Privacy policy

This policy describes what personal data the Parkuj.com.pl service processes, for what purpose, on what legal basis, and who it is entrusted to. It applies to visitors, newsletter subscribers and account holders.

1. Data controller

The controller of personal data is IntegraLab Tomasz Waliński, operator of the Parkuj.com.pl service.

Topolowa 9/7
05-500 Mysiadło

Tax ID (NIP): 7611355049

Contact for data protection matters: support@parkuj.com.pl.

We have not appointed a data protection officer — none of the conditions in art. 37 GDPR applies. Please direct all matters to the address above.

2. What data we process

Account

• email address — used for signing in, confirming registration, and notifications about your parking place,
• password — stored only as a cryptographic hash by the Supabase Auth authentication mechanism; we have no access to it in plain form,
• account creation date and last sign-in date.

Using a parking lot

• membership of a lot and your role in it (Manager, holder of a permanent place, user of the shared pool),
• daily bookings, releases of a permanent place, waitlist entries and their order,
• coin balance and history — the internal allocation unit described in theTerms of service,
• the label of your assigned place and, if a Manager added one, its position on the parking floorplan.

This data is visible to the Manager of the lot you belong to, and to the extent necessary to other members of that lot (for example, the fact that a given place is taken on a given day). It is not visible to members of other lots — the separation is enforced at the database level, not only in the interface.

Newsletter

If you subscribe to the newsletter using the form on the home page, we process the data below. MailerLite keeps the subscriber list on our behalf (section 4); we keep no copy of it in our own database.

• your email address and — if you give it — your first name,
• the version and language of the consent statement shown at signup, and the signup source (the form on the site),
• the state of the subscription (unconfirmed, active, unsubscribed) and the dates of signup, confirmation and unsubscribe,
• the IP address from which the confirmation link was clicked — MailerLite records it at confirmation; the form on our site does not pass your IP address to it,
• an approximate location (country) and time zone — MailerLite derives them from the IP address a request or event came from (for example the server that sent your signup, or the confirmation page or a message being opened), so they may not match where you actually are,
• whether and when a message was opened and whether a link in it was clicked — MailerLite records this, and we use it to improve the content.

Technical data

• IP address and User-Agent header — seen by the hosting and abuse-protection layer (Cloudflare), which processes them transiently to keep the service secure and available and does not link them to an account. Your IP address is also seen by Sentry, because a fault report is sent by your browser directly to that service's server rather than through us; in our Sentry project IP addresses are stored alongside the report, for the period stated in section 5,
• fault report (error telemetry, Sentry) — created only when an unhandled error occurs in the application, and only in the production version of the service. A report from the browser contains: the error message and stack trace, the full page URL where the error occurred — including query parameters and fragment, so for example the invite code in a /join/… address or the return path in a sign-in address — the address of the page you came from (the Referer header, including an external site), your browser identification string (User-Agent), a record of your recent actions in the browser in the minutes before the error (addresses opened, console messages, elements clicked). The report does not contain cookies, form contents or any other request and response bodies, database data, values of variables from our code, or an account identity attached by this tool. A report created on the server side is narrower — it carries no headers, no cookies and no request bodies — but itcarries the full URL, query parameters included, exactly as the browser report does,
• technical page-view signal (Sentry) — separate from the fault report and sent on every page view in the production version, including when nothing went wrong. It carries no content and no data about you; it exists only to count what share of visits end in an error,
• usage statistics (PostHog) — page views and clicks with text masked, and named events in the service, on the terms and to the extent described in section 7; depending on your choice in cookie settings,
• parking floorplan uploaded by a Manager — an image file, which may contain data about the site, not people.

What we do NOT process

• we do not collect device location data — the service never requests geolocation access; the only location we know is the approximate position PostHog derives from the IP address, described in section 7,
• we do not process licence plates or vehicle data,
• we do not process payment data — the service accepts no payments.

3. Legal bases and purposes

4. Recipients of the data

We use the providers listed below. Each of them processes data only on our instructions and only to the extent needed to perform its function.

Where a provider is outside the European Economic Area, or a provider inside it passes data on outside it to its affiliates or sub-processors, the transfer takes place on the basis of standard contractual clauses approved by the European Commission and, where the provider participates in the EU-US Data Privacy Framework, also on the basis of the Commission's adequacy decision.

We do not sell personal data and do not share it with others for their own marketing purposes.

5. Retention periods

• account data — for as long as the account exists; after deletion we remove it without undue delay,
• booking and coin history — for the duration of your membership of a given lot; it is needed for the coin ledger to balance and for the Manager to see who occupied a place,
• the history of account, lot and membership steps (internal analysis of the service, section 3) — for as long as the account exists, deleted together with it; if you object, we delete your entries and stop recording them,
• email correspondence — up to 12 months after the matter is closed,
• the fault reports described in section 2 (including the IP address) — up to 90 days from the error; after that period the provider deletes them, and we keep no copy of our own,
• the consent receipts described in section 7 — 3 years from each decision; after that a daily automated job deletes them,
• an unconfirmed newsletter signup (the confirmation link was not clicked) — permanently deleted no later than 90 days after signup,
• newsletter subscriber data — until you unsubscribe or withdraw consent,
• data after you unsubscribe from the newsletter — all the subscriber data described in section 2 (the email address, first name if given, dates and consent data, the IP address from confirmation and the history of opens and clicks) are kept as proof of consent and to block the address from being added again against your will; permanently deleted no later than 3 years and 60 days after unsubscribing,
• usage statistics data (PostHog) — up to 7 years from when the event was recorded; after that period the provider deletes it.

Newsletter data is deleted in two steps. At least once every 30 days we review the list and ask MailerLite to delete unconfirmed signups older than 30 days and contacts who unsubscribed more than 3 years ago; MailerLite then has up to 30 days to delete them permanently from its systems. If you sign up again with the same address during that time, MailerLite may restore the earlier record together with its history. The deadlines above cover both steps, and our backup copies of the list too — their rotation does not extend these periods.

6. Your rights

You have the right to:

• access your data and obtain a copy of it (art. 15 GDPR),
• rectify inaccurate data (art. 16),
• erasure (art. 17),
• restriction of processing (art. 18),
• data portability (art. 20),
• object to processing based on legitimate interest (art. 21),
• withdraw your newsletter consent at any time (art. 7(3)) — using the unsubscribe link in every message, or by writing to support@parkuj.com.pl; withdrawal does not affect the lawfulness of processing before it.

To exercise any of these, write to support@parkuj.com.pl. We respond within the period set by the GDPR, as a rule within one month.

You also have the right to lodge a complaint with a supervisory authority — in Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw.

7. Cookies

The service stores strictly necessary cookies on your device and — only with your consent — statistics cookies. Strictly necessary cookies do not require consent.

• sb-* — strictly necessary: sign-in session cookies, set by the Supabase authentication mechanism; sign-in does not work without them,
• __Host-pc_consent — strictly necessary: remembers your choice — consent and refusal alike — for 6 months, after which we ask again. It holds a random identifier, your decisions, the versions of the text we asked you about, and the date of the decision — no other personal data. Page scripts cannot read it,
• ph_<token>_posthog and __ph_opt_in_out_<token> — statistics (PostHog),only after consent, for 6 months; plus ph_<token>_* entries in the browser's session storage, which disappear when the tab is closed.

Every visitor, whatever their country, is asked for consent in a banner on their first visit. Until you decide, the statistics tool is not started at all: nothing is stored on your device and nothing is sent.

After you consent, PostHog records page views, leaving a page, and clicks. The text and attributes of clicked elements are masked, and we remove invite codes and return paths from page addresses. Once you sign in, events are linked to your account identifier (never to your email address).

When you have consented and are signed in, our server also sends PostHog — directly, toeu.i.posthog.com, with no cookies at all — named events in the service: for example creating a lot, a request to join, a booking, or a failed action together with its error code (never the message text). They are linked to your account identifier and the lot identifier, never to your email address. Your PostHog profile also records your role in the service (Manager or member) and the number of lots you manage, and the lot carries properties describing its state: counts (for example the number of places and members), flags, its stage in the service and the date it was configured. Without consent — before you decide, after a refusal or after you withdraw it — the server sends no such event.

After you refuse or withdraw consent, page views are counted without storing anything on your device: PostHog computes, on its side, a hash of your IP address, browser identification string and a salt that changes daily. Such a hash cannot recognise you the next day and is not linked to an account. In both modes your IP address reaches PostHog through our server; PostHog does not store it with the events.

Approximate location. After you consent, before it discards the IP address, PostHog derives an approximate position from it: country, region, city, postal code, approximate coordinates with an accuracy radius, and time zone. It stores these with the events and — if you are signed in — also in the profile linked to your account. After you refuse or withdraw consent, no location is derived: PostHog removes the IP address right after computing the hash. This is the position a geolocation database assigns to the IP address (often your internet provider's location), not the location of your device. We use it only for summaries of which countries and regions the service is used from.

Every decision we save is confirmed by a receipt kept in our database: the random identifier from the__Host-pc_consent cookie, the decision for each category and its kind (consent, refusal or withdrawal), the date and place of the decision (banner or settings), the text and policy versions, the language, the country determined by the hosting layer, a random request identifier (which prevents a double save) and — if you are signed in — your account identifier. A receipt contains no IP address and no browser identification string.

You can change or withdraw your decision at any time in cookie settings — the link is also in the page footer and on your account page. Withdrawing consent removes the PostHog cookies from your device.

Session cookies are scoped to a specific domain. Being signed in on one domain of the service does not mean being signed in on another — this is intended behaviour.

8. Automated decisions

Allocation of a place from the waitlist happens automatically, following the declared order of entries (FIFO) and coin availability. The rule is public and identical for everyone; we build no profiles and apply no behavioural scoring. This is not automated decision-making producing legal effects within the meaning of art. 22 GDPR.

9. Changes to this policy

We will notify account holders and newsletter subscribers of material changes by email. The date of the last update is shown at the top of this page.