Privacy Policy

The controller of your personal data is:

Kamil Zwarycz, conducting business under the name LogicLoom Kamil Zwarycz
Registered in the Central Registration and Information on Business (CEIDG)
NIP: 5871749235 | REGON: 540001576
Kalinowa 6L lok. 3, 81-198 Kosakowo, Poland
Email: [email protected]

Public register: biznes.gov.pl

This Privacy Policy explains how we collect, use, store, and protect personal data in connection with the BudiBuilder platform, and describes your rights under Regulation (EU) 2016/679 (GDPR), the Polish Act on Personal Data Protection, and the Act on the Provision of Electronic Services.

We have not appointed a Data Protection Officer (DPO), as we do not meet the thresholds requiring mandatory DPO appointment under Article 37 GDPR. Privacy queries may be directed to [email protected].

BudiBuilder operates in two distinct data protection roles, and it is important to understand the distinction:

Role 1 — Data Controller (for Subscriber account data):
When you register and use BudiBuilder, we determine the purposes and means of processing your personal data (name, email address, billing information, usage data). In this capacity we are your data controller and this Privacy Policy applies fully.

Role 2 — Data Processor (for your clients' data):
When you use BudiBuilder to store records about your own clients (client names, contact details, appointment notes, service history), you — the contractor or service provider — are the data controller of that client data. We process it solely on your behalf, under your instructions, as your data processor under Article 28 GDPR.

As your data processor, we:
• Process your clients' data only as necessary to provide the Service, never for our own marketing or analytics purposes.
• Maintain confidentiality and implement appropriate technical security measures.
• Notify you promptly of any data breach affecting your clients' data.
• Delete or return all client data upon termination of your subscription.

You are responsible for ensuring you have a lawful GDPR basis to collect and store your clients' data in BudiBuilder. If your clients are residents of the EU/EEA, you must provide them with a GDPR-compliant privacy notice.

The Data Processing Agreement (DPA) embedded in our Terms of Service governs our processor relationship with you.

We collect and process the following categories of personal data about Subscribers (not end-clients):

Account data: full name, business name (if applicable), email address, password (stored as a one-way cryptographic hash — we cannot recover your password), profile photo (optional).

Billing and payment data: billing name and address, invoice email, VAT number (if applicable). Payment card details are collected and stored exclusively by Stripe, Inc. — we receive only a payment token and the last four digits of your card.

Usage and technical data: IP address, browser type and version, device type, pages visited, features used, session duration, timestamps, error logs, and performance metrics. This data is collected automatically when you use the Service.

Communication data: the content of emails, support tickets, and chat messages you send to us.

Subscriber-entered client data: as a data processor (see Section 2), we store the client records you input. This data belongs to your clients and you are responsible for it.

We do not intentionally collect or process special categories of personal data (sensitive data) under Article 9 GDPR — such as health data, biometric data, or religious beliefs — about Subscribers. If any such data appears in Subscriber-entered client records, you are responsible for ensuring a lawful basis exists.

We process your personal data on the following lawful bases under Article 6 GDPR:

Contract performance (Art. 6(1)(b) GDPR): Account data and billing data are processed to enter into and perform the subscription agreement with you — to provide access, manage your account, issue invoices, and provide support. Providing this data is a contractual requirement; without it we cannot provide the Service.

Legitimate interests (Art. 6(1)(f) GDPR): Usage and technical data are processed for our legitimate interests in: improving the Service and user experience, detecting and preventing fraud, abuse, and security incidents, and monitoring system performance. We have balanced these interests against your rights and concluded that our interests do not override yours, given the limited sensitivity of usage data.

Legal obligation (Art. 6(1)(c) GDPR): Billing records and invoices are retained to comply with Polish tax and accounting law (Ustawa o rachunkowości, Ordynacja podatkowa), which requires retention for 5 years.

Consent (Art. 6(1)(a) GDPR): Where we rely on consent — for example, for non-essential analytics cookies or for sending marketing communications — you may withdraw your consent at any time without affecting the lawfulness of prior processing. Withdrawal can be done via the cookie management panel or by emailing [email protected].

We use your personal data for the following purposes:

Service provision: to create and manage your account, provide access to all Service features, and ensure the Service functions correctly for you.

Billing and invoicing: to process subscription payments via Stripe, issue VAT invoices, handle failed payments, and maintain financial records.

Customer support: to respond to your support requests, troubleshoot issues, and improve our help documentation based on common issues.

Service communications: to send transactional emails essential to your use of the Service — account confirmation, password resets, subscription renewal notices, payment receipts, and important Service updates.

Service improvement and security: to monitor system performance, detect bugs, analyse usage patterns (in aggregated/anonymised form where possible), prevent fraud, and maintain the security and integrity of the Service.

Legal compliance: to fulfil our obligations under Polish and EU law, including tax, accounting, and data protection requirements.

Marketing (with consent only): if you have opted in, we may send newsletters, product update announcements, and promotional offers. You may unsubscribe at any time via the link in any marketing email or by contacting [email protected].

We do not sell your personal data to third parties. We do not use your personal data for automated profiling that produces legal or similarly significant effects.

We retain your personal data only for as long as necessary for the purposes described in this Policy:

Account data (name, email, profile): retained for the duration of your active subscription plus 30 days after account deletion. The 30-day period allows you to export your data before permanent deletion.

Client data (entered by you as Subscriber): treated identically — retained for 30 days post-termination, then permanently deleted.

Billing records and invoices: retained for 5 years from the end of the tax year in which the transaction occurred, as required by Polish tax law (Ordynacja podatkowa, Art. 70) and accounting law (Ustawa o rachunkowości).

Usage logs and technical data: retained for up to 12 months for security monitoring, fraud detection, and service improvement. Aggregated, anonymised analytics may be retained indefinitely.

Support communications: retained for 3 years from the date of resolution, to assist with follow-up issues and quality improvement.

Consent records: retained for the duration of your account plus 3 years, as evidence of consent for compliance purposes.

When data is no longer required, it is securely deleted using industry-standard methods or anonymised such that you can no longer be identified.

As a data subject under GDPR, you have the following rights:

Right of access (Art. 15): Request a copy of all personal data we hold about you, including information on processing purposes, recipients, and retention periods.

Right to rectification (Art. 16): Request correction of any inaccurate or incomplete personal data.

Right to erasure / right to be forgotten (Art. 17): Request deletion of your personal data where: it is no longer needed for its original purpose; you withdraw consent (where consent was the legal basis); you object to processing based on legitimate interests and we have no overriding grounds; or the processing is unlawful.

Right to restriction of processing (Art. 18): Request that we temporarily limit how we use your data while a dispute about accuracy or lawfulness is resolved.

Right to data portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format (JSON or CSV) and transmit it to another controller. This right applies to data processed on the basis of contract or consent.

Right to object (Art. 21): Object at any time to processing based on our legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests. You have an absolute right to object to direct marketing.

Right to withdraw consent (Art. 7(3)): Where processing is based on your consent, withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

No automated decision-making: We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects (Art. 22 GDPR).

How to exercise your rights: Email [email protected] with the subject line "GDPR Rights Request". We will verify your identity and respond within 30 days (extendable to 60 days for complex requests with notice). All requests are free of charge. We may need to retain certain data despite an erasure request where we have a legal obligation to do so.

We engage the following trusted sub-processors who process personal data on our behalf. All are bound by written data processing agreements:

Stripe, Inc. (USA) — payment processing. Processes billing information, payment card data, and fraud detection signals. PCI DSS Level 1 certified. Transfers to the US are governed by Standard Contractual Clauses (SCC) per EU Commission Decision 2021/914 and Stripe's EU-US Data Privacy Framework certification. Stripe's privacy policy: stripe.com/privacy. Stripe's DPA: stripe.com/legal/dpa.

Auth.js (NextAuth) v5 — open-source identity and authentication. Processes account credentials (email, hashed password), session tokens, and authentication events. The Auth.js library is self-hosted on our infrastructure (EU/EEA); we delegate sign-in to OAuth providers (Google, Apple, Microsoft Entra ID, Facebook, LinkedIn, X/Twitter) — only the providers enabled in the deployment are used. Auth.js documentation: authjs.dev.

Cloud hosting provider (EU/EEA) — application servers, databases, and file storage. All primary data is hosted within the EU/EEA. Processes all categories of personal data stored in the Service.

An up-to-date list of all sub-processors is available at budibuilder.com/subprocessors. We will notify Subscribers at least 14 days in advance of adding or replacing a sub-processor. Subscribers who object to a sub-processor change may terminate their subscription within that notice period with a pro-rata refund.

We do not sell your personal data to third parties.

Some of our sub-processors (Stripe, Cloudflare, the OAuth identity providers we delegate to) are based in the United States, which is outside the European Economic Area (EEA). Personal data transferred to these processors is protected by the following safeguards:

Standard Contractual Clauses (SCCs): We rely on the SCCs approved by the European Commission under Implementing Decision (EU) 2021/914. These clauses create enforceable data protection obligations on the recipient.

EU-US Data Privacy Framework (DPF): Where applicable, we use processors certified under the DPF, which was recognised as providing adequate protection by the European Commission in its adequacy decision of 10 July 2023.

Your rights: You may obtain further details about the specific safeguards applied to transfers by contacting [email protected]. You have the right to request a copy of the applicable SCCs.

All data stored in our primary database and application infrastructure is hosted within the EU/EEA and is not subject to international transfer.

We use cookies and similar technologies in accordance with the Polish Act on Electronic Communications (Prawo komunikacji elektronicznej, PKE, Dz.U. 2024 poz. 1221, Arts. 399-400) and GDPR.

Strictly necessary cookies (no consent required):
These are essential for the Service to function and cannot be disabled. They include: authentication/session cookies required by Auth.js (NextAuth), security cookies (including CSRF protection), and our cookie-consent state cookies.

Current cookie model:
At this time, BudiBuilder does not enable optional analytics, marketing, social, or personalization cookies through the consent panel. Optional categories are disabled by default and not actively used.

Your cookie choices:
• You can review the current cookie model at budibuilder.com/cookies.
• You can reset your consent state from cookie settings in the app.
• You can also manage cookies through your browser settings, though this may affect Service functionality.

Cookie retention: session cookies are deleted when you close your browser. Consent-state cookies are retained for up to one year.

We do not use advertising or cross-site tracking cookies to serve targeted advertising.

BudiBuilder is a professional business tool intended for use by adults (18+) operating as contractors or service providers. We do not knowingly collect personal data from individuals under the age of 18.

Age of consent for digital services: Under Polish implementation of GDPR Article 8, the minimum age for providing consent for information society services is 16 years. Our Service is not directed at individuals under 18.

If we become aware that we have collected personal data from someone under 18 without appropriate consent, we will delete that data promptly. Please contact [email protected] if you believe we may have inadvertently collected data from a minor.

Regarding your clients' data: As a contractor, you may store project records for minor clients (under 16). You, as the data controller, are responsible for ensuring you have obtained appropriate parental or guardian consent in accordance with applicable law. Our Terms of Service and DPA require you to ensure a lawful basis for all data you input into the Service.

We do not carry out automated decision-making, including profiling, that produces legal effects or similarly significantly affects you, within the meaning of Article 22 GDPR.

We use automated systems for: fraud detection (to identify unusual account activity that may indicate unauthorised use or payment fraud) and spam filtering (to block malicious content). These systems flag cases for human review and do not make final binding decisions without human involvement.

Any analytics or usage analysis we perform is used only to improve the Service in aggregate and does not result in individual decisions affecting your rights or access to the Service.

You have the right to lodge a complaint with the competent data protection supervisory authority if you believe we have processed your personal data in breach of GDPR.

The competent supervisory authority for Poland is:

Prezes Urzędu Ochrony Danych Osobowych (UODO)
President of the Office for Personal Data Protection
ul. Stawki 2, 00-193 Warszawa, Poland
Website: uodo.gov.pl
Telephone: +48 22 531 03 00
Email: [email protected]

You may also lodge a complaint with the supervisory authority in the EU member state of your habitual residence or place of work. A directory of EU supervisory authorities is available at edpb.europa.eu.

We would appreciate the opportunity to address your concerns before you contact UODO. Please reach out to us first at [email protected].

For all privacy-related enquiries, rights requests, or concerns:

Kamil Zwarycz, conducting business under the name LogicLoom Kamil Zwarycz
Kalinowa 6L lok. 3, 81-198 Kosakowo, Poland
NIP: 5871749235 | REGON: 540001576
Email: [email protected]

We will acknowledge your enquiry within 3 business days and provide a full response within 30 days (extendable to 60 days for complex requests, with prior notification).

This Privacy Policy was last updated on 26 March 2026. We will notify you of material changes by email and/or a prominent notice in the Service at least 30 days before the changes take effect. The current version is always available at budibuilder.com/privacy.