raw files — the raw uploaded file is removed automatically a short time after processing (approximately 10 minutes).
- Activity / security logs — retained for around 90 days by default, unless a security incident or the law requires longer.
- Support requests — up to 24 months after the request is resolved, unless a longer period is needed to handle legal claims or obligations.
- Consent and Terms-acceptance records — kept as long as needed to demonstrate consent / acceptance and compliance.
- Payment / transaction records — kept as required by accounting, tax and consumer law.
Documents and derived information
Deleting an individual document removes the stored file and its extracted text, but confirmed facts, case events, deadlines and interpretations already built into your plan may remain, because they are stored separately from your files. Deleting your account is the broad deletion mechanism. For broader deletion or correction, use your account “Data & Privacy” controls or contact us.
Your rights
Subject to the conditions in data-protection law, you have the right to access, correct, delete, restrict or object to processing of your data, to data portability, and to withdraw consent where processing is based on consent (without affecting earlier processing). You can export your data and delete your account from your account settings. Not every right applies in every situation.
You also have the right to complain to the supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), Warsaw, Poland.
Cookies and analytics
Analytics are off until you consent. See our Cookie Policy for details and controls.
Contact
For any privacy request or question, contact us at [email protected] or by post at Plac Piastów 3/5, 59-100 Polkowice, Poland.