Legal & Info

PRIVACY POLICY

Last updated: June 10, 2026

At GoPublica, we are committed to protecting the privacy and security of your personal data. This Privacy Policy describes how we collect, use, store, and share personal data in connection with our SaaS platform, in compliance with the General Data Protection Regulation (GDPR) and applicable Polish law.

1. DATA CONTROLLER

The controller of your personal data is:

GoPublica Andrii Knapp NIP: 6772525332 Republic of Poland E-mail: support@gopublica.com

If you have any questions regarding data protection, please contact us at the above email address.

2. ROLES IN DATA PROCESSING (GDPR)

GoPublica as Controller: We are the controller of personal data of our registered Business Clients (you), including your name, email address, company information, billing details, and IP address. We collect this data to provide you with platform access, process subscription payments, and deliver technical support.

GoPublica as Data Processor: When your end customers (e.g., restaurant guests, salon clients) submit booking information through your widget or GoPublica-powered page, you act as the Controller of their personal data. GoPublica acts solely as a Data Processor, storing and processing this data strictly on your behalf and in accordance with your instructions. You bear full responsibility as Controller for ensuring a legal basis for processing your customers' data and for fulfilling all GDPR obligations towards them.

3. WHAT DATA WE COLLECT

Data you provide directly:

  • Name, surname, and company name
  • Email address
  • NIP (tax identification number)
  • Payment card data (processed and stored exclusively by Stripe — we do not store raw card data)
  • Company address and contact details

Data collected automatically:

  • IP address and browser/device information
  • Usage data and activity logs in the Admin Panel
  • Cookie identifiers and session tokens

Your end customers' data (processed on your behalf):

  • Name, surname, phone numbers, and email addresses submitted through booking forms
  • Booking details (date, time, service, number of guests)
  • Any additional fields configured by you in the widget

4. LEGAL BASIS FOR PROCESSING

We process personal data on the following legal bases in accordance with Art. 6 GDPR:

  • Art. 6(1)(b) — Performance of a contract: Processing of account data, billing information, and usage data to provide the platform.
  • Art. 6(1)(c) — Legal obligation: Retaining invoices and transaction records in accordance with Polish tax and accounting law.
  • Art. 6(1)(f) — Legitimate interest: Monitoring platform security, preventing fraud, and improving platform performance.
  • Art. 6(1)(a) — Consent: First-party analytics (pseudonymized visitor statistics) — only after you have given your consent via the cookie banner.

5. DATA RETENTION AND INFRASTRUCTURE

5.1. Our main server infrastructure (backend) is hosted at Hetzner (Germany, European Union). 5.2. All databases are managed by MongoDB Atlas, in data centers operated by Amazon Web Services (AWS) located in Frankfurt, Germany, ensuring data remains within the European Union. 5.3. Client pages and widgets are deployed through Vercel. GoPublica relies on Vercel's compliance with Standard Contractual Clauses (SCC) approved by the European Commission.

6. EXTERNAL DATA PROCESSORS (SUB-PROCESSORS)

To operate the platform, we share limited data with the following entities:

  • Stripe, Inc. — Payment processing (EU / USA)
  • Furgonetka Sp. z o.o. — Parcel delivery and locker selection (data: recipient name, phone, email, delivery address). Browser-side map widget also exposes visitor IP to Furgonetka.
  • Telegram FZ-LLC — Order, reservation, and job-application notifications sent to tenant-configured Telegram bots (data: customer name, phone, booking details). Also used for admin lead notifications.
  • Cloudinary, Inc. — Media hosting for menu photos, gallery images, and news articles (browser-side upload widget).
  • Google LLC — Maps embeds for location display (browser-side iframes expose visitor IP to Google).
  • Vercel, Inc. — Frontend hosting and anonymized Web Analytics (EU / USA)
  • MongoDB Atlas (AWS) — Database storage (Frankfurt, Germany, EU)
  • Hetzner Online GmbH — Server infrastructure (Germany, EU)
  • Kilo Code Inc. — AI assistant model gateway (text you enter into the admin AI assistant or AI content tools is sent for processing; personal data such as e-mail addresses or phone numbers is automatically masked before transmission). AI assistant is used by tenant administrators only.
  • OpenRouter, Inc. — AI model gateway (fallback provider, same masking as above).

We do not sell your or your customers' data to any third parties.

7. INTERNATIONAL DATA TRANSFERS

When transferring data outside the European Economic Area (e.g., to the USA), GoPublica ensures appropriate safeguards, in particular Standard Contractual Clauses (SCC) approved by the European Commission in accordance with Art. 46(2)(c) GDPR.

| Recipient | Country | Safeguard | |---|---|---| | Stripe, Inc. | USA | EU-US Data Privacy Framework + SCC | | Telegram FZ-LLC | UAE | SCC (EU-approved Module 2) | | Cloudinary, Inc. | USA | SCC + Cloudinary DPA | | Vercel, Inc. | USA | EU-US Data Privacy Framework | | Google LLC (Maps) | USA | EU-US Data Privacy Framework | | Kilo Code Inc. | USA | SCC (Art. 46(2)(c) GDPR) — personal data is masked before transfer | | OpenRouter, Inc. | USA | SCC (Art. 46(2)(c) GDPR) — personal data is masked before transfer |

All database storage (MongoDB Atlas) and server infrastructure (Hetzner) remain within the EU (Frankfurt, Germany).

8. DATA RETENTION

Business Client account data: We retain your data for the duration of your active subscription. After account cancellation, data is retained for 60 days (to allow for potential reactivation) and then permanently deleted from our systems, unless law (e.g., accounting regulations) requires longer retention.

| Data category | Retention period | Legal basis | |---|---|---| | Account data (name, email, phone, company) | Duration of subscription + 60 days | Art. 6(1)(b) | | Consent records (IP, timestamp, version) | 3 years from grant | Art. 6(1)(f) — proof of consent | | Orders & invoices | 5 years (Polish tax/accounting law) | Art. 6(1)(c) | | Demo requests | 1 year from submission | Art. 6(1)(f) — lead management | | Visitor analytics (pseudonymized) | 14 months (daily rotation) | Art. 6(1)(a) — consent | | CV files (job applications) | 6 months from decision | Art. 6(1)(a) — consent | | Cookie consent choice | 1 year | ePrivacy Directive |

End customer booking data: Retained in accordance with your configuration. After account deletion, this data is removed along with your data within the same 60-day window.

9. YOUR GDPR RIGHTS

You have the right to access, rectify, erase ("right to be forgotten"), restrict processing, data portability, object, and withdraw consent. To exercise these rights, write to support@gopublica.com. We will respond within 30 days (Art. 12(3) GDPR).

You also have the right to lodge a complaint with the President of the Office for Personal Data Protection (UODO), ul. Stawki 2, 00-193 Warszawa, Poland.

Withdrawal of consent: You may withdraw your marketing consent at any time by contacting us at support@gopublica.com or through your account settings. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal (Art. 7(3) GDPR).

9a. AUTOMATED DECISION-MAKING

We do not engage in automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).

We use essential cookies for login session management and branch selection (which cannot be disabled) and first-party analytics cookies — only after you have given your consent via the cookie banner. Third-party map and media widgets (Google Maps, Furgonetka parcel locker map, Cloudinary) may set their own cookies when loaded.

11. SECURITY

We implement industry-standard security measures (HTTPS/TLS encryption, access controls) to protect data against unauthorized access or loss.

12. POLICY CHANGES

We reserve the right to update this Policy. We will notify you of material changes at least 14 days in advance.