Legal document
Privacy Policy
In effect as of October 8, 2026.
Last updated:
1. Data Controller
The controller of your personal data is Tymoteusz Majchrzak, operating a sole proprietorship under the name Trafficly, ul. Reymonta 7, Podkowa Leśna, Poland, Tax ID (NIP): 5291870517 (hereinafter: “Trafficly” or the “Controller”).
Contact for data protection matters: kontakt@trafficly.pl
2. What data we collect
Depending on how you use the Service, we process the following categories of data:
a) Registration and account data
- e-mail address,
- first and last name or company name,
- billing details: Tax ID (NIP), invoice address.
b) Service usage data
- information about managed websites (domains, keywords),
- history of generated AI content,
- account settings and preferences.
c) Technical data
- IP address,
- browser type and version,
- session and activity data within the Service,
- cookie files (details in section 7).
d) Payment data
Payments are handled by Stripe, Inc. Trafficly does not store payment card data. Stripe may process data as a separate controller – see Stripe's privacy policy.
e) Data from the Szefu form (AI assistant)
- first name and e-mail address,
- optionally: company name, phone number, number of mailboxes and your message,
- optionally: who referred you (the “Who referred you?” field),
- the referral code from the page address (the ref parameter), if you arrive via a referral link – we do not store it on your device.
3. Purpose and legal basis for processing
| Purpose of processing | Legal basis |
|---|---|
| Conclusion and performance of the agreement (access to the Service) | Art. 6(1)(b) GDPR |
| Issuing a VAT invoice | Art. 6(1)(c) GDPR (legal obligation) |
| Handling complaints and inquiries | Art. 6(1)(b) and (f) GDPR |
| Responding to a Szefu form submission and preparing an offer | Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) |
| Granting rewards in the Szefu referral programme | Art. 6(1)(f) GDPR (legitimate interest) |
| Service security, fraud prevention | Art. 6(1)(f) GDPR (legitimate interest) |
| Sending newsletters and marketing communications | Art. 6(1)(a) GDPR (consent) |
4. Data retention period
- Account data: for the duration of the agreement plus 3 years after its termination (the statute of limitations for civil-law claims).
- Invoice data: 5 years from the end of the tax year in which the invoice was issued (legal obligation).
- Marketing data: until the User withdraws consent.
- Technical data (logs): up to 12 months from the date recorded.
- Szefu form submissions: 12 months from the last contact, if no contract is concluded.
5. Data recipients
Your data may be shared with the following entities that process data on our behalf (sub-processors). Which recipients apply depends on whether you only use trafficly.pl or also the client Panel (app.trafficly.pl):
a) trafficly.pl (website)
- Vercel (website hosting) – Vercel Inc., USA
- Supabase (database: pricing, spots remaining, blog posts, form submissions) – Supabase Inc., USA, server in the EU region (West EU)
- Resend (e-mails from contact forms) – Resend Inc., USA
b) Client Panel (app.trafficly.pl)
- Supabase (database and authentication) – Supabase Inc., USA, server in the EU region (West EU)
- Vercel (application hosting) – Vercel Inc., USA
- Stripe (payment processing) – Stripe, Inc., USA
- Resend (e-mail delivery) – Resend Inc., USA
- Anthropic (AI language models) – Anthropic PBC, USA
- OpenRouter (AI model access intermediary) – OpenRouter Inc., USA
All of the entities listed provide an adequate level of data protection, including through the use of Standard Contractual Clauses (SCCs) approved by the European Commission.
Szefu – AI assistant (information)
The list above does not cover data from your mailbox processed by Szefu. Szefu runs on your computer – the content of your e-mails and bills does not reach Trafficly’s servers. Mailbox data is processed by your computer and by the AI model provider – Anthropic (Anthropic PBC, USA) – with whom you have your own agreement. The model analyses messages solely to perform the task and does not use them to train models. Passwords are encrypted and the Szefu panel is protected with a PIN. Referral programme rewards are shown in the Szefu panel.
6. Your rights
Under the GDPR, you have the following rights:
- Right of access – you can obtain information about the data being processed and receive a copy of it.
- Right to rectification – you can correct inaccurate or incomplete data.
- Right to erasure (the “right to be forgotten”) – you can request deletion of your data if there is no legal basis for its continued processing.
- Right to restriction of processing – you can request that processing of your data be limited in certain cases.
- Right to data portability – you can receive your data in a structured, machine-readable format.
- Right to object – you can object to processing based on the Controller's legitimate interest.
- Right to withdraw consent – you can withdraw your consent to marketing processing at any time, without affecting the lawfulness of processing carried out before the withdrawal.
- Right to lodge a complaint – you can file a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.
To exercise the rights above, send a message to: kontakt@trafficly.pl. We will respond within 30 days of receiving your request.
8. Changes to this Privacy Policy
We reserve the right to amend this Privacy Policy. We will notify you of any significant changes at least 14 days before they take effect, by sending a notice to your e-mail address or displaying a message within the Service. The current version of this Policy is always available at trafficly.pl/polityka-prywatnosci.
9. Contact
For matters relating to personal data protection, please contact us:
- E-mail: kontakt@trafficly.pl
- Postal address: ul. Reymonta 7, Podkowa Leśna, Poland