Last updated: September 2026.
The controller of personal data processed in connection with using Tortownik is Info M.D. Sp. z o.o., Tax ID (NIP) 8133772579, registered at ul. Dukielska 6/12, 35-505 Rzeszów (the "Controller").
You can reach the Controller by email at [email protected] or via the form on the contact page.
When you create an account, you provide your full name, email address, and password — stored only in hashed form, which the Controller cannot read. You can also sign in with a passkey, without a password.
If you choose to sign in with Google, we receive your name, email address, and profile picture from your Google account. We use this data solely to create and authenticate your Tortownik account — never for any other purpose. We do not request access to your Gmail, Drive, contacts, or any other Google data beyond basic sign-in information.
While using the app, you enter data about your own business: company name, organization settings, and — if you choose to enter them — your customers' data (name, phone, email, notes). For this data, you are the controller, and Tortownik's Controller acts as a processor that technically hosts and secures it on your behalf.
We also automatically collect technical data: IP address, device and browser information, and server logs, plus — if the app errors — diagnostic data sent to our error-monitoring tool.
If you write to us via the contact form, we process the name, email address, and message content you provide, solely to respond to you.
The app uses necessary cookies (e.g. to keep you signed in and remember your theme choice) — these run always, without asking for consent, because the app cannot work without them.
With your separate consent, given in the cookie banner, an analytics category may also be used. You can withdraw or change that consent at any time — in your account settings or in the homepage footer.
The analytics category uses Google Analytics and Google Tag Manager (Google Ireland Limited), which may involve transferring data to Google LLC in the USA under standard contractual clauses approved by the European Commission.
Providing the service and running your account — basis: performance of a contract (Art. 6(1)(b) GDPR).
Replying to messages sent via the contact form — basis: the Controller's legitimate interest in handling inquiries (Art. 6(1)(f) GDPR).
Detecting, diagnosing, and fixing technical errors in the app — basis: the Controller's legitimate interest in keeping the service working and secure (Art. 6(1)(f) GDPR).
Analyzing how the app is used, if you consent to analytics cookies — basis: consent (Art. 6(1)(a) GDPR).
Fulfilling legal obligations, e.g. tax and accounting — basis: legal obligation (Art. 6(1)(c) GDPR).
We do not sell your data, and we never use it for targeted advertising or to train generalized AI/ML models. Any data we receive from Google, in particular, is used exclusively as described in this policy and in accordance with the Google API Services User Data Policy, including its Limited Use requirements.
We share data only with service providers who process it on our behalf, under a data processing agreement, and only to the extent needed to run the app: our hosting provider (server infrastructure), Resend (transactional email delivery — verification, password reset, and notification emails), Sentry (error monitoring and diagnostics), and, if you consent to analytics cookies, Google Analytics and Google Tag Manager (see "Cookies" below).
We disclose data to public authorities only when required by law, e.g. tax or law-enforcement obligations.
We keep your account data for as long as your account remains active. Financial documents (e.g. invoices) are kept for the period required by tax law, currently 5 years from the end of the tax year in which they were issued, even after account deletion.
Technical logs and diagnostic data sent to our error-monitoring tool are kept only as long as needed to detect and fix issues, and are deleted automatically afterwards.
To request deletion of your account and personal data, contact us at [email protected] or via the form on the contact page. We will delete your data without undue delay, except where we must keep it longer to comply with a legal obligation (e.g. the tax retention period above).
The right to access your data and receive a copy of it.
The right to rectification (correction) of your data.
The right to erasure ("the right to be forgotten").
The right to restriction of processing.
The right to data portability.
The right to object to processing based on legitimate interest.
The right to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
The right to lodge a complaint with the Polish data protection authority (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl).
For matters relating to personal data protection, you can reach us at [email protected] or via the form on the contact page.
Go to the contact form →