Privacy policy

1. Data controller

The controller of your personal data is Paweł Kazubski, trading as Prosciej (prosciej.com), with a registered address at ul. Leona Babińskiego 1, 71-051 Szczecin, Poland, tax ID (NIP) 955-215-93-41. Contact for data-protection matters: our contact form at prosciej.com/kontakt.

We have not appointed a Data Protection Officer (DPO). For all matters concerning personal data, please use the contact details above.

2. Scope of collected data

We process only the data necessary to provide the service and handle payments:

• account data: your email address and (when signing in with Google) the name from your Google profile,
• project data: room dimensions, panels, materials and files saved in the editor,
• billing data: subscription status and invoice details (name, address, tax ID) if you provide them,
• technical data: IP address, browser type and event logs required for security and diagnostics.

3. Purpose and legal basis of processing

We process your data for the following purposes and on the following GDPR legal bases:

• providing the service and maintaining your account — Art. 6(1)(b) GDPR (performance of a contract),
• handling payments and issuing invoices — Art. 6(1)(b) and (c) GDPR (legal obligation, including tax law),
• security, abuse prevention and diagnostics — Art. 6(1)(f) GDPR (legitimate interest),
• marketing communication (if you consent) — Art. 6(1)(a) GDPR (consent, which you may withdraw).

4. Data recipients and processors

We use trusted providers that process data on our behalf: hosting and infrastructure providers (Railway, Vercel), the payment operator (Stripe), a file-storage service (Cloudflare R2), and a transactional-email provider (ZeptoMail). We do not sell your data.

Some providers may process data outside the European Economic Area. In such cases, the transfer relies on Standard Contractual Clauses approved by the European Commission.

5. Data retention period

We keep account and project data for the duration of the contract (while your account exists). After you delete your account, we delete or anonymise the project data. Billing data and invoices are retained for the period required by tax law (generally 5 years).

6. Your rights

Under the GDPR you have the following rights, which you can exercise by contacting us:

• the right to access your data and obtain a copy of it,
• the right to rectify inaccurate data,
• the right to erasure (“right to be forgotten”),
• the right to restrict processing,
• the right to data portability,
• the right to object to processing based on legitimate interest,
• the right to withdraw consent at any time (without affecting the lawfulness of earlier processing),
• the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland.

7. Cookies and similar technologies

We use cookies and browser storage (localStorage) for purposes essential to the service — among others, keeping your login session and remembering your chosen interface language. This data stays on your device and is not used for profiling.

For analytics we use a two-level model. Without your consent we rely solely on cookieless analytics: PostHog (servers in the European Union) for product-funnel analysis, and Vercel Analytics and Speed Insights for traffic and page-performance metrics. In this mode these tools set no cookies or other identifiers on your device and are not used for profiling or advertising. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in maintaining and improving the service.

If you consent via the banner (Art. 6(1)(a) GDPR), PostHog will store a persistent, anonymous identifier on your device (in localStorage and a cookie) and automatically record page interactions (autocapture, excluding the 3D editor). This lets us recognise you on return visits and better understand how the service is used. You can withdraw consent at any time — via the “Change privacy settings” button at the bottom of this page or in the site footer — and withdrawing consent removes the identifier from your device.

PostHog and Vercel act as our processors and process this data on our behalf. If you would rather not be included in this analytics, enable the “Do Not Track” (DNT) signal in your browser — we respect it and then collect no analytics data; you can also use a script-blocking extension.

8. Contact

For matters related to personal-data protection, contact us through our contact form at prosciej.com/kontakt. We will respond without undue delay and no later than the period required by the GDPR.