Privacy policy

Data controller

The controller of personal data processed by legalizacja.app is Clean Whale Sp. z o.o., ul. Opaczewska 42, 02-372 Warszawa, Poland. Contact: ivan.shyla@cleanwhale.pl.

What data we process

Account: e-mail address (magic-link sign-in). Situation and case: citizenship, voivodeship, residence status, answers and case stages — provided voluntarily to tailor your checklist. Chat: the content of conversations with the assistant. We do not store document files on our disk or in our database. For content review, the file is sent once to the Anthropic API; we retain only its name, type, size and the check result. Under Anthropic’s standard API terms, inputs and outputs are deleted from its systems within 30 days, subject to safety, legal or separately agreed exceptions. We also store account-linked technical service events (for example an assistant response, token counts, path selection, document generation, checkout start and optional response feedback), without chat or document contents. Timeline-map reports are anonymous and are not linked to the account. Google Analytics 4 loads only after cookie-banner consent. Technical data includes an essential session cookie (kp_uid) and server logs (IP address) for abuse protection. We use no marketing cookies.

The public case feed shows only the voivodeship, case type, stage months and outcome — without a person or case identifier, exact days, tokens or technical data.

Google Timeline travel import runs entirely in the browser. The location-history.json file and its coordinates are not sent to our server or linked to an account or analytics. Derived dates and entered countries remain in this tab’s session storage until the tab closes or you press Clear.

Purposes and legal bases

Providing the service (checklists, chat, reminders) — Art. 6(1)(b) GDPR (contract). Case e-mail notifications — Art. 6(1)(b); you can disable them in account settings. Security and anti-abuse limits — Art. 6(1)(f) (legitimate interest). Anonymous map statistics — the data does not identify a person.

Recipients (processors)

Amazon Web Services (hosting in the USA — us-east-1; SES e-mail — eu-central-1, Frankfurt), Anthropic PBC (processing chat content and one-time analysis of uploaded documents to provide the AI service) and Google (Analytics — audience statistics, only with your consent). Transfers outside the EEA rely on Standard Contractual Clauses / the EU-US Data Privacy Framework. We do not sell data or share it for marketing.

Retention

Account and case data — until account deletion or an erasure request. Anonymous map reports — indefinitely (they identify no one). Technical logs — up to 90 days.

Your rights

You have the right to access, rectify, erase, restrict, port your data and to object. Write to ivan.shyla@cleanwhale.pl — we reply within 30 days. You may also lodge a complaint with the Polish DPA (UODO, uodo.gov.pl). The AI chat is informational — we make no automated decisions with legal effects.