Privacy Policy

1. Data controller

The controller of your personal data is Klaavi PSA, a joint-stock company registered in Warsaw, Poland, entered in the register of entrepreneurs of the National Court Register (KRS) under number 0001244751, tax identification number (NIP) 5273221412, statistical number (REGON) 544568357.

2. What data we process

Depending on how you use Klaavi, we process the following categories of data:

Account and registration data

• Email address provided when activating the trial or purchasing a PRO subscription
• Device identifier (hardware fingerprint), generated locally from hardware parameters and used to verify that the free trial is used only once per device. Combined with an email address it may constitute personal data and is processed on the basis of legitimate interest (Article 6(1)(f) GDPR)

Payment data

• Transaction data (amount, currency, date) processed by our payment provider Paddle
• Klaavi does not store payment card details. They are processed exclusively by Paddle acting as merchant of record

Application usage statistics (local)

• Number of words typed, suggestions used, session duration
• This data is stored exclusively on your device and is never transmitted to our servers

Website analytics and advertising data

• Pseudonymised traffic data collected on klaavi.app by Google Analytics 4 (device identifier, on-site behaviour, traffic sources) and anonymous statistical data collected by Plausible Analytics
• Data collected by the Meta Pixel and the Google Ads tag for the purpose of measuring advertising effectiveness and building advertising audiences. These tools are activated only after you give your consent
• Application analytics events collected by PostHog (Cloud EU) without identifying individual users
• Google Analytics 4, the Meta Pixel and Google Ads data are not anonymous within the meaning of the GDPR and require your consent. Plausible data is anonymous and does not require consent

Technical data

• Windows operating system version (for diagnostic and compatibility purposes only)
• Klaavi application version

3. Purposes and legal bases of processing

• Performance of a contract (Article 6(1)(b) GDPR) - activation and operation of the trial, access to the PRO subscription, payment handling via Paddle
• Legitimate interest (Article 6(1)(f) GDPR) - product security, prevention of abuse (hardware fingerprint), analytics based on tools that do not require consent (Plausible Analytics, PostHog configured without user identification), technical data (operating system version, application version) necessary for error diagnosis and software compatibility
• Consent (Article 6(1)(a) GDPR) - analytics based on pseudonymised identifiers (Google Analytics 4), advertising tools (Meta Pixel, Google Ads), and email marketing communication. You may withdraw your consent at any time by clicking "Unsubscribe" in any email from us, by changing your choice in the cookie settings in the website footer, or by writing to [email protected]
• Legal obligation (Article 6(1)(c) GDPR) - retention of tax and transaction records as required by law

4. Sharing data with third parties

Your data may be shared only with trusted providers we work with:

• Paddle (payment provider, United Kingdom) - data necessary to complete the transaction. Paddle acts as merchant of record, which means Paddle is responsible for the tax settlement of your purchases. Transfers to the United Kingdom take place on the basis of the European Commission adequacy decision for the United Kingdom and, where applicable, EU Standard Contractual Clauses.
• Brevo (email marketing provider, France, EU) - your email address, used to send transactional emails (activation link, confirmations, subscription information) and, on the basis of separate consent, informational and promotional messages. Data is processed within the European Economic Area.
• Meta Platforms Ireland Limited (Meta Pixel) - pseudonymised data about visits to klaavi.app, used to measure advertising effectiveness and build advertising audiences. Meta also processes this data for its own purposes as an independent controller. Activated only after you give consent. Details: facebook.com/privacy/policy.
• Google LLC (Google Analytics 4, Google Ads) - pseudonymised website analytics and advertising conversion data. Google LLC is based in the United States. Transfers take place on the basis of the EU-US Data Privacy Framework and EU Standard Contractual Clauses. Analytics is configured without advertising personalisation. Activated only after you give consent.
• Plausible Analytics - anonymous website statistics, without cookies and without user identifiers. GDPR-compliant without a cookie banner. Data is processed within the EU.
• PostHog (PostHog Inc., USA, data processed on EU servers, eu.posthog.com) - application analytics events without identification of individual users. Transfers to the United States take place on the basis of EU Standard Contractual Clauses. Data is stored exclusively on servers in Europe.

We do not sell your data. We do not share it with data brokers. Transfers outside the European Economic Area take place solely on the basis of legal mechanisms guaranteeing an adequate level of protection, in particular the Standard Contractual Clauses approved by the European Commission.

5. Data retention periods

• Account and email data - for the duration of the subscription and, after it ends, for 12 months to allow reactivation, unless you request deletion earlier. The legal basis for retaining data after the subscription ends, for the purpose of retention communication, is your marketing consent (Article 6(1)(a) GDPR). If you withdraw your marketing consent, your data will be deleted or anonymised promptly after the subscription ends.
• Transaction data - 5 years from the transaction date, in accordance with tax law, or for the period required by the law applicable in your country if that period is longer.
• Anonymous analytics data (Plausible) - retained by the provider in accordance with its policy. This is not personal data.
• Pseudonymised analytics data (Google Analytics 4) - retained by Google for 14 months (the GA4 default with the shortened retention option enabled). This data is not linked to your identity on the Klaavi side.
• Advertising data (Meta Pixel, Google Ads) - retained by Meta and Google in accordance with their policies. Advertising cookies expire after 90 days at the latest.
• Application event data (PostHog) - retained by the provider in accordance with its policy, without identification of individual users.
• Activation and licence verification logs - a record of trial and subscription activation dates and device identifiers (hardware fingerprint), retained for 12 months from the expiry of the account or subscription, on the basis of legitimate interest (Article 6(1)(f) GDPR): protection against trial abuse and verification of licence validity.
• Support data - email correspondence and requests sent to [email protected] and [email protected], retained for 24 months from the date of the request, on the basis of legitimate interest (Article 6(1)(f) GDPR): the ability to refer to the request history and provide continuity of service.
• Local application statistics - stored exclusively on your device. You may delete them at any time from the Klaavi settings or by uninstalling the application.

6. Your rights

Under the GDPR you have the following rights:

• Access - the right to obtain information about the data we process
• Rectification - the right to have inaccurate data corrected
• Erasure - the right to request deletion of your data (the "right to be forgotten")
• Restriction of processing - the right to request that processing be suspended in certain circumstances
• Portability - the right to receive your data in a machine-readable format
• Objection - the right to object to processing based on legitimate interest
• Withdrawal of consent - at any time, without affecting the lawfulness of processing carried out before withdrawal

To exercise any of these rights, write to us at [email protected]. We will respond without undue delay and no later than one month from receipt of your request. In the case of complex or numerous requests, this period may be extended by a further two months. We will inform you of any such extension before the end of the first month.

If you believe we are processing your data unlawfully, you have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (uodo.gov.pl). If you reside in another EU or EEA country, you may also lodge a complaint with the supervisory authority in your country of residence.

7. Automated processing and profiling

Klaavi uses a hardware fingerprint (device identifier) to verify whether a free PRO trial has already been used on a given device. This is a purely technical check that the trial is used only once. It does not constitute profiling or automated decision-making within the meaning of Article 22 GDPR and produces no legal effects concerning you beyond restricting access to a further free trial period.

Klaavi does not carry out behavioural profiling or automated decision-making that significantly affects your legal or economic situation.

8. Protection of minors

Klaavi is not intended for persons under 16 years of age. If you are under 16, you should not provide your personal data or register an account with Klaavi. If we learn that we have collected personal data from a person under 16 without verifiable consent from a parent or legal guardian, we will delete that data promptly. Please contact us at [email protected] if you become aware of such a case.

9. Cookies and tracking technologies

Plausible Analytics operates without cookies and does not require consent under the GDPR. Cloudflare cookies are technically necessary for the security of the website and also do not require consent.

Full details, including cookie names and lifetimes: Cookie policy.

10. Data security

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or destruction. These include encryption of data in transit (HTTPS), restricted access to personal data and regular security reviews.

Data relating to your typing (statistics, prediction personalisation) is stored exclusively locally and never leaves your device.

11. Changes to this privacy policy

We reserve the right to update this policy. We will inform you of any material changes by email or by a notice in the application at least 14 days before they take effect. The date of the last update appears at the top of this document.

12. Contact