sugello
/

Privacy Policy

Translation notice. This is an English translation of the Polish-language Polityka Prywatności (Privacy Policy), provided for convenience only. The original Polish version is the legally binding document; in the event of any discrepancy between the two, the Polish version shall prevail. This Privacy Policy is governed by Polish law and the GDPR, regardless of the language in which it is read.

Privacy Policy of the Sugello Platform

effective as of 24 July 2026

Dear User,

We make every effort to ensure the security and confidentiality of your personal data. We care about your privacy both when you visit our website, register an account, and use our services, and when you contact us by e-mail. We act in accordance with the law, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the "GDPR").

In this document, we want to present you with the most important information about the processing of your personal data. For simplicity, we have organized it in a Q&A format. All so that you know for what purpose, on what legal basis, and for how long we process your data, as well as who may have access to it and what rights you have. The rules for using the Platform are set out separately in the Terms of Service available on the Platform.

How do we obtain your personal data?

By using the sugello.com website (hereinafter: the "Platform") you may be asked to provide your personal data. Providing data is voluntary, but in certain situations it may be necessary. For example, without providing an e-mail address, we will not register your User Account, nor will we send you a Sign-in Link enabling you to sign in to the Platform. If, as a visitor, you respond to a Board via a Widget or its public page, providing your name and e-mail address is optional.

Some data is collected automatically during your visit to the Platform (e.g. IP address, browser type, data stored in cookies). It is used, among other things, to maintain your sign-in session, remember your chosen language for the Platform, and protect against abuse and spam.

Who is the Controller of your personal data?

The Controller of your personal data is Braket Kamil Doroszewicz, with its registered office at ul. Głogowska 31/33, 60-702 Poznań, Poland, NIP (Tax ID): 5372654060, REGON (Business Registry No.): 386676072, registered with the Central Registration and Information on Business (CEIDG).

If you have any questions or concerns, you can contact us electronically at the following e-mail address: hello@sugello.com.

For what purpose, on what legal basis, and for how long do we process your data?

We process your personal data for the purpose of:

  1. concluding and performing the agreement for the provision of services (registering and maintaining a User Account, creating a Board, using the free or paid tier of the Services):

    • the legal basis is the necessity of processing for the performance of the agreement or to take steps at the request of the data subject prior to entering into an agreement (Art. 6(1)(b) GDPR),
    • the data will be processed until the Service ceases to be provided (closure of the User Account, termination of the agreement for the provision of services);

  2. fulfilling our obligations regarding the protection of personal data:

    • the legal basis is our legal obligation (Art. 6(1)(c) GDPR),
    • the data will be processed until the expiry of the limitation periods for claims arising from a breach of personal data protection provisions;

  3. establishing, pursuing, and defending potential claims:

    • the legal basis is our legitimate interest (Art. 6(1)(f) GDPR), which we have in taking action to protect our rights in proceedings before courts and other state authorities,
    • the data will be processed until the expiry of the limitation periods for claims arising under applicable law;

  4. ensuring the proper functioning of the Platform and protection against abuse and spam (including through browser fingerprinting, IP address, the Cloudflare Turnstile CAPTCHA mechanism, and loading Google Fonts, used to ensure one vote per person and to limit the number of Submissions from a single IP address):

    • the legal basis is our legitimate interest (Art. 6(1)(f) GDPR), which we have in ensuring the proper and secure operation of the Platform and in counteracting abuse,
    • the data will be processed until an effective objection is raised or the purpose of processing is achieved;

  5. responding to your questions sent to us electronically to hello@sugello.com:

    • the legal basis is our legitimate interest (Art. 6(1)(f) GDPR), which we have in communicating with our customers and responding to questions from our prospective customers or other persons interested in our products and services,
    • the data will be processed until the expiry of the limitation periods for claims arising under applicable law;

  6. marketing purposes (informing you about news and changes on the Platform):

    • the legal basis is your voluntary consent (Art. 6(1)(a) GDPR), given separately from acceptance of the Terms of Service,
    • the data will be processed until consent is withdrawn (withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal); you may withdraw your consent at any time, e.g. by clicking the unsubscribe link in a message you receive.

REMEMBER! We process personal data for as long as necessary to achieve the purposes indicated above, unless you submit a valid and proper request for the deletion of your personal data. In addition, the processing period may depend on the applicable provisions of law, e.g. in the case of limitation periods for pursuing claims.

Who may be the recipient of your personal data?

In certain situations, if it proves necessary to achieve the purposes of processing, we make use of the support and assistance of external entities. In each case, however, before transferring personal data, we require their recipients to guarantee appropriate protection and confidentiality of that data.

Recipients of your personal data may include:

  • Polar Software, Inc. (Polar.sh) – the entity handling payments for Paid Services as Merchant of Record; it receives your e-mail address, User identifier, and IP address (used to determine the correct billing currency),
  • Resend – the provider of our e-mail delivery service (Sign-in Link, account-deletion confirmation),
  • Cloudflare, Inc. – the provider of the Platform's hosting infrastructure, as well as the CAPTCHA mechanism (Cloudflare Turnstile) and request rate limiting,
  • Neon – our database provider, on which the Platform's data is stored (servers located in the European Union),
  • Google LLC – the provider of fonts (Google Fonts) loaded on the Platform,
  • authorized state authorities, pursuant to applicable law,
  • other entities whose request for data disclosure is justified under applicable law.

Do we transfer personal data to third countries?

As a rule, we try to limit the transfer of personal data outside the European Union and the European Economic Area (EEA). The Platform's database (Neon) is stored on servers located in the European Union.

However, we use services and technologies offered by entities based in the United States: Polar Software, Inc., Resend, and Cloudflare, Inc., as well as Google LLC (in connection with the Google Fonts loaded on the Platform). Under the GDPR, these are so-called entities located in third countries, in respect of which an appropriate level of protection, or a reference to appropriate safeguards, must be demonstrated.

We ensure that the transfer of data to the above entities takes place in accordance with the GDPR:

  • Resend, Cloudflare, Inc., and Google LLC hold current certification under the EU-U.S. Data Privacy Framework (DPF), pursuant to the European Commission's adequacy decision of 10 July 2023 finding an adequate level of protection for personal data (Art. 45 GDPR),
  • Polar Software, Inc. bases its data transfers on the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR).

More information on the data-processing practices of the above entities can be found on the respective providers' websites.

Do we profile your personal data?

No. We do not carry out profiling of your personal data, nor do we make any automated decisions about you that could produce legal effects or similarly significantly affect you.

Do we use so-called cookies?

On the Platform we use so-called cookies, i.e. short text files stored on your device, solely to the extent necessary for the proper functioning of the Platform:

  • session cookie – enabling your sign-in session to your User Account to be maintained,
  • language-preference cookie – remembering the language version of the Platform you have selected.

We do not use analytics cookies, marketing cookies, or third-party tracking cookies for tracking or profiling purposes. Because the cookies we use are exclusively necessary (technical) in nature, their installation does not require your consent.

You may nevertheless block or restrict the installation of cookies using your browser settings. Please note, however, that blocking necessary cookies may prevent you from signing in to the Platform or may cause your language selection not to be remembered between visits.

How do we protect your data?

To ensure a high and consistent level of protection, we apply security measures for our IT environment appropriate to the processing involved, including, among others:

  • encryption of connections using the TLS protocol,
  • automatic database backups,
  • network-attack protection mechanisms (e.g. against DDoS) arising from Cloudflare's infrastructure,
  • no storage of User passwords – signing in to the Platform is done exclusively via a one-time Sign-in Link sent to your e-mail address,
  • access to personal data restricted solely to the Controller of the Platform.

What rights do the people whose data we process have?

Persons whose data we process have the right to:

  • access their personal data;
  • rectify their personal data;
  • erase their personal data;
  • restrict the processing of their personal data;
  • object to the processing of their personal data;
  • data portability;
  • withdraw consent to the processing of their data (where processing is based on consent).

The rights listed above are not absolute, however, and in certain situations, after conducting an assessment, we may lawfully refuse to comply with them.

We also inform you that withdrawing consent to processing will not affect the lawfulness of processing carried out on the basis of consent given before its withdrawal.

If you submit a request to us to exercise any of the above rights, we will respond to it promptly, but no later than within one month of receipt. If, due to the complex nature of the request or the number of requests, we are unable to fulfil your request within one month, we will fulfil it within a further two months. We will, however, inform you in advance of the intended extension of the deadline.

How can you report irregularities in the processing of personal data?

If you believe that your personal data is being processed by us in a manner inconsistent with applicable law, you may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

Does using the Platform involve sending logs to the server?

Using the Platform involves sending requests to the server on which the website is hosted. Every request made to the server is recorded in the server logs and stored on the server. The logs include, among other things, the IP address, the server's date and time, and information about the web browser and operating system.

Data recorded in the server logs is not associated with specific individuals using the website and is not used by us to identify you.

Server logs are used solely as auxiliary material for administering the website, and their content is not disclosed to anyone other than persons authorized to administer the server.

Can we change our Privacy Policy?

Yes. The protection of personal data is an ongoing process that we adapt to current needs and evolving technology. For this reason, our Privacy Policy may be supplemented or amended, of which we will inform you by posting a notice on the Platform, and in the case of material changes, we will send a separate notification electronically to registered Users.