Privacy policy

Data controller

The controller of personal data processed by cleobot.net (the "Service") is Patryk Grodoń, ul. Wyszyńskiego 73/11, Wodzisław Śląski, Poland, tax ID (NIP): 6472604949 (the "Controller").

Contact for all personal data matters: support@cleobot.net.

What data we collect

We collect only the data necessary to run the Service and provide CleoBot:

• Account data — e-mail address and password. The password is stored exclusively as a cryptographic hash; the Controller does not know and cannot read your password.
• Purchase data — the selected package, amount, transaction status and identifier, and the dates it was created and paid. We do not process card numbers or bank account details — you provide those directly to the payment operator.
• License data — the validity period of the license linked to your account.
• Technical data — IP address and basic server logs (date and type of request), used solely for security purposes such as rate limiting.
• Message content handled by the in-app auto-reply feature — passed to OpenAI solely to generate a reply; it is not stored in our database.

Purposes and legal bases of processing

We process data for the following purposes:

• creating and operating your account, handling purchases and licenses — art. 6(1)(b) GDPR (performance of a contract),
• keeping accounting and tax records — art. 6(1)(c) GDPR (legal obligation),
• keeping the Service secure, preventing abuse, and establishing or pursuing claims — art. 6(1)(f) GDPR (legitimate interest),
• traffic analytics (Google Analytics) — art. 6(1)(a) GDPR (consent), only if you grant it in the cookie settings.

Data recipients

We use providers that process data on our behalf or as independent controllers:

• Supabase — database and authentication,
• OVHcloud — server infrastructure,
• Cloudflare — traffic protection and abuse prevention using Turnstile (technical browser and device signals),
• CashBill S.A. — payment operator (BLIK, instant bank transfers); for payment data it acts as an independent controller under its own privacy policy,
• Stripe (Stripe Payments Europe, Ltd.) — card payment operator; for payment data it acts as an independent controller under its own privacy policy,
• OpenAI — generating in-app auto-replies,
• Resend — sending transactional e-mail (e.g. purchase confirmations),
• Google — traffic analytics (Google Analytics), only after consent.

Transfers outside the EEA

Some providers (including Google, Cloudflare, OpenAI, Stripe and Resend) may process data on servers in the United States. Transfers rely on the European Commission's adequacy decision (EU-U.S. Data Privacy Framework) or standard contractual clauses (SCC).

How long we keep data

• account data — until the account is deleted,
• transaction records — for 5 years from the end of the tax year of the transaction (legal obligation),
• technical logs — up to 90 days,
• cookies — as described in the "Cookies" section and per your browser settings.

Your rights

Regarding your personal data, you have the right to:

• access your data and obtain a copy,
• rectify your data,
• erase your data,
• restrict processing,
• data portability,
• object to processing based on legitimate interest,
• withdraw consent at any time — without affecting the lawfulness of processing carried out before withdrawal.

To exercise these rights, write to support@cleobot.net. You may also lodge a complaint with the President of the Polish Personal Data Protection Office (uodo.gov.pl).

Cookies

The Service uses two kinds of cookies:

• Essential — maintain your login session and remember the selected language. They are required for the Service to work and do not require consent.
• Analytics (Google Analytics) — measure traffic in the Service. They are set only after you grant consent.

You can change your choice at any time through the "Cookie settings" link in the footer, or delete or block cookies in your browser settings. Blocking essential cookies may make signing in impossible.

Data security

Data in transit is encrypted (HTTPS/TLS). Passwords are stored only as cryptographic hashes, access to data is technically limited to what is necessary, and the infrastructure is kept up to date.

Changes to this policy

This policy may be updated, for example when new Service features launch. The current version is always available at cleobot.net/en/privacy-policy together with its effective date.