Privacy Policy

1. Who we are

Data controller

The controller of your personal data is:

• RR-Soft (operator of the Calcopolis platform)
• ul. Kierbedzia 8A, 00-728 Warszawa, Poland
• NIP / VAT-EU: 921-192-91-92
• REGON: 060629850

Privacy-related enquiries: contact@calcopolis.com. You may also use our contact form.

2. Scope & applicable law

Polish and EU rules

We process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR), applicable Polish data protection law, and — where relevant — the Polish Act on Provision of Electronic Services and ePrivacy rules on cookies and similar technologies.

This policy applies to the Calcopolis website, web application, embedded calculators operated by us, and related communication channels. It does not replace the privacy notices of our customers who embed Calcopolis forms on their own websites — in those cases, the website owner is usually the data controller for visitor submissions, and we act as a data processor on their instructions.

3. What data we collect

Categories of personal data

Depending on how you interact with Calcopolis, we may process:

• Account & identity data — name, email address, company name, login credentials (stored in hashed form), profile and workspace settings
• Billing data — subscription plan, payment status, billing history; card details are processed by Stripe and are not stored on our servers
• Service & usage data — calculators and forms you create, configuration, usage quotas, logs, error reports, and actions taken in the platform
• Lead & form submission data — information entered by end users into calculators/forms you publish (e.g. contact details, answers, calculated results), when you use lead capture features
• Communication data — messages you send to support, feedback, and email correspondence
• Technical data — IP address, browser type, device information, operating system, referral URLs, date/time of access, and cookie identifiers
• Marketing & analytics data — interactions with our website and campaigns, including data collected through analytics, advertising, and session-recording tools described below

Providing account data is necessary to register and use paid features. Other data may be optional depending on the feature you use.

4. Purposes & legal bases

Why we use your data

We process personal data for the following purposes:

• Providing the service (Art. 6(1)(b) GDPR) — account creation, hosting calculators, embed delivery, automation, support, and platform functionality
• Billing & contract administration (Art. 6(1)(b) and (c) GDPR) — subscriptions, invoices, payment processing, accounting, and tax obligations
• Security & abuse prevention (Art. 6(1)(f) GDPR) — protecting accounts, preventing spam and fraud, including Google reCAPTCHA on public forms
• Service improvement (Art. 6(1)(f) GDPR) — diagnostics, performance monitoring, and understanding how features are used
• Marketing & measurement (Art. 6(1)(a) GDPR — consent, where required) — website analytics, advertising performance, remarketing, and conversion tracking
• Session recordings (Art. 6(1)(a) GDPR — consent, where required) — understanding how visitors use our website to improve usability; see section 7
• Communication (Art. 6(1)(b) or (f) GDPR) — responding to enquiries and sending service-related notices

Where we rely on legitimate interest, we balance our interests against your rights. Where consent is required — especially for non-essential cookies, advertising tags, and session recording — we ask for it before such tools are activated.

5. Tools & recipients

Who we share data with

We use trusted service providers (“processors”) that process data on our behalf and only as instructed by us. These include:

• Stripe — payment processing and subscription management (USA / global infrastructure)
• SendGrid (or equivalent email provider) — transactional and service emails
• Google reCAPTCHA — bot and spam protection on forms
• Google Fonts — delivery of web fonts when used on our site or in published calculators
• Hosting & CDN providers — operation of calcopolis.com and cdn.calcopolis.com

We also use, or plan to introduce, the following marketing and analytics tools. When active, they may set cookies or similar identifiers and collect usage data:

• Google Analytics 4 (GA4) — website traffic and behaviour statistics
• Google Ads — conversion measurement and remarketing
• Meta Ads (Facebook / Instagram Pixel) — advertising performance and remarketing
• Hotjar or similar session-recording tools — recordings of browsing sessions, clicks, scrolls, and page interactions on our website

If you connect third-party integrations inside Calcopolis (e.g. webhooks, CRM, email automation, spreadsheets), data may also be sent to providers you configure. You are responsible for ensuring you have a lawful basis to share end-user data with them.

We may also disclose data when required by law, to protect our rights, or in connection with a business transfer, always subject to applicable legal safeguards.

6. Cookies

Cookies and similar technologies

Our website uses cookies and similar technologies for essential operation (e.g. session management, security, CSRF protection), preferences, analytics, advertising, and — where enabled — session recording.

Non-essential cookies, including those used by GA4, Google Ads, Meta Ads, and Hotjar, are used only on the basis of your consent where required by EU and Polish law. You can manage your choices at any time through our cookie settings and your browser controls.

More details are available in our Cookie Policy.

7. Session recording

Hotjar and similar tools

Session recording tools can capture how you navigate our website, including pages viewed, mouse movements, clicks, scrolling, and data you type into visible form fields. Under GDPR and Polish law, this is personal data processing and — when non-essential — generally requires prior consent.

We reserve the right to use Hotjar or comparable session-recording and heatmap services on calcopolis.com to understand usability issues, improve conversion paths, and fix friction in the user experience. Such tools are intended for our own marketing website and application interface, not for surreptitious recording inside calculators you embed on third-party sites unless explicitly configured and disclosed by you as the controller.

When we enable session recording, we configure privacy safeguards where available (such as suppressing sensitive fields), limit retention periods, and rely on the provider’s data processing agreement. You may withdraw consent through cookie settings.

8. International transfers

Data outside the EEA

Some providers we use (including Google, Meta, Stripe, Hotjar, and SendGrid) may process data in the United States or other countries outside the European Economic Area. Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and supplementary measures. You may request more information about transfers relevant to your data by contacting us.

9. Retention

How long we keep data

We retain personal data only as long as necessary for the purposes above, including:

• Account data — for the life of your account and up to [e.g. 3 years] after closure, unless a longer period is required by law
• Billing & tax records — for the period required by Polish accounting and tax regulations
• Support correspondence — typically up to [e.g. 3 years] after the case is closed
• Analytics, advertising, and session-recording data — according to each provider’s settings and our configuration, generally between [e.g. 14 days] and [e.g. 26 months], unless you withdraw consent earlier
• Server logs — usually up to [e.g. 90 days] for security and troubleshooting
• Lead data in your calculators — until you delete it or close your account, subject to your own retention policies as controller

When data is no longer needed, we delete or anonymise it.

10. Your rights

Rights under GDPR

If you are in the EU/EEA (including Poland), you have the right to:

• access your personal data and receive a copy
• rectify inaccurate data
• erase data (“right to be forgotten”) in certain circumstances
• restrict processing in certain circumstances
• data portability, where applicable
• object to processing based on legitimate interest, including profiling
• withdraw consent at any time, without affecting prior lawful processing
• lodge a complaint with a supervisory authority

In Poland, the supervisory authority is the President of the Personal Data Protection Office (UODO) — uodo.gov.pl.

To exercise your rights, contact us at contact@calcopolis.com. We may need to verify your identity before responding.

11. Security & children

How we protect data

We apply technical and organisational measures appropriate to the risk, including access controls, encryption in transit (SSL/TLS), isolated execution of embedded calculator code, and separation of customer environments. No method of transmission or storage is completely secure; please use a strong password and keep credentials confidential.

Calcopolis is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, please contact us so we can delete it.