Privacy policy

The data controller is Kodemia Paweł Skuza, Polish tax ID (NIP) 5732478560, al. Najświętszej Marii Panny 48/11, 42-217 Częstochowa, Poland. Privacy enquiries may be sent to office@kodemia.biz.

• data entered in the contact form: name, organisation, work email, optional phone number, organisation type and message;
• confirmation that the notice concerning the prototype has been accepted;
• technical data needed to operate and secure the website, such as IP address, request time, browser information and server logs.

The website must not be used to submit real case materials, court documents, professional secrets or special-category personal data. Please do not include such information in the contact form.

When an invited user chooses to connect Google, Dowodownik processes only the Google data needed for the connection and acquisition workflow selected by that user.

• Google account identity: stable account identifier, email address and email-verification status used to authenticate the invited user and bind each connection to the correct account;
• Gmail preview: bounded message identifiers, labels and headers such as date, sender, recipients, subject and Message-ID, without message body or attachments;
• Gmail acquisition: the complete read-only representation of an individually selected message, including MIME content and attachments, only after the user explicitly approves that exact candidate;
• Google Drive preview: file and folder identifiers, names, MIME types, parents, drive identifier, size, checksum, version and capabilities under the folder selected by the user;
• Google Drive acquisition: bytes of an individually selected source file, only after exact approval;
• client repository: a separate Google Drive connection used to create and verify files used with Dowodownik in the destination folder selected by the user.

• to verify the invited user's identity and maintain a secure session;
• to display a bounded metadata preview from the selected Gmail query or Drive folder;
• to freeze an exact candidate snapshot and record the user's explicit approval;
• to retrieve only the approved message or file and calculate cryptographic checksums;
• to transfer the approved bytes and deterministic manifests to the client-controlled repository selected by the user;
• to verify the resulting copy by readback where the selected repository supports it;
• to disconnect a Google connection and revoke further application access at the user's request.

Dowodownik does not use Google user data for advertising, profiling, credit decisions, sale to data brokers, or training general-purpose artificial intelligence models. Automated models are not a source of evidential content and do not write verbatim evidence.

OAuth access and refresh tokens are encrypted at rest in Azure Key Vault and are not placed in browser local storage, application documentation or telemetry. Connections for Gmail, source Drive and repository Drive are separated and bound to the relevant user and client context.

Azure acts as a transfer processor and keeps only the minimum operational state and temporary staging required for the workflow. Approved canonical materials are written to the local or Google Drive repository selected and controlled by the client. The client, not Dowodownik or Azure, controls retention, backup, availability and custody of that repository.

Google user data is not sold. It is disclosed only as necessary to provide or secure the requested service: to Microsoft Azure as the hosting, encrypted-secret and transfer-processing provider; to Google APIs as requested by the connected user; to the client-controlled destination selected by that user; and to authorised personnel or professional advisers where necessary for support, security, legal compliance or the establishment, exercise or defence of claims.

Dowodownik does not permit humans to read Google message or file content unless the user has approved the relevant acquisition and access is necessary to provide support requested by the client, investigate a security incident, comply with law, or protect legal rights. Such access must be limited and authorised.

OAuth tokens are retained while the connection is active and are disabled when the user disconnects it, access is revoked, the service relationship ends, or continued retention is no longer necessary. Short-lived access tokens expire according to Google's rules. Temporary Azure staging is not a canonical repository and is retained only as needed to complete, retry or investigate the transfer, subject to the service's operational retention controls.

A user may disconnect a Google connection in Dowodownik and may also revoke access in Google Account permissions. Requests to delete account, connection or operational data may be sent to office@kodemia.biz and will be handled without undue delay, subject to legal obligations and the need to preserve immutable audit events. Disconnecting Dowodownik does not delete source data in Google or materials already transferred to a repository controlled by the client; deletion from that repository must be requested from its controller.

Dowodownik's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• responding to an enquiry, arranging a demonstration and taking steps before a potential contract — Article 6(1)(b) GDPR;
• handling correspondence, securing the website, preventing abuse and establishing, pursuing or defending claims — our legitimate interests under Article 6(1)(f) GDPR;
• compliance with legal obligations where applicable — Article 6(1)(c) GDPR.

Submitting the contact form does not subscribe the user to a newsletter and is not consent to electronic marketing. Any future marketing communication requires a separate legal basis.

Data may be entrusted to providers supporting the website only to the extent necessary.

• SeoHost — website hosting and execution of the contact endpoint;
• Cloudflare — DNS, proxy, security and content delivery;
• Brevo (Sendinblue SAS) — delivery and logging of the transactional email;
• Google Workspace — receipt and storage of correspondence in office@kodemia.biz;
• Google Fonts — font delivery, which may disclose connection metadata to Google.

Some providers may process data outside the European Economic Area. Where this occurs, transfers rely on safeguards required by the GDPR, particularly an adequacy decision or standard contractual clauses.

Contact-form correspondence is retained for as long as necessary to handle the enquiry and generally no longer than 12 months after the conversation ends. Data may be retained longer when required to enter into or perform a contract, comply with law, or establish, pursue or defend claims. Technical logs are retained according to the controller's and providers' security settings.

• access to personal data and a copy of it;
• rectification, erasure or restriction of processing;
• data portability where applicable;
• objection to processing based on legitimate interests;
• a complaint to the Polish President of the Personal Data Protection Office or another competent supervisory authority.

Providing data is voluntary, but fields marked as required are necessary to submit the form and receive a response. We do not make decisions about users based solely on automated processing.

The website stores only the language preference in browser local storage under the key “dowodownik-lang”. Cloudflare and other infrastructure providers may use technical cookies or similar mechanisms required for security and proper operation. The website does not currently use its own analytics or advertising tools.

This policy may be updated when website features, providers or legal requirements change. The current version is always published on this page with its last-updated date.