1. Who is responsible for your data
Your data is handled by WebStars (Warsaw, Poland) — you can contact us at contact@websiteoptimizer.pl.
2. Scope of processed data
- Account data: e-mail address; password stored in hashed form.
- Billing data: purchase information; payments handled by Stripe — full card data is not stored.
- Configuration data: Webflow API token, website identifiers.
- Content data: images and metadata (file names, ALT texts) processed to provide the Service.
- Technical data: IP address, browser/device type, logs, analytics data, interface preferences.
3. Purposes and legal bases (Art. 6 GDPR)
| Purpose | Legal basis |
|---|---|
| Maintaining the Account and providing the Service | Art. 6(1)(b) (contract) |
| Handling payments and billing | Art. 6(1)(b) and (c) (legal obligation) |
| Handling complaints | Art. 6(1)(b) and (c) |
| Security, logs, abuse prevention | Art. 6(1)(f) (legitimate interest) |
| Statistics and analytics (Google Tag Manager) | Art. 6(1)(a) (consent) |
| Establishing or defending claims | Art. 6(1)(f) |
Providing account data and data necessary to deliver the Service is voluntary but required to use the Service.
4. Data recipients and processors
- Vercel Inc. — Application hosting.
- Supabase — database and authentication. Hosting region: European Union (EEA).
- Stripe — payment processing.
- Google — AI ALT text generation (e.g. Google Gemini; images from the website may be transmitted) and analytics (Google Tag Manager).
- Webflow, Inc. — the User's website platform, accessed via the API token.
- E-mail provider — sending transactional messages.
5. Transfers outside the EEA
The Application's database (Supabase) is hosted within the EEA. Some other providers (e.g. Vercel, Stripe, Google, Webflow) may process data outside the EEA, including in the USA. In such cases transfers rely on appropriate safeguards, in particular Standard Contractual Clauses (SCC).
6. Data retention periods
- Account data — for the duration of the Account, and after deletion until claims become time-barred.
- Billing data — for the period required by tax and accounting regulations.
- Data processed based on consent (e.g. analytics) — until consent is withdrawn.
- API tokens and keys — until removed by the User or until the Account is deleted.
7. Rights of data subjects
You have the right to: access, rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent at any time. Contact: contact@websiteoptimizer.pl. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland.
8. Cookies and similar technologies
- Necessary — maintaining the login session and remembering the interface language.
- Functional — remembering preferences (theme, content language).
- Analytics — Google Tag Manager and Google tools; used based on consent.
Cookie settings can be managed in the browser. Restricting necessary cookies may hinder use of the Service.
9. Data security
We apply measures appropriate to the risk, including transmission encryption (HTTPS), password hashing and restricted data access. We recommend granting API tokens the minimum necessary permissions.
10. Automated processing and profiling
We do not make decisions based solely on automated processing that would produce legal effects or similarly significantly affect the User. AI features concern website content, not profiling of individuals.
11. Data of minors
The Service is intended for adults or persons acting with the consent of a legal guardian. We do not knowingly collect data of children below the age required by law.
12. Changes to the Privacy Policy
The Policy may be updated. We will inform about significant changes in the Service or by e-mail. The current version is always available on the Service.
13. Contact
For matters concerning personal data and privacy: contact@websiteoptimizer.pl.