Privacy policy

1. Data controller

The controller of personal data is Patryk Kowalski, running a business under the name KamikStudio Patryk Kowalski, NIP (Polish tax identification number): 6182187584, REGON (Polish business registry number): 387776597, office and correspondence address: ul. Fabryczna 1, 62-800 Kalisz, Poland (hereinafter: the “Controller”).

This Policy describes the data whose processing we decide on ourselves. Data of customers, employees and business partners that a bakery enters into the BakePilot application is processed by us on the bakery's behalf under a data processing agreement (Annex No. 1 to the Terms of Service); in those matters the bakery is the controller.

Contact in personal data matters: kontakt@bakepilot.pl

2. Legal bases for processing

We process personal data on the following bases:

• Article 6(1)(b) of the GDPR (Regulation (EU) 2016/679) - performance of a contract (providing the BakePilot service) and steps taken at your request before entering into it (replying to an inquiry sent through the contact form)
• Article 6(1)(a) of the GDPR - consent (newsletter, analytics and advertising cookies and the related events sent from our server)
• Article 6(1)(c) of the GDPR - legal obligation (accounting, invoices; handling notices of illegal content and giving reasons for moderation decisions under Articles 16 and 17 of Regulation (EU) 2022/2065, the “Digital Services Act”)
• Article 6(1)(f) of the GDPR - legitimate interest (analytics, security, promoting BakePilot among bakery and pastry businesses using data from public registers - section 3a; establishing, pursuing and defending claims under the contract, also after the account is deleted)

3. What data we collect

Registration data:

• First and last name
• Email address
• Phone number (mandatory at registration and in contact forms)
• Company details: name, NIP, address, email, phone

Operational data (entered by the User):

• Data of the bakery's customers (name, phone, email, address)
• Orders, products, ingredients, recipes
• Sales and purchase invoices (seller and buyer details, document line items)
• Data of the Organization's employees - if you use the Time tracking module (first and last name, record of hours, absences, payroll data, PIN code for clocking in and out)
• Financial and tax data - if you use the Finance module (takings broken down by VAT rate, cost summaries, tax estimates)
• HACCP data (temperature readings, forms)
• KSeF (Poland's National e-Invoicing System, Krajowy System e-Faktur) certificate and the related key - if you connect your account to KSeF. We store them only in encrypted form and use them solely to act on your behalf towards KSeF

Technical data (collected automatically):

• IP address
• Browser and device type
• Session time and duration
• Cookies (see the Cookie policy)

3a. Data obtained from public registers

Some data does not come from you. If you run a sole proprietorship in the bakery or pastry industry, we may have obtained your data as follows (Article 14 of the GDPR):

• Source: the Central Register and Information on Economic Activity (CEIDG, a Polish public register of businesses); the data is supplemented with information publicly available on Google Maps (Google Places), on OpenStreetMap and on the company's website.
• Categories of data: the entrepreneur's first and last name, company name, NIP, business address, type of business, phone number and email address given in those sources, website address and social media profiles.
• Purposes and basis: promoting the BakePilot service among businesses in the industry - the Controller's legitimate interest (Article 6(1)(f) of the GDPR), in two forms: (1) a database of businesses for our sales representatives, who may visit the business in person; (2) matching ad audiences on Meta services (Facebook, Instagram) - we pass on a list of contact details encrypted with the SHA-256 hash, Meta compares it with its users and deletes the list after matching. This is profiling for advertising purposes that does not produce legal effects concerning you.
• What we do not do: we do not send commercial information to these addresses by email and we do not make marketing phone calls without your consent.
• Recipients: BakePilot sales representatives (persons cooperating with the Controller), Meta Platforms Ireland Ltd. (with transfer to Meta Platforms, Inc. in the USA on the basis of the European Commission's adequacy decision - the EU-U.S. Data Privacy Framework - or standard contractual clauses) and the infrastructure providers listed in section 5 (Supabase, Vercel).
• Period: until you object or the business is closed (its entry is removed from CEIDG). At least once every 12 months we compare the database with CEIDG and delete the data of businesses whose entry has been removed.
• Your rights: you may object at any time (write to kontakt@bakepilot.pl) - we will then delete your data from this database and from the lists passed on to Meta. You also have the rights described in section 7, including the right to lodge a complaint with the President of the Polish Data Protection Authority (Prezes UODO).

4. Purposes of processing

• Providing the BakePilot service (account management, access to features)
• Handling payments and invoices
• Communication with the User (support, notifications)
• Direct marketing (with consent - newsletter)
• Analytics and improving the service
• Security and preventing abuse
• Fulfilling legal obligations (accounting)
• Establishing, pursuing and defending claims under the contract
• Handling notices of illegal content from the bakepilot.com/report-content form (the notifier's name or company name and email, the content of the notice) and informing the notifier and the author of the content about the decision

5. Recipients of data

Data may be shared with the following categories of recipients:

• Supabase Inc. - database hosting (servers in the European Union - Ireland, region eu-west-1)
• Vercel Inc. - application and website hosting (the functions of the app.bakepilot.pl application run in the Dublin, Ireland region)
• Stripe Payments Europe, Ltd. - accepting card payments and handling subscriptions
• Fakturownia sp. z o.o. - issuing subscription invoices and sending them to the National e-Invoicing System (KSeF) (buyer details given at payment)
• Resend Inc. - sending emails (transactional messages from the application and the website, and the newsletter); in transactional messages we do not measure opens or clicks (section 5a)
• Meta Platforms Ireland Ltd. - remarketing and advertising analytics: Meta Pixel and the Conversions API (an event after registration, purchase or form submission with SHA-256 hashes of the email address and phone number and Meta cookie identifiers) - only after consent to advertising cookies has been given; in addition, matching ad audiences (Custom Audience) on the basis of a list of SHA-256 hashes of contact details of bakery and pastry businesses obtained from the CEIDG public register
• Sentry (Functional Software Inc.) - monitoring of application errors
• Anthropic PBC - reading documents in the invoice price scanner module. The photo or file of the invoice you upload is sent for processing and reading of its line items. This applies only to documents you upload to this feature yourself
• Telegram Messenger Inc. - technical notifications sent to the BakePilot administrator about outages, payments and KSeF certificate renewals (information about the error and, for payments and certificates, also the organization name, plan and subscription identifier)
• CallMeBot (WhatsApp messages delivered by Meta) - notifications to the BakePilot administrator: about a new inquiry from a form (name, email, phone), a new registration (organization name, NIP, city), a new support ticket (subject, name and organization name of the person reporting), a new blog comment (name, email, excerpt of the content), a new notice of illegal content (type of content and violation, without the notifier's data), entry into the demo version (name, email) and - as a backup, when Telegram is not working - about a technical error (description of the error)
• Cloudflare, Inc. - protection against bots and spam (Cloudflare Turnstile) of the account registration form in the application (app.bakepilot.pl/register), the blog comment form, the illegal content notice form and the market research surveys (bakepilot.pl/badania). The IP address and technical data of the browser and device are processed, on the basis of the Controller's legitimate interest in protecting the service against automated account creation and abuse (Article 6(1)(f) of the GDPR)
• unpkg - interface files of the public API documentation (the browser's IP address when that page is opened)
• Ministry of Finance (KSeF) - sending sales invoices and downloading purchase invoices issued to your NIP, if you enable this feature
• Google Ireland Ltd. / Google LLC - website traffic analytics and measuring ad performance (Google Analytics 4, Tag Manager - only after consent to cookies has been given; after registration and purchase our server sends Google Analytics an event with the Google Analytics client identifier and the account identifier, only after consent to analytics cookies has been given) and delivering push notifications to the mobile application (Firebase Cloud Messaging - device identifier and notification content)
• OpenStreetMap Foundation - converting an address into coordinates when suggesting addresses and optimizing the delivery route (the Nominatim service). Only the address itself is sent, without the recipient's name or contact details

Data is not sold to third parties or transferred outside the EEA, except for the services listed above, which use standard contractual clauses (SCC) approved by the European Commission.

Former recipients of data (data was transferred until 19.10.2026):

• Easy.tools sp. z o.o. - handling subscriptions concluded before 21.09.2026 (payments and invoices issued on behalf of the Service Provider). From 20.10.2026 we do not transfer any data to this entity. Data transferred earlier, including invoices issued on behalf of the Service Provider, remains in its system for the retention period of accounting and tax records

5a. Measurement in email messages

In transactional messages (e.g. registration confirmation, password reset, invoice, data export, reply to a ticket) we do not include a tracking pixel or redirect links - we do not know whether the message was opened or which link was clicked. We record only information from the email provider about the delivery or rejection of the message, so as not to send it to a non-existent address (legitimate interest, Article 6(1)(f) of the GDPR). The rules for measurement in the newsletter are described in the Cookie policy.

6. Retention period

• Account data and organization data - until the account is deleted by the owner (in Settings) or at the owner's request. After the trial period or subscription ends, the account switches to restricted mode and the data remains available for download or deletion. From 2 November 2026, data of accounts in restricted mode is stored for 6 months (for accounts in that mode before 2 November 2026, the period runs from that day); after that time we delete the account and its data, giving notice by email 30 and 7 days in advance. Deleting an account takes effect immediately; deleted data may remain in database backups for up to 7 days
• Registration and billing data after the account is deleted (the owner's first and last name, email, phone, company name, NIP, address, contract dates, subscription and payment history) - until the limitation period for claims under the contract expires (Article 118 of the Polish Civil Code (Kodeks cywilny): 3 years for claims related to business activity, 6 years in other cases, at the end of the calendar year), counted from the end of the contract; basis: legitimate interest in establishing, pursuing and defending claims (Article 6(1)(f) of the GDPR)
• Full data export files - 24 hours from preparation, after which they are deleted
• Data obtained from public registers - as in section 3a
• Accounting data - until the limitation period for the tax liability expires (as a rule, 5 years from the end of the year in which the tax payment deadline passed); invoices sent to KSeF are stored there for 10 years from the end of the year of issue
• Marketing data - until consent is withdrawn
• Notices of illegal content and the register of moderation decisions - 3 years from the decision
• Technical logs - 90 days

7. User rights

Under the GDPR you have the following rights:

• Right of access - you may request a copy of your data
• Right to rectification - you may correct inaccurate data
• Right to erasure - you may request deletion of your data (the “right to be forgotten”)
• Right to restriction of processing
• Right to data portability - in the application, the account owner orders a full data export in Settings: a ZIP archive prepared overnight, with CSV files for each type of data, a combined XLSX workbook and invoices in the KSeF format (XML), available for 24 hours via a signed link sent by email; orders can also be downloaded straight away to a CSV file, and the lists in the modules to CSV/XLSX
• Right to object - to processing based on legitimate interest, on grounds relating to your particular situation, and to processing for direct marketing purposes (including profiling) - at any time and without giving reasons
• Right to withdraw consent - at any time

To exercise the above rights, write to: kontakt@bakepilot.pl. We will reply without undue delay, at the latest within one month; in complex cases the deadline may be extended by two months, and we will inform you of this.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO, the Polish Data Protection Authority), ul. Stawki 2, 00-193 Warszawa, Poland.

8. Data security

We use the following protection measures:

• Encryption in transit (TLS/SSL)
• Encryption at rest (AES-256)
• Row Level Security (RLS) - isolation of data between organizations
• Regular backups
• Role-based access control (RBAC)
• An optional administrator password locking modules with sensitive data (wages, costs, taxes) - useful when several people work on one account
• Monitoring of access and anomalies

9. Remote access by technical support

As part of handling technical support tickets, the Controller may obtain remote access to the data of the User's Organization in the Application. This concerns data such as: orders, products, recipes, ingredients, customers and organization settings.

Legal basis: access is an instruction of the Organization under the data processing agreement (Article 28 of the GDPR, Annex No. 1 to the Terms of Service), given separately for each ticket by clicking the “I consent to account access” button in the technical support widget; as regards the data of the User themselves - performance of a contract (Article 6(1)(b) of the GDPR).

Purpose of processing: diagnosing and fixing technical problems reported by the User.

Scope of access: viewing and editing the Organization's data to the extent necessary to resolve the ticket. All actions of the Controller are recorded in an event log (audit log).

Duration: an access session lasts a maximum of 24 hours and expires automatically. The User may withdraw consent at any time - withdrawal ends the session immediately.

Log retention period: the event log of the access session is stored for 12 months and then deleted.

10. Changes to the Policy

We reserve the right to update this Policy. We will notify you of significant changes by email 14 days in advance. The current version is always available at bakepilot.pl/polityka-prywatnosci.