Privacy policy

Scope and controller

Ryiako Mykola is the controller of online account data and correspondence. Contact details appear below. This policy covers the website, account, licensing and support.

The catalogue, stock, staff records and warehouse history are held on your local server. An online account is not a warehouse backup. The business using the app is responsible for personal data in its own database. Do not send us a database in a support request without prior agreement.

Data and purposes

An account requires an email address. We store account and organisation identifiers, the organisation name you provide, plan, licence status, assigned server details and last connection. This supports account creation and service delivery (GDPR Article 6(1)(b)).

For security we process code and token hashes, an IP address hash, attempt counts, expiry times and browser/session information. A hashed IP is not anonymous. The basis is our legitimate interest in preventing misuse (Article 6(1)(f)). We also record the Terms version accepted during registration on the website or in the app, language and acceptance time.

We handle support messages to resolve your request. Payment records are processed when you pay, including to meet legal obligations (Article 6(1)(c)). Providing account data is voluntary, but we cannot create an account without your email. We do not automatically subscribe you to marketing or carry out advertising profiling.

Providers and international processing

The website and account database use Sites / Cloudflare infrastructure. Resend delivers codes and withdrawal acknowledgements. We retain the statement, name, account email, contract reference, receipt time and copy delivery status to handle the withdrawal and document receipt. Stripe handles payments when you use a paid plan; card entry takes place on Stripe, while CountTrace stores billing identifiers and status, not your full card number.

Providers may process data outside the EEA. Their terms, subprocessors and transfer mechanisms are described in the provider documents linked below. You can request information about safeguards applicable to your data. We do not sell personal data.

Retention

Account and licence data are kept while your account is maintained. After closure, we retain only what is necessary for legal obligations or establishing, exercising or defending claims. When handling a request, we explain any retained records and their basis.

A login code is valid for 10 minutes. Code records older than 7 days and sessions that expired more than 7 days ago are removed in batches during subsequent authentication activity. With no activity, they await the next cleanup. A login session lasts up to 30 days. Correspondence is kept until the matter is resolved, and longer only for legal duties or claims. Provider backups and logs also follow their retention arrangements.

Your rights

Where applicable, you can request access, a copy, correction, erasure, restriction or portability and object to processing based on legitimate interests. Where consent is the basis, you can withdraw it without affecting earlier lawful processing.

Use the data request page or email below. We reply without undue delay, normally within one month; we explain any justified extension within that month. You may complain to the Polish supervisory authority (UODO) or the competent authority in your country. CountTrace is not directed at children; we do not require a date of birth to create an account.