Privacy Policy

1. Data controller

The controller of your personal data is Klaavi PSA, with its registered office in Warsaw, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0001244751, NIP 5273221412 and REGON 544568357.

2. Personal data we process

Depending on how you use Klaavi and which services are enabled, we process the following categories of data:

Registration and account data

• The email address provided when activating a trial or purchasing a PRO subscription.
• A device identifier (hardware fingerprint), generated locally from hardware parameters and used to verify whether a trial has already been used. When combined with an email address, it may constitute personal data and is processed on the basis of legitimate interests (Article 6(1)(f) GDPR).

Payment data

• Transaction details, including amount, currency and date, processed by our payment provider Paddle.
• Klaavi does not store payment-card details. They are processed exclusively by Paddle as merchant of record.

Local application statistics

• The number of words entered, suggestions used and session duration.
• This information is stored only on your device and is not transmitted to our servers.

Website analytics data (where the relevant tool is enabled)

• Where enabled, pseudonymised traffic data collected by GA4, including device identifiers, on-site behaviour and traffic sources, and anonymous statistics collected by Plausible Analytics.
• Where PostHog is enabled, application analytics events collected through PostHog Cloud EU without identifying individual users.
• GA4 data is not anonymous within the meaning of the GDPR and requires consent. Plausible data is anonymous and does not require consent.

Technical data

• The Windows operating-system version, used only for diagnostics and compatibility.
• The Klaavi application version.

3. Purposes and legal bases

• Performance of a contract (Article 6(1)(b) GDPR) – trial activation and operation, access to the PRO subscription and payment handling through Paddle.
• Legitimate interests (Article 6(1)(f) GDPR) – product security, fraud and trial-abuse prevention, analytics based on tools that do not require consent, and technical data necessary for diagnostics and software compatibility.
• Consent (Article 6(1)(a) GDPR) – analytics based on pseudonymised identifiers that require consent, including Google Analytics 4, and email marketing. You can withdraw consent at any time by selecting the unsubscribe link in an email from us or by writing to [email protected].
• Legal obligation (Article 6(1)(c) GDPR) – retaining tax and transaction records as required by law.

4. Sharing data with third parties

Your data may be shared only with trusted providers we work with, where the relevant service is enabled and necessary for the purpose described:

• Paddle (payment provider, United Kingdom) – information required to complete transactions. Paddle acts as merchant of record and is responsible for the tax settlement of purchases. Transfers to the United Kingdom rely on the European Commission adequacy decision for the United Kingdom.
• Brevo (email provider, France / EU) – where used as the email provider, it receives email addresses to send transactional messages and, with separate consent, informational and promotional communications. Data is processed within the European Economic Area.
• Google Analytics 4 – where enabled, it processes pseudonymised website analytics. Google LLC is based in the United States; transfers rely on the applicable legal mechanism, including EU Standard Contractual Clauses where relevant. Advertising personalisation is disabled and GA4 is activated only after consent.
• Plausible Analytics – where enabled, it processes anonymous website statistics without cookies or persistent user identifiers, within the EU.
• PostHog (PostHog Inc., United States; Cloud EU environment) – where enabled, it processes application analytics events without identifying individual users. Transfers rely on the applicable legal mechanism, including EU Standard Contractual Clauses where relevant, while event data is stored in the European service environment.

We do not sell your personal data. Transfers outside the European Economic Area take place only through legal mechanisms designed to ensure an adequate level of protection.

5. Retention periods

• Account and email data – for the duration of the subscription and for 12 months afterwards to allow reactivation, unless you request deletion earlier. If you withdraw marketing consent, the data will be deleted or anonymised promptly after the subscription ends.
• Transaction data – for five years from the transaction date, or for a longer period where required by the law applicable to the user.
• Anonymous analytics data (Plausible, where enabled) – retained by the provider under its policy and not treated as personal data.
• Pseudonymised analytics data (GA4, where enabled) – retained for the period configured in the service and no longer than necessary for the analytics purpose; Klaavi does not link it to your identity.
• Application analytics events (PostHog, where enabled) – retained by the provider under its policy without identifying individual users.
• Activation and licence-verification logs – retained for 12 months after the account or subscription expires on the basis of legitimate interests.
• Support data – correspondence and requests sent to [email protected] and [email protected], retained for 24 months from the request date.
• Local application statistics – stored only on your device and removable at any time through Klaavi settings or by uninstalling the application.

6. Your rights

Under the GDPR, you have the following rights:

• Access – the right to receive information about the personal data being processed.
• Rectification – the right to correct inaccurate personal data.
• Erasure – the right to request deletion of personal data.
• Restriction – the right to request that processing be restricted in specific circumstances.
• Data portability – the right to receive data in a machine-readable format.
• Objection – the right to object to processing based on legitimate interests.
• Withdrawal of consent – at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, email [email protected]. We will respond without undue delay and no later than one month after receiving your request. For complex or numerous requests, this period may be extended by a further two months, and we will notify you before the first month expires.

If you believe that we process your data unlawfully, you may lodge a complaint with the President of the Polish Personal Data Protection Office (uodo.gov.pl).

7. Automated processing and profiling

Klaavi uses a hardware fingerprint to verify whether a free PRO trial has already been used on a device. This is solely a technical verification of trial eligibility. It does not constitute profiling or automated decision-making within the meaning of Article 22 GDPR and has no legal effect beyond preventing access to another free trial.

Klaavi does not use behavioural profiling or automated decision-making that has a significant legal or economic effect on you.

8. Children’s data

Klaavi is not intended for people under the age of 16. If you are under 16, you should not provide personal data or register a Klaavi account. If we learn that we have collected personal data from a person under 16 without verifiable consent from a parent or legal guardian, we will delete it promptly. Please report such cases to [email protected].

9. Cookies and tracking technologies

The klaavi.app website may use cookies necessary for the operation and security of the website. We do not use advertising or behavioural-profiling cookies. Where Plausible Analytics is enabled, it works without cookies or persistent identifiers. Where GA4 is enabled, its cookies are not activated before the user gives consent.

10. Data security

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or destruction. These measures include encrypted transmission through HTTPS, restricted access to personal data and regular security reviews.

Information about what you type, including local statistics and prediction personalisation, is stored only on your device and never leaves it.

11. Changes to this policy

We may update this policy. We will notify you of material changes by email or through an in-application notice at least 14 days before they take effect. The last-updated date appears at the top of this document.

12. Contact