Who the controller is
Matouš Janeček, company ID (IČO) 29938881, T. G. Masaryka 415, 562 01 Ústí nad Orlicí. For anything concerning personal data, write to matous.janecek@gmail.com.
This policy applies to you as a user of Podklado and to the people in your team. Your clients’ data, meaning whatever they deliver to you through the link, we process only on your behalf under the data processing agreement. You are the controller of that data.
What data and why
- Account: name, email, password (only as an irreversible hash) and the language in which you use the app and we send you emails. So that we can provide the service, i.e. performance of a contract.
- Sign-in: IP address and browser for each sign-in. For account security, legitimate interest.
- Payments: billing details and payment history. You enter your card directly with Stripe; we never see it. Performance of a contract and the legal obligation to keep accounts.
- Service emails: email confirmation, password reset, project notifications. Performance of a contract. We do not send marketing mass mailings.
- Free checklist: the email address you had it sent to and which checklist it was. So that we can send it to you and know which ones people are interested in, i.e. legitimate interest. We send nothing else to that address.
- Website traffic: see the next section.
Visit counting
On public pages (home, pricing, checklists, demo, sign-up and sign-in) we count visits with Umami, which runs on our own server. We do not send this data to anyone else. We want to know which pages help people and where they come to the site from. This is our legitimate interest.
- We store the address of the page you came from (including utm campaign parameters), the type of browser, operating system and device, screen size, language, and the country and city estimated from your IP address.
- We do not store the IP address itself. Visits are linked only within a single day through an irreversible hash that changes every day. So the next day we will not recognise you, and we do not know who you are. For the same reason we cannot look up, show or delete this data for you (Art. 11 GDPR).
- We do not use cookies and store nothing on your device unless you ask us to with the button below.
- We do not measure the app after sign-in or the pages through which clients deliver their materials at all.
- If your browser has “Do Not Track” turned on, we do not count you.
Who we share data with
- Oracle (Oracle Cloud Infrastructure), data centre in Frankfurt, Germany: server and database.
- Cloudflare, Inc.: storage for files and database backups (Cloudflare R2) with EU jurisdiction; the data stays in the European Union. The contract is covered by the EU standard contractual clauses.
- Resend, Inc.: sending emails from the EU region. Any transfer to the USA is covered by the EU standard contractual clauses.
- Stripe Payments Europe, Ltd., Ireland: payments and invoices. Stripe may transfer data to the USA under its own policies and the standard contractual clauses.
- Accountants and authorities, only where the law requires it.
How long
- Account data for as long as you have the account. When you delete the account, we delete it straight away; it disappears from backups within 30 days at the latest.
- Invoices and accounting records for 10 years, as the law requires.
- Sign-in records for as long as the sign-in is valid.
- The email from a downloaded checklist for one year, after which we delete it ourselves. Sooner on request.
- Traffic data for two years, after which we delete it ourselves.
Cookies
We use only two essential cookies: one for sign-in and one with the page language (NEXT_LOCALE), which disappears when you close the browser. We count visits without cookies and without storing anything on your device, and we have no advertising or cross-site tracking. That is why we do not ask for consent.
Your rights
You have the right to access your data, to have it corrected, erased or its processing restricted, to data portability and the right to object to processing based on legitimate interest. Most of this you can do yourself in Settings; for the rest, write to us. The quickest way to object to visit counting is the button in the Visit counting section. You can lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.