Privacy Policy
Last updated: October 9, 2026
The short version
- We collect what we need to run RaportON: your account, your company profile and the reports you create.
- We don't sell or share your personal information, and we don't use advertising or tracking cookies.
- Your data is stored with our providers in the United States.
- You can access, export or delete your data at any time by emailing support@raporton.com.
1. Who we are
This Privacy Policy explains how RaportON (“we”, “us”) handles personal information when you visit raporton.com or use the RaportON web app (together, the “Service”).
RaportON is operated by akApp Studio (akappstudio.pl), the trade name of Andrzej Król, an individual running an unregistered business activity in Tylicz, Poland, email support@raporton.com. For the information described in Section 2 - except the information about your customers that you put into reports (see Section 5) - we are the “controller” under the EU General Data Protection Regulation (GDPR) and the business responsible for it under U.S. state privacy laws. Because we are established in the European Union, we apply the GDPR to all users, wherever they live.
2. Information we collect
Information you give us
- Account: your email address and password. Passwords are stored by our authentication provider only in hashed form; we can't see them. If you use Sign in with Google, we receive your name, email address and profile picture link from Google.
- Company profile: company name, address, phone, license number, logo and any other fields you add. This appears in the header of your PDFs.
- Your content: templates, drafts and reports, including the information about your customers, readings, notes, photos and signatures you enter. We handle customer information on your behalf (see Section 5).
- Communications: when you email us or use our contact form - your name (optional), email address, topic and message.
Information created when you use the Service
- Subscription: your plan, its status, billing period dates and Stripe identifiers. Card details are collected and processed by Stripe; we never receive your full card number.
- Consents and settings: when you accepted the Terms and this Policy, whether you opted in to marketing emails, and your app preferences.
- Usage counters: how many reports you generate each month.
- Technical data: IP address, browser and device type, operating system, time of requests and error logs, recorded by our hosting providers when you use the Service.
- Data on your device: the app keeps your sign-in session, unfinished drafts, cached templates and preferences in your browser's local storage, and caches app files so it loads faster.
3. How we use information and our legal bases
We use personal information only for the purposes below. The second column shows the legal basis under the GDPR.
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the Service: your account, generating PDFs, storing reports and templates, showing reminders | Contract - Art. 6(1)(b) |
| Processing payments and managing subscriptions | Contract - Art. 6(1)(b) |
| Service emails: sign-up confirmation, password resets, receipts, notices about changes to the Service, the Terms or this Policy | Contract - Art. 6(1)(b); legitimate interests - Art. 6(1)(f) |
| Customer support and answering your messages | Contract - Art. 6(1)(b); legitimate interests - Art. 6(1)(f) |
| Keeping the Service secure, preventing abuse and fixing errors | Legitimate interests - Art. 6(1)(f) |
| Occasionally asking for feedback about the Service (never advertising) | Legitimate interests - Art. 6(1)(f); you can object at any time |
| News and offers about RaportON - only if you opted in | Consent - Art. 6(1)(a); you can withdraw it at any time |
| Meeting tax, accounting and other legal obligations | Legal obligation - Art. 6(1)(c) |
| Establishing, exercising or defending legal claims | Legitimate interests - Art. 6(1)(f) |
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects, and we don't build advertising profiles.
4. How we share information
We don't sell your personal information, and we don't share it for cross-context behavioral (targeted) advertising. We share it only as follows:
- Service providers (sub-processors) that process data for us under contracts:
- Supabase, Inc. - database, authentication and file storage. Your data is stored in the United States (US East, Virginia).
- Vercel, Inc. - hosting of the website and app, content delivery network and server functions (United States and a global edge network).
- Stripe (Stripe, Inc. and its affiliates) - payment processing and subscription billing. Stripe also acts as an independent controller for some payment data under its own privacy policy.
- Google LLC - Sign in with Google (if you use it), web fonts on our public pages, and email hosting for our support mailbox.
- Web3Forms - delivery of messages sent through our contact form.
- Our transactional email provider - sending account emails such as sign-up confirmations and password resets.
- Your browser's speech service. If you use voice dictation, your browser's built-in speech recognition (for example Google in Chrome or Apple in Safari) processes your voice under the browser maker's privacy terms. We receive only the resulting text.
- People you choose. When you send a PDF or share a template link, the information goes to the recipients and apps you pick.
- Legal and safety reasons. If required by law, a court order or a lawful request by public authorities, or if necessary to protect our rights, our users or others.
- Business transfers. In connection with a reorganization, merger, sale of assets or transfer of the Service to a company set up to operate it. The recipient will be bound by this Policy.
5. Information about your customers
When you enter information about your customers or other people into the Service, you decide what to collect and why: you are the controller (or “business”), and we act as your processor (or “service provider”). We process that information only to provide the Service to you, under the data processing terms in Section 7 of our Terms of Service. We don't use it for our own purposes, and we don't sell or share it. If one of your customers contacts us about their information, we will refer them to you. You are responsible for giving your customers any notices the law requires and for having a lawful basis to collect and share their information.
6. International transfers
We are based in Poland, and our providers store your data in the United States. Where the GDPR or UK GDPR applies to a transfer of personal data outside the European Economic Area or the UK, we rely on the European Commission's Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework (and its UK extension) where the recipient is certified under it.
7. How long we keep information
- Account, profile, templates and reports: while your account is active. Content you delete is removed from our active systems; when you delete your account, we delete your data within 30 days.
- Backups: overwritten on a rolling basis, typically within 30 days.
- Payment and billing records: as long as tax and accounting laws require (up to 5 years after the end of the tax year).
- Consent records and correspondence: as long as needed to handle your request and show that we acted properly, generally up to 3 years after our last contact.
- Technical logs: kept by our providers for short periods, generally no longer than 90 days.
- Data on your device: until you sign out, clear your browser data or delete it.
We may keep information longer where the law requires it or to establish, exercise or defend legal claims.
8. Security
We use technical and organizational measures to protect your information, including encryption in transit (HTTPS/TLS), encryption at rest by our hosting provider, hashed passwords, row-level security so that each account can reach only its own data, and limited internal access. No system is completely secure, so please use a strong password and protect your devices. If a data breach affects your personal information, we will notify you and the authorities as the law requires.
9. Your rights and choices
- Everyone. Wherever you live, you can ask us to give you access to your personal information and a copy of it (also in a portable format), correct it, delete it, or restrict or object to certain processing (including feedback requests). You can withdraw your consent to marketing emails at any time with the unsubscribe link or by emailing us. Withdrawing consent doesn't affect processing that happened before.
- How to make a request. Email support@raporton.com from the email address on your account. We may need to verify your identity. We'll respond within one month; for complex requests we may extend this by up to two months and will tell you if we do.
- EEA and UK users. You have the right to lodge a complaint with a supervisory authority - in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) - or with the authority where you live or work.
- U.S. state privacy rights. Residents of California and other states with consumer privacy laws may have the right to know, access, correct and delete their personal information and to opt out of its sale, of sharing for targeted advertising, and of certain profiling. We don't sell or share personal information, don't use it for targeted advertising, and don't use sensitive personal information to infer characteristics about you. You can exercise your rights as described above, including through an authorized agent, and we won't discriminate against you for doing so. If we decline your request, you can appeal by replying to our decision; if we deny the appeal, you may contact your state attorney general. We treat Global Privacy Control signals as a request to opt out of sale and sharing. We don't respond to “Do Not Track” signals because we don't track you across websites. California “Shine the Light”: we don't share personal information with third parties for their own direct marketing.
10. Cookies and similar technologies
We don't use advertising or analytics cookies or third-party trackers. The app uses your browser's local storage and a service worker for essential functions: keeping you signed in, saving drafts and settings, and loading faster. Our public pages remember whether you dismissed the cookie notice. The fonts on our public pages are loaded from Google Fonts, so your browser connects to Google's servers, which receive your IP address. You can clear stored data in your browser settings at any time, but the app may not work properly without it.
11. Children
The Service is for businesses and people aged 18 and over. We don't knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.
12. Changes to this Policy
We may update this Policy. We'll post the new version on this page with a new “Last updated” date and, for material changes, notify you by email or in the app before they take effect.
13. Contact
Questions or requests about your privacy:
RaportON - akApp Studio (Andrzej Król)
Tylicz, Poland · akappstudio.pl
Email: support@raporton.com