Privacy policy

§1. Who the controller is

The controller of your personal data is MODELMATIC Sebastian Kuźmicz, a sole proprietorship registered in the Polish CEIDG register, based in Wrocław, Poland, address: ———, tax ID (NIP) ———, registry number (REGON) ———.

For anything concerning personal data, write to support@modelmatic.pl. We have not appointed a data protection officer — we are not required to, and correspondence is handled at the same address.

§2. What data we collect

Account data you provide on sign-up and in profile settings:

• e-mail address (it also serves as your login) and confirmation that it is valid,
• first and last name,
• organisation name, company size and tax ID — if you choose to provide them,
• how you use the platform and how you heard about us — optional fields,
• a bcrypt hash of your password (we never store passwords in plain text),
• an encrypted two-factor secret and recovery codes, if you enable 2FA.

§3. Technical data and the security log

For security-relevant events — sign-in, password change, permission grant, a rejected form submission — we record the IP address, browser information (User-Agent header), the type of event and its time.

A message sent through the contact form is stored in full: its content, the name, company and e-mail address you provide, plus the sender's IP address and browser details — so that repeated abuse can be recognised. All of it is deleted after 90 days.

Without this there is no way to detect a compromised account or answer the question „who changed this and when”. The log is cleared automatically after 90 days.

§4. Production data you enter into the applications

The data you enter into ModelFactory and ModelMES — line structure, routings, orders, operation records, data about the people working at the stations — belongs to you. In relation to it we act as a processor and you as the controller.

Every customer gets a separate, isolated instance with its own database. We do not combine data across customers, do not use it for our own analysis or to train anything, and do not share it with third parties.

If you enter your employees' data into the system, you are responsible for the legal basis for that processing and for informing them about it. On request we sign a data processing agreement.

§5. Why we process data and on what basis

Each purpose has its legal basis under Article 6 GDPR:

• providing the service and running your account — Art. 6(1)(b), performance of a contract,
• settlements, invoices and tax obligations — Art. 6(1)(c), legal obligation,
• platform security: the event log, submission limits, bot protection — Art. 6(1)(f), our legitimate interest in protecting the service and its users,
• replying to a message from the contact form — Art. 6(1)(f), conducting correspondence,
• establishing or defending legal claims — Art. 6(1)(f).

§6. How long we keep data

• account data — for as long as the account exists; once you delete it, we remove the data promptly,
• unconfirmed accounts (where the verification link was never clicked) — 7 days from sign-up,
• the security log — 90 days,
• accounting records — 5 years from the end of the tax year, as required by Polish tax law,
• data in backups — until the relevant backup expires under its rotation schedule,
• contact form messages — until the correspondence ends, no longer than 90 days; after that they are deleted automatically.

§7. Who else processes the data

We use providers without whom the platform could not run. Each of them processes data solely on our instructions:

• OVH SAS — servers and outgoing mail; infrastructure located in the European Union,
• Stripe Payments Europe, Ltd. — payment handling; we neither see nor store your card details, they go straight to Stripe,
• Cloudflare, Inc. — form protection against bots (the Turnstile mechanism), where enabled.

§8. Transfers outside the European Economic Area

We keep data on servers in the European Union. The exceptions are Stripe and Cloudflare, whose parent companies are based in the United States — those transfers rely on standard contractual clauses approved by the European Commission.

§9. Cookies

We use only cookies strictly necessary for the service: they hold your session after you sign in and protect forms against abuse. They do not require consent, because sign-in would not work without them.

We use no marketing or analytics cookies. We do not embed Google Analytics or any other tracking tool — the site carries no third-party scripts beyond the providers listed above.

§10. Your rights

You have the right to:

• access your data and receive a copy of it,
• have inaccurate data corrected,
• have your data erased („the right to be forgotten”),
• restrict processing,
• port your data to another controller,
• object to processing based on legitimate interest.

§11. Complaint to the supervisory authority

If you believe we process your data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland. We would appreciate it, though, if you wrote to us first — most matters can be settled straight away.

§12. Security

The connection to the site is encrypted (HTTPS). Passwords are stored only as bcrypt hashes. You can protect your account with two-factor authentication. Sign-in and public forms limit the number of attempts from one address. Access to production data is confined to the given customer's instance.

No system is entirely secure. If you spot a vulnerability, write to support@modelmatic.pl — we treat such reports as a priority.

§13. Is providing data mandatory

An e-mail address and your name are required to create an account — without them we cannot provide the service. The remaining fields are optional. Company details (name, tax ID) become required only when you purchase a paid plan, because they are needed to issue an invoice.

§14. Changes to this policy

We will notify you of material changes by e-mail sent to the address linked to your account, at least 14 days in advance. The date of the last update appears at the top of this page.