Privacy Policy

Version 2.0 · Effective: 27 April 2026

This Privacy Policy fulfills the information obligation under Article 13 GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016). It describes what data AlleProfit collects, for what purpose, on what legal basis, and what rights you have. The Polish version (privacy.html) is the legally authoritative one; this English translation is provided for convenience.

1. Data Controller

The controller of your personal data is:

insertNow Kamil Tyszkiewicz
Tax ID (NIP): 9223073555
Contact: [email protected]

We have not appointed a Data Protection Officer - please send all data-related matters to the email address above.

2. Data we process

Account data: email address, password (stored as a bcrypt hash), registration date
Social-login data: for Google sign-in - email and Google ID; for Allegro sign-in - Allegro login and user identifier
Allegro OAuth tokens - encrypted with Fernet, used solely to fetch orders via the Allegro API
Business data from Allegro: order numbers, dates, amounts, fees, product data, shipping data - fetched automatically via the Allegro API
Product own-costs - entered manually or imported by you from files / photos
Technical data: IP address, session identifier, browser information, error logs (up to 90 days)
Billing data: when you purchase a paid plan - processed by Stripe (card data does NOT reach our servers; we only receive the customer ID and subscription status)

3. Purposes of processing

Providing the AlleProfit service - Allegro sales profitability analysis
User authentication and authorization
Synchronising orders and fees from the Allegro API
Processing payments and managing subscriptions
Sending transactional notifications (password reset, alerts, summaries) - only those necessary for the service to function
Service security - abuse detection, bot protection, error logging
Compliance with legal obligations (accounting, invoice retention)
Marketing of our own services - sending e-mails with offers, product news and surveys, only after your separate, voluntary consent (which you can withdraw at any time in account settings without affecting your use of the service)

The guide and e-mails from AlleProfit

If you leave your e-mail address in the form on the home page or in the Poradnik (guides) section and click "Send me the guide", we send you a PDF guide, 7 e-mails with facts about Allegro fees (one per business day) and later news and offers from AlleProfit. Clicking the button under which you see this information is your consent to these messages. The legal basis is your consent (Article 6(1)(a) GDPR) and, for commercial information, also Article 398 of the Polish Electronic Communications Law. We process your e-mail address, the date and version of the consent text and an irreversible hash of your IP address (as proof of consent). You can unsubscribe at any time with the "unsubscribe" link in every message. We then stop sending, keep the address, the date of unsubscribing and the proof of consent for 12 more months and then delete them. Signing up does not create an account in the service.

4. Legal bases of processing

Art. 6(1)(b) GDPR - performance of the service contract (account data, business data, Allegro tokens, own-costs)
Art. 6(1)(c) GDPR - compliance with legal obligations (accounting, VAT invoices)
Art. 6(1)(f) GDPR - legitimate interest of the controller (service security, error logs, abuse protection)
Art. 6(1)(a) GDPR - your consent (when signing in via Google/Allegro OAuth, when activating service before the 14-day right of withdrawal expires, and for sending marketing information and surveys by e-mail)

5. Data recipients - data processors

To operate, AlleProfit relies on trusted suppliers (processors under Art. 28 GDPR). They process your data solely on our instructions and to provide services to us:

Processor	Purpose	Location
netcup GmbH	Server hosting, database	Germany (EEA)
Cloudflare, Inc.	CDN, DDoS protection, SSL	USA (with SCCs)
Stripe, Inc.	Payments and subscriptions	USA / Ireland (with SCCs)
Resend, Inc.	Transactional email delivery	USA (with SCCs)
Google LLC	OAuth (Google sign-in), Gemini AI (cost-document scanning)	USA (with SCCs)
OpenAI, L.L.C.	Cost-document scanning (fallback)	USA (with SCCs)
Anthropic, PBC	AI tools supporting diagnostics and maintenance of the Service	USA (with SCCs)
Allegro.pl sp. z o.o.	API integration with your seller account	Poland (EEA)
National Bank of Poland (NBP)	Currency exchange rates (anonymous queries, no personal data)	Poland (EEA)
Meta Platforms Ireland Ltd.	Meta Pixel - measuring ad performance and remarketing. Loaded only after you consent to marketing cookies	Ireland (EEA), with transfer to the USA

For data collected by the Meta Pixel we act together with Meta Platforms Ireland Ltd. as joint controllers (Art. 26 GDPR) rather than as controller and processor. We are responsible for obtaining your consent and transmitting the data, while Meta's further processing follows its own terms. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the Cookie Policy.

Data may be disclosed to public authorities solely on the basis of applicable laws (e.g. court order, prosecutor's office, tax authorities).

6. Transfers outside the European Economic Area

Some of our processors are based in the USA (Cloudflare, Stripe, Resend, Google, OpenAI, Anthropic). Transfers occur on the basis of:

Standard Contractual Clauses (SCCs) approved by Commission Decision 2021/914 - with processors with whom we have signed appropriate data-processing agreements
Commission Decision 2023/1795 on the adequate level of protection of personal data under the EU-US Data Privacy Framework - for processors certified under this programme

Cost-document scanning by AI models (Google Gemini, OpenAI) takes place without transferring personal data - only invoice / pricelist images are uploaded (containing product data, not personal data).

For technical diagnostics and maintenance of the Service we may use AI tools (Anthropic). In such cases we share only the information necessary to analyse the issue (e.g. error logs, technical metadata), keeping personal data to a minimum.

You can request a copy of the safeguards we use - send a request to [email protected].

7. Data retention period

Account and settings data - for the duration of the contract and until you delete the account
Business data (orders, fees, costs) - by default 6 months back; for the full duration of account activity
Error and security logs - up to 90 days
Billing data (VAT invoices, accounting documents) - for the period required by tax law (5 years from the end of the accounting year)
Allegro OAuth tokens - until the account is disconnected or the tokens expire

After contract termination, your data is deleted or anonymised, except for data subject to mandatory retention under the law (e.g. invoices).

8. Your rights

In connection with processing your personal data, you have the following rights:

Right of access to your data (Art. 15 GDPR)
Right to rectification of inaccurate or incomplete data (Art. 16 GDPR)
Right to erasure ("right to be forgotten") - Art. 17 GDPR
Right to restriction of processing (Art. 18 GDPR)
Right to data portability in a structured format (Art. 20 GDPR)
Right to object to processing based on legitimate interest (Art. 21 GDPR)
Right to withdraw consent at any time - without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3) GDPR)

To exercise these rights, write to: [email protected]. We will respond within 30 days.

Right to lodge a complaint

You have the right to lodge a complaint with the supervisory authority - the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) - if you consider that processing of your data violates GDPR.

9. Automated decisions and profiling

We do not make automated decisions about you within the meaning of Art. 22 GDPR, that is decisions producing legal effects or similarly significantly affecting you. AlleProfit's algorithms (e.g. matching costs to products, profitability analysis) only present your own data.

If you consent to marketing cookies, Meta may profile you in order to select which ads you see (remarketing). This profiling produces no legal effects for you, affects only the ads shown, and you can switch it off at any time by withdrawing consent in the Cookie Policy.

10. Voluntary nature of data provision

Providing personal data is voluntary, but necessary for the service:

Without an email and password (or Google/Allegro account) - you cannot create an account
Without connecting an Allegro account - you cannot use the main feature of the service (order analysis)
Without payment data - you cannot purchase a paid plan (but you can use the free Starter plan)

11. Cookies and browser storage

We use cookies and browser storage strictly necessary for the operation and security of the service. Details are described in the Cookie Policy.

We use marketing cookies only with your consent. The only ad network we integrate with is Meta (Facebook, Instagram) through the Meta Pixel. Until you consent we set no marketing cookies, and you can withdraw consent at any time.

12. Security

Allegro OAuth tokens - encrypted with Fernet (AES-128)
User passwords - hashed with bcrypt (with salt)
All connections - encrypted with SSL/TLS (HTTPS)
Database access - restricted to the administrator and authorised representative
Backups - performed regularly and encrypted at rest

13. Changes to the Privacy Policy

We may update this Policy. We will inform you of material changes 14 days in advance via the email address linked to the account. The current version is always available at alleprofit.com/privacy.html.

14. Contact

For matters concerning personal data protection:
insertNow Kamil Tyszkiewicz
Email: [email protected]