Privacy
Policy.

This Privacy Policy sets out the rules for the processing and protection of the personal data of Users of the KalkMate.pl service (hereinafter: the “Service”), operated by KalkMate (hereinafter: the “Controller”).

The controller of the personal data collected via the Service is:

• e-mail: kontakt@kalkmate.pl,
• phone: +48 600 580 888,
• the contact form available on the website.

In operating the Service, we collect the following categories of personal data:

3.1. Data provided by the user

• first and last name,
• e-mail address,
• phone number,
• address of the InPost pickup point (Paczkomat parcel locker).

3.2. Data collected automatically

• IP address,
• browser type and version,
• operating system,
• data on activity in the Service (pages visited, duration of the visit),
• technical information about the device.

3.3. Transaction data

• order history,
• payment data (processed by Stripe),
• information on the balance, purchases and activations of AI tokens (including activated license codes from the box),
• AI Chat conversation history.

3.4. AI assistant chat on the website

When you start a conversation in the chat window on the website (Terms of Service §8), we process:

• the e-mail address provided when starting the conversation,
• the content of your messages and the assistant’s replies, with date and time,
• the address of the subpage from which the message was sent, the page language and information about the browser (user-agent),
• only if you have consented to analytics cookies: the course of your visit to the website (subpages visited and sections viewed, with times) and a conversation identifier added to the Microsoft Clarity session recording — this lets us see what you were looking for and answer you better. Without this consent, the course of the visit is not collected.

The “I’m not a robot” confirmation performs a calculation in your browser — it does not use the services of external companies and does not store cookies. The content of messages is transmitted to the AI model provider (see section 6) solely for the purpose of generating a reply.

An overview of the purposes of processing and the corresponding legal bases under the GDPR.

We store personal data for the periods required by law or for the time necessary to achieve the purposes of processing:

• Transaction data and invoices: 5 years from the end of the calendar year in which the tax obligation arose.
• Contract data: for the term of the contract and for the period required by law (e.g. 6 years in connection with the limitation period for claims).
• Data related to AI tokens (balance, package purchases, activated codes): for as long as the account exists and for 3 years after its deletion.
• AI Chat history: for as long as the account exists (until the user deletes the conversation or the account) and for up to 30 days after the account is deleted.
• Marketing data (consent): until consent is withdrawn or an objection is raised.
• Analytics data: up to 25 months from the last activity.
• Website chat conversations (e-mail, content, course of the visit): 12 months from the last message in the conversation, after which they are deleted automatically; earlier — at your request.

Personal data may be disclosed to the following categories of recipients:

• Stripe – payment operator (processing of payment card transactions, including purchases of AI token packages).
• InPost – courier company (delivery of products to Paczkomat parcel lockers).
• Resend – e-mail service (sending transactional messages and magic links).
• Google AI (Gemini) – provider of the AI Chat service (processing of chatbot queries).
• OpenRouter, Inc. (USA) – intermediary providing access to AI models (including Google Gemini); receives the content of messages from the website chat and AI Chat in order to generate replies. We do not share your e-mail address with it.
• Microsoft Clarity – analytics tool (heatmaps, session recordings) used only after consent to analytics cookies has been given — see section 9.
• Hosting provider – storage of data on VPS servers.
• PostgreSQL database provider – storage of user data.
• Entities authorized by law – state authorities, courts (where required by law).

Some service providers (e.g. Stripe, Google AI, OpenRouter, Microsoft Clarity) may process data outside the European Economic Area (EEA). In such cases:

• We ensure appropriate safeguards in accordance with the GDPR (standard contractual clauses approved by the European Commission).
• Data are transferred only to countries ensuring an adequate level of data protection or to entities applying appropriate safeguards.

Under the GDPR, you have the following rights:

8.1. Access to data — Art. 15 GDPR

You have the right to obtain confirmation as to whether we process your personal data and, if so, to access them and receive a copy.

8.2. Rectification — Art. 16 GDPR

You have the right to request the prompt rectification of inaccurate data or the completion of incomplete data.

8.3. Erasure (“right to be forgotten”) — Art. 17 GDPR

In certain cases, you have the right to request the erasure of your personal data.

8.4. Restriction of processing — Art. 18 GDPR

In certain situations, you may request the restriction of the processing of your data.

8.5. Data portability — Art. 20 GDPR

You have the right to receive your data in a structured, commonly used and machine-readable format and to transmit them to another controller.

8.6. Objection — Art. 21 GDPR

You have the right to object to the processing of your data for marketing purposes or on the basis of a legitimate interest.

8.7. Withdrawal of consent — Art. 7(3) GDPR

Where processing is based on consent, you have the right to withdraw it at any time.

8.8. Complaint to the supervisory authority — Art. 77 GDPR

You have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO) if you believe that the processing of your data infringes the GDPR.

9.1. What cookies are

Cookies are small text files stored on the user’s device when visiting a website.

9.2. Cookies we use

• Necessary — ensure the basic functionality of the website (user session, cart, login).
• Functional — remember your preferences (e.g. dark mode).
• Analytics — help us understand how users use the website (heatmaps, session recordings, visit statistics). For this purpose we use Microsoft Clarity (Microsoft Corporation).
• Marketing — used to personalize ads (only with consent).

9.3. Microsoft Clarity

Microsoft Clarity is loaded only after consent to analytics cookies has been given in the consent banner (“Accept all”). The tool stores on the device, among others, the cookies _clck, _clsk, CLID, ANONCHK, MR and SM, which are used to recognize returning users, record sessions and generate heatmaps. The data are processed by Microsoft Corporation in accordance with the Microsoft Clarity privacy policy. Consent can be withdrawn at any time by clearing the consent banner data in your browser settings (localStorage) and selecting “Essential only”.

9.4. Browser storage used by the chat

The assistant chat stores your conversation identifier in the browser storage (localStorage) so that the conversation can be continued after the page is reloaded — this is necessary for the service you request to work, and it is removed when you click “End”. Only with consent to analytics cookies does the chat also store in sessionStorage (until the tab is closed) the list of visited subpages and sections referred to in point 3.4.

9.5. Managing cookies

You can manage cookies through your browser settings. Please bear in mind, however, that disabling cookies may affect the functionality of the Service (e.g. login, shopping cart).

We apply appropriate technical and organizational measures to protect personal data against:

• unauthorized access,
• loss,
• destruction,
• unauthorized modification,
• unauthorized distribution.

• SSL/TLS connection encryption (HTTPS),
• secure password storage (salted bcrypt algorithm),
• user session protection (HttpOnly, Secure cookies),
• access to data restricted to authorized persons only,
• regular software and system updates,
• monitoring of infrastructure security,
• regular database backups.

Within the Service, we do not use automated decision-making, including profiling, that would produce legal effects concerning Users or similarly significantly affect them.

The KalkMate.pl Service may be used by minors (secondary school students). If the user is under 18 years of age, purchasing the calculator and using AI Chat requires the consent of a parent or legal guardian.

This Privacy Policy may be amended due to technological developments, changes in the law or changes in the operation of the Service.

• a notice on the Service’s home page,
• an e-mail message (for registered users).

Please direct any questions concerning the processing of personal data and the exercise of your rights to:

• E-mail: kontakt@kalkmate.pl,
• Phone: +48 600 580 888,
• Contact form available on the website.