Privacy Policy

This privacy policy implements the information obligation under Article 13
of Regulation (EU) 2016/679 ("GDPR").

1. Data controller

The controller of your personal data is Marcel Kamiński, a sole trader
registered in CEIDG, tax ID (NIP) 5242917839, REGON 388675415,
address: ul. Mazowiecka 11 lokal 49, 00-052 Warszawa, Poland. Contact regarding
personal data: kontakt@nieruchomek.pl.

2. What data we process

• e-mail address — provided when ordering a report;
• property data — parcel identifier, address, coordinates, optional
  preferences and notes entered in the form;
• payment data — transaction identifiers, amount, status (payments are
  processed by PayPro S.A. / Przelewy24 as a separate controller — we do
  not store payment card data or bank login credentials);
• consent records — date of acceptance of the terms, document versions,
  IP address;
• technical data — server logs (IP address, request time) necessary to
  ensure security;
• visit statistics — number of visits, referring site, browser language and
  device type. We use no cookies for this and do not store your IP address:
  repeat visits are recognised through an irreversible hash derived from a random
  value that rotates daily and is never retained. The hash cannot be tied to an
  identifiable person or matched across days, and the resulting statistics are
  aggregate only;
• public land-register content — if you provide a KW number, we fetch the
  register content (including owner data from section II) from the public
  land-and-mortgage register via an external provider; we process it solely to
  prepare your report and remove it during anonymisation after the retention
  period;
• listing URL and listing content — if you paste a link to a sales listing,
  we fetch the publicly visible offer data from that page: title, price, area,
  attributes, the description written by the seller, and up to 15 photos
  (where the listing has more, you choose which ones we analyse). We fetch only
  the page you name, whether on a well-known portal or any other site; in the
  latter case we identify ourselves as Nieruchomek/1.0 and honour that site's
  robots.txt. Phone numbers and e-mail addresses found in the description are
  masked automatically before storage (a heuristic — we cannot guarantee it
  catches every form); we do not store the seller's name or contact details.
  Photos fetched from the listing are held in memory for the duration of the
  analysis and are never written to disk; the report contains neither the
  photos nor the full listing text, only commentary on them. The link and the
  fetched content are removed during anonymisation (section 5);
• listing text and photos you enter yourself — if you type the listing in
  instead of pasting a link, you may also upload up to 30 photos (up to 15,
  chosen by you, are analysed). Unlike photos fetched from a listing, these
  files are stored on our server, because we must keep them between your
  order and the generated report. Each upload is re-encoded on arrival, which
  strips EXIF metadata including the GPS coordinates phones record. The
  files and the text you typed are removed during anonymisation (section 5);
• listing preview before ordering — when you paste a link on the map or in
  the form, we fetch the offer's title, price, area and location to position the
  map and prefill the form. This happens at your request, prior to entering into
  the contract (Art. 6(1)(b) GDPR); the result is kept for up to 24 hours in
  the server cache, keyed by the listing URL rather than by you.

Providing your e-mail address is voluntary but necessary to perform the
service (deliver the report).

3. Purposes and legal bases

• performance of the contract — generating and delivering the report,
  handling payments and refunds, order-related communication (Art. 6(1)(b)
  GDPR);
• legal obligations — tax and accounting settlements (Art. 6(1)(c)
  GDPR);
• legitimate interest — service security, technical logs, establishing
  and defending against claims, proof of given consents (Art. 6(1)(f) GDPR).

4. Recipients of data

We entrust or disclose data only to the extent necessary to perform the
service:

• Google Cloud (Google Ireland Limited / Google LLC) — server
  infrastructure and backups; the servers run in the europe-west1 (Belgium)
  region and backups in the EU location, i.e. within the European Economic
  Area;
• Anthropic PBC (USA) — provider of the artificial-intelligence models. We
  send the model property-related data and content gathered from registers and
  the internet, and — if you provided a listing link — also the offer
  description and the downloaded photos (image analysis). The model also uses
  the provider's built-in web search, which means queries containing the
  address or location of the property are passed to it. We do not send
  your e-mail address. Transfers to the USA are based on standard
  contractual clauses (Art. 46(2)(c) GDPR) concluded in the data processing
  agreement;
• Tavily, Inc. (USA) — searching official and local pages for research
  purposes; we pass only the query text (municipality name, address, parcel
  number), never data identifying you. If the service is not configured or does
  not respond, queries go to DuckDuckGo (Duck Duck Go, Inc., USA) as a
  fallback. Transfers to the USA are based on standard contractual clauses;
• PayPro SA (Przelewy24), ul. Pastelowa 8, 60-198 Poznań, Poland,
  KRS 0000347935 — payment processing; PayPro is a separate controller of
  your data in the scope of payment execution;
• Apify Technologies s.r.o. (Czechia) — retrieval of public
  land-and-mortgage register content, only when you provide a KW number
  yourself;
• home.pl S.A. (Poland) — outgoing mail service; the provider receives your
  e-mail address and the message content including the attached report.

A current list of our processors is available on request at
kontakt@nieruchomek.pl.

We do not sell personal data and do not share it for third-party marketing
purposes.

Content loaded from third-party CDNs

The website loads some styling libraries and the map directly from third-party
servers: cdn.tailwindcss.com and unpkg.com (CDNs operated in the USA)
and map tiles from tile.openstreetmap.org (OpenStreetMap Foundation, United
Kingdom). When a page is displayed, your IP address and browser information
reach those parties — a technical consequence of fetching a file, not
profiling: we place no cookies or marketing identifiers there and receive no
data about you from those requests.

5. Retention periods

• report data (e-mail address, property data, report content, PDF file) —
  the report is available online for 365 days from the order, and we keep
  the data for a further 730 days after that, because of the limitation
  period for claims — roughly 3 years in total. After that an automated job
  anonymises the report: it removes the e-mail address, your notes and the
  PDF file, deletes the entire AI analysis layer, the public land-register
  content and the listing content, the KW number and the listing URL, the
  open-internet research results, the IP address recorded with your consents,
  and also the raw source responses and the records of prompts sent to the AI
  models. What remains is an anonymous entry with dates, the versions of the
  accepted documents and settlement data;
• listing preview (before ordering) — up to 24 hours in the server
  cache;
• payment settlement data — for the period required by tax and accounting
  regulations (as a rule, 5 years from the end of the tax year);
• technical logs — short-term, for security purposes.

6. Your rights

You have the right to: access your data, rectify it, erase it, restrict
processing, data portability, and to object to processing based on
legitimate interest. Requests are handled at kontakt@nieruchomek.pl. You also
have the right to lodge a complaint with the President of the Polish Personal
Data Protection Office (uodo.gov.pl).

7. Automated decision-making

The report is generated automatically; however, we do not make decisions
about you that produce legal effects based solely on automated processing,
including profiling.

8. Cookies

The service uses only technically necessary cookies: session cookies,
CSRF cookies (form security) and the language preference. We do not use
third-party marketing or analytics cookies — which is why the service does
not display a cookie-consent banner.

Separately from cookies, your IP address is transferred to the CDNs described
in section 4 whenever a page is loaded.

9. Changes to this policy

We may update this policy (e.g. when providers change). The current version
is always available on the website together with the date of the last
update.