Privacy Policy

§ 1. Data controller

The controller of Users' personal data is:

§ 2. Purposes and legal bases for processing

Users' personal data is processed for the following purposes:

• Providing the services (Art. 6(1)(b) GDPR) – creating and maintaining the User Account, managing the diet profile, generating meal plans, and storing plan history.
• Processing payments and subscriptions (Art. 6(1)(b) and (c) GDPR) – processing recurring payments via PayU S.A. and issuing accounting documents.
• Handling complaints (Art. 6(1)(c) GDPR) – fulfilling the legal obligations related to processing complaints.
• Legitimate interest (Art. 6(1)(f) GDPR) – application security (Cloudflare Turnstile), pursuing claims, and maintaining statistics.
• Marketing attribution (Art. 6(1)(f) GDPR) – determining the source (e.g. a Google/Meta ad, search engine, or referring site) through which the User reached us, in order to measure advertising campaign effectiveness and optimize customer acquisition costs.

§ 3. Categories of data processed

Depending on the scope of the User's use of the application, the Controller may process:

• Identification and contact data: email address, first and last name (from the PayU form or, with consent, from Google/Facebook/GitHub).
• Profile data and preferences: calorie target, diet style, exclusions, allergens, culinary preferences, fridge contents.
• System data: IP address, browser type, session tokens, PWA permission information.
• Sign-up attribution data (first visit): the landing page along with query parameters (e.g. UTM tags, ad click identifiers), the referring page, browser and device type (user agent), and approximate location (country/city determined from the IP address, without storing the IP address itself) – recorded once on the first visit to the site and linked to the account at the time of registration, visible only in the admin panel for analytical purposes.

§ 4. Data recipients and data transfers

1. Users' personal data may be shared with trusted processors to ensure the proper functioning of the application:

• Supabase Inc. – operator of the PostgreSQL database and authentication module (GDPR compliant, data encryption).
• PayU S.A. – online payment operator, transaction authorization, and subscription management.
• Vercel Inc. – hosting provider for the Swaplate application.
• Cloudflare Inc. – operator of the Turnstile CAPTCHA system protecting the forms.

2. AI integration (Google Gemini API): Requests to the API contain only technical and dietary information (e.g. "keto diet, gluten-free, 2000 kcal"). No personal data allowing user identification is shared with Google.

§ 5. User rights (including Meta/Facebook requirements)

1. Every User has the following rights under the GDPR:

• The right to access their data and receive a copy of it.
• The right to rectify (correct) their data.
• The right to erasure ("the right to be forgotten").
• The right to restrict processing.
• The right to data portability.
• The right to object to processing.
• The right to lodge a complaint with the UODO (President of the Personal Data Protection Office).

2. Data deletion procedure (Meta/Facebook Data Deletion): Users registered via Facebook OAuth can delete their data at any time. Instructions and an automatic deletion form are available at swaplate.pl/data-deletion. Deleting a profile results in the permanent removal of meal plan history and preferences.

§ 6. Data retention period

1. Data linked to a User Account is processed for the entire period the account is active – until a deletion request is submitted.
2. Transaction and accounting data (PayU payments) is retained for 5 years from the end of the calendar year in which the tax payment deadline occurred.

§ 7. Cookies and Local Storage

1. The swaplate.pl Service uses cookies and LocalStorage technology to ensure the interface functions properly.
2. The swaplate_attr cookie (necessary, valid for 90 days) stores, once, on the first visit, the marketing attribution data described in § 3 (landing page, referrer, UTM, user agent, approximate location) – used solely to link the registration with its traffic source.
3. LocalStorage stores information that is not personal data:
   • Theme preference (light/dark mode) – prevents screen flicker on load.
   • Shopping list state (/lista-zakupow) – preserves shopping progress after closing the browser.
4. Users can block or delete cookies and clear LocalStorage in their browser settings, which may affect certain PWA features.

§ 8. Data security

1. The Controller uses advanced technical and organizational measures to protect personal data.
2. The connection to the Service is fully encrypted with an SSL certificate (HTTPS).
3. Authorization is based on the Supabase system with the PKCE (Proof Key for Code Exchange) protocol, protecting login tokens against interception.

§ 9. Contact

Any questions, requests, and demands regarding the protection of personal data should be directed to dane@swaplate.pl or in writing to the Controller's correspondence address.