Privacy Policy

Last updated: [Date]

This is a draft prepared for review, not legal advice. Every value in [brackets] must be filled in and the whole text checked by the site owner (and, ideally, a lawyer) before this page governs a real sale.

1. Controller

Ireneusz Winnik, [Registered address], Tax ID (NIP): [Tax ID (NIP)], is the data controller for the personal data described below. Contact: [Contact email].

2. Data we process

• Account data: your email address, an optional display name, and a salted hash of your password. We never store your password in plain text.
• Task data: if you use BranchFirst only in your browser, your tasks never leave your device and we never receive them. If you activate BranchFirst Sync, your task document (the tree of projects and tasks you create) is stored on our server so it can be shared across your devices and the terminal app.
• Terminal tokens: a signed token used to authenticate the BranchFirst terminal application to your account, tied to your account and revocable at any time.
• Payment data: we do not store your card details. Payments are processed by Stripe, which collects and processes billing information directly, as described below.
• Sync waitlist: while BranchFirst Sync is not yet open for purchase, if you ask to be notified we store the email address and plan (monthly or yearly) you chose. We use this only to tell you when Sync opens.

3. Purposes and legal bases

• Providing the account and Sync service you request — performance of a contract.
• Processing subscription payments and preventing fraud — performance of a contract and legitimate interest.
• Securing the service (e.g. detecting abuse) — legitimate interest.
• Notifying you when BranchFirst Sync opens, if you asked to join the waitlist — consent.

4. Processors

• Stripe — processes payments and acts as merchant of record for BranchFirst Sync subscriptions (billing, invoicing, VAT/sales tax, and related customer support for payment transactions).
• [Hosting provider] — hosts the application and database that store account and, for Sync users, task data.
• Resend — delivers the email that notifies us when someone joins the BranchFirst Sync waitlist.

5. Cookies

We use a single session cookie to keep you signed in. We do not currently use analytics, advertising, or tracking cookies.

6. Retention

We keep account data for as long as your account exists. If your BranchFirst Sync plan ends, we do not delete your task data: the last synced copy remains available to you as a read-only download. Sync waitlist entries (email and chosen plan) are kept until Sync opens or until you ask us to delete them, whichever comes first. You can request deletion of your account and associated data, including a waitlist entry, at any time by contacting us.

7. Your rights

Under the GDPR, you have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. To exercise any of these rights, contact us at [Contact email]. You also have the right to lodge a complaint with the Polish data protection authority, the Urząd Ochrony Danych Osobowych (UODO), or with the supervisory authority in your own EU country of residence.

8. Contact

Questions about this policy: [Contact email]. See also our Terms of Service and refund policy.