Trafficly is committed to protecting your personal data. This document describes what data we collect, for what purpose, how long we retain it, and what rights you have as a data subject.
1. Data Controller
The controller of your personal data is Tymoteusz Majchrzak, operating a sole proprietorship under the name Trafficly, ul. Reymonta 7, Podkowa Leśna, Poland, Tax ID (NIP): 5291870517 (hereinafter: “Trafficly” or the “Controller”).
Contact for data protection matters: kontakt@trafficly.pl
2. What data we collect
Depending on how you use the Service, we process the following categories of data:
a) Registration and account data
- e-mail address,
- first and last name or company name,
- billing details: Tax ID (NIP), invoice address.
b) Service usage data
- information about managed websites (domains, keywords),
- history of generated AI content,
- account settings and preferences.
c) Technical data
- IP address,
- browser type and version,
- session and activity data within the Service,
- cookie files (details in section 7).
d) Payment data
Payments are handled by Stripe, Inc. Trafficly does not store payment card data. Stripe may process data as a separate controller — see Stripe's privacy policy.
3. Purpose and legal basis for processing
| Purpose of processing | Legal basis |
|---|
| Conclusion and performance of the agreement (access to the Service) | Art. 6(1)(b) GDPR |
| Issuing a VAT invoice | Art. 6(1)(c) GDPR (legal obligation) |
| Handling complaints and inquiries | Art. 6(1)(b) and (f) GDPR |
| Service security, fraud prevention | Art. 6(1)(f) GDPR (legitimate interest) |
| Analytics and service improvement | Art. 6(1)(f) GDPR (legitimate interest) |
| Sending newsletters and marketing communications | Art. 6(1)(a) GDPR (consent) |
4. Data retention period
- Account data: for the duration of the agreement plus 3 years after its termination (the statute of limitations for civil-law claims).
- Invoice data: 5 years from the end of the tax year in which the invoice was issued (legal obligation).
- Marketing data: until the User withdraws consent.
- Technical data (logs): up to 12 months from the date recorded.
5. Data recipients
Your data may be shared with the following entities that process data on our behalf (sub-processors):
- Supabase (database and authentication) – Supabase Inc., USA, server in the EU region (West EU)
- Vercel (application hosting) – Vercel Inc., USA
- Stripe (payment processing) – Stripe, Inc., USA
- Resend (e-mail delivery) – Resend Inc., USA
- Anthropic (AI language models) – Anthropic PBC, USA
- OpenRouter (AI model access intermediary) – OpenRouter Inc., USA
All of the entities listed provide an adequate level of data protection, including through the use of Standard Contractual Clauses (SCCs) approved by the European Commission.
6. Your rights
Under the GDPR, you have the following rights:
- Right of access – you can obtain information about the data being processed and receive a copy of it.
- Right to rectification – you can correct inaccurate or incomplete data.
- Right to erasure (the “right to be forgotten”) – you can request deletion of your data if there is no legal basis for its continued processing.
- Right to restriction of processing – you can request that processing of your data be limited in certain cases.
- Right to data portability – you can receive your data in a structured, machine-readable format.
- Right to object – you can object to processing based on the Controller's legitimate interest.
- Right to withdraw consent – you can withdraw your consent to marketing processing at any time, without affecting the lawfulness of processing carried out before the withdrawal.
- Right to lodge a complaint – you can file a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.
To exercise the rights above, send a message to: kontakt@trafficly.pl. We will respond within 30 days of receiving your request.
7. Cookies
The Service uses the following types of cookies:
- Essential – required for the Service to function correctly (session, authentication). These do not require your consent and cannot be disabled.
- Analytics – used to analyze how the Service is used in order to improve it. Require consent.
- Preference – remember the User's settings and preferences. Require consent.
You can manage cookies in your browser's settings. Disabling essential cookies may prevent you from using the Service.
8. Changes to this Privacy Policy
We reserve the right to amend this Privacy Policy. We will notify you of any significant changes at least 14 days before they take effect, by sending a notice to your e-mail address or displaying a message within the Service. The current version of this Policy is always available at trafficly.pl/polityka-prywatnosci.
9. Contact
For matters relating to personal data protection, please contact us:
This Privacy Policy is in effect as of June 1, 2025.