§ 1. Controller and contact
1. The controller of the personal data processed in connection with the use of the arkeeno website (the “Service”) is Arkeeno sp. z o.o. with its registered office at ul. Papieża Jana Pawła II 26-1, 18-300 Zambrów, Poland, NIP 7231646361, REGON 545477898, KRS 0001259222 (the “Controller” or “we”).
2. For all matters concerning personal data, you can contact us at rodo@arkeeno.com lub privacy@arkeeno.com.
3. The Controller has not appointed a Data Protection Officer. Contact on data matters is through the addresses given in paragraph 2.
§ 2. The Controller’s two roles
1. For the data of Users (including Designers) collected to provide the services, arkeeno acts as the controller of that data.
2. For personal data that a Designer enters into the Service about their own clients and contractors (for example, data of the Designer’s Clients), arkeeno acts as a processor, and the controller of that data is the Designer. The rules for this processing are set out in the data processing agreement (see § 11).
§ 3. Purposes, legal bases and categories of data
We process Users’ personal data for the following purposes and on the following legal bases:
Creating and maintaining an Account, providing the services: first name, surname, email address, login data, Account data. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
Handling payments and issuing invoices: billing data, invoice data. Legal basis: Art. 6(1)(b) and (c) GDPR (legal obligation).
Contact and support: content of correspondence, email address. Legal basis: Art. 6(1)(b) and (f) GDPR (legitimate interest).
Analytics and development of the Service: usage data, technical identifiers. Legal basis: Art. 6(1)(f) GDPR (for cookies: consent).
Security and error diagnostics: technical logs, device data. Legal basis: Art. 6(1)(f) GDPR (legitimate interest).
Establishing, pursuing and defending legal claims: data necessary to establish claims. Legal basis: Art. 6(1)(f) GDPR (legitimate interest).
AI features (at the User’s request): content submitted to AI features (photos, notes). Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
Providing data is voluntary, but it is necessary to conclude and perform the contract: without it, it is not possible to create an Account or use features that require registration.
§ 4. Designer’s Clients (Guests)
1. A Designer’s Client can use shared materials without creating an Account. In that case we may process the minimum data necessary to share the materials and collect comments.
2. If a Designer’s Client decides to create an Account, they provide their first name, surname, email address and, optionally, a phone number.
3. We process the data of the Designer’s Clients entered by the Designer as a processor, on behalf of and on the instructions of the Designer.
§ 5. Features based on artificial intelligence
1. The Service provides AI features in which, at the User’s request, the content submitted is processed, in particular photos uploaded by the User and notes on sales opportunities.
2. This content is passed to the AI model providers listed in § 7 solely to perform the requested feature.
3. In accordance with the terms of use of these providers’ application programming interfaces (APIs), the content submitted is not used to train their models.
4. The User should not submit to AI features special categories of data (for example, health data) or data to which the User does not have the appropriate rights.
§ 6. Recipients of data
Data may be disclosed to entities that process it on our behalf (processors), to the extent necessary to provide the services, and to entities authorised under the law. The main providers are listed in the table in § 7.
§ 7. Service providers (processors)
We use the following providers. Some of them process data outside the European Economic Area (EEA). In such cases the transfer is based on standard contractual clauses (SCCs) approved by the European Commission:
Supabase: database, authentication, file storage. Location: European Union (EEA).
PostHog: analytics of the use of the Service. Location: European Union (EEA).
Vercel: application hosting. Location: European Union (EEA). Transfer basis: SCCs.
Resend: sending email messages. Location: European Union (EEA). Transfer basis: SCCs.
Sentry: error monitoring. Location: European Union (EEA). Transfer basis: SCCs.
Twilio: communication (SMS / notifications). Location: USA. Transfer basis: SCCs.
Google (Gemini): AI features. Location: USA / global. Transfer basis: SCCs.
OpenAI: AI features. Location: USA. Transfer basis: SCCs.
Stripe: handling of payments and subscriptions. Location: Ireland (EEA) / USA. Transfer basis: SCCs.
Note: the list of providers may change as the Service develops. The current list is available on request at rodo@arkeeno.com.
§ 8. Transfers of data outside the EEA
1. As a rule, data is processed within the EEA (including Supabase and PostHog in the EU region).
2. Some providers (listed in § 7) process data in third countries, in particular in the USA. In such cases we apply standard contractual clauses (SCCs) and, where necessary, additional security measures to ensure an adequate level of data protection.
3. You can obtain a copy of the safeguards applied by contacting us at privacy@arkeeno.com.
§ 9. Data retention period
1. We keep Account data for the duration of the contract and for the period necessary after it ends (for example, to handle possible claims).
2. We keep billing data and invoices for 5 years, counted from the end of the year in which the tax payment deadline expired, in accordance with tax regulations.
3. We keep data processed on the basis of consent until the consent is withdrawn.
4. We keep data processed on the basis of legitimate interest until an objection is effectively lodged or the purpose of the processing ceases.
5. Content submitted to AI features is not stored by us permanently beyond what is necessary for the feature and the Service to operate.
§ 10. Rights of the data subject
1. You have the right to:
a) access your data and obtain a copy of it;
b) rectification of your data;
c) erasure of your data (“the right to be forgotten”);
d) restriction of processing;
e) data portability;
f) object to processing based on legitimate interest;
g) withdraw consent at any time (without affecting the lawfulness of processing carried out before its withdrawal).
2. You exercise these rights by contacting us at rodo@arkeeno.com.
3. If the data concerns you as a Designer’s Client and was entered by the Designer, direct your requests first to the Designer as the controller of that data; we will help to pass the request on.
4. You have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) (ul. Stawki 2, 00-193 Warsaw, Poland).
§ 11. Data processing agreement
1. To the extent that a Designer enters into the Service personal data of third parties (for example, their clients), arkeeno processes this data as a processor, solely to provide the services and in accordance with the Designer’s instructions.
2. The detailed rules of the processing (including its scope, duration, security measures and the use of sub-processors) are set out in the data processing agreement, which we make available to the Designer and which forms an integral part of the agreement for the provision of services.
§ 12. Cookies and analytics
1. The Service uses cookies and similar technologies. We use cookies that are necessary for the Service to operate on the basis of our legitimate interest.
2. We use analytics cookies (including PostHog) on the basis of your consent given through the consent mechanism (the cookie banner). You can change or withdraw your consent at any time.
3. You can also change your cookie settings in your browser. Restricting cookies may affect the operation of some features of the Service.
§ 13. Data security
1. We apply technical and organisational measures appropriate to the risk, including encryption in transit, access control and regular backups.
2. Only authorised persons and trusted providers have access to the data, to the extent necessary to provide the services.
§ 14. Changes to the Privacy Policy
1. We may update the Privacy Policy, in particular where the law, the scope of the services or the providers change.
2. We will inform Users who have an Account of material changes by email or in the Service.
3. This Policy applies from 23 August 2026.