TachoPomoc
TachoPomoc Privacy Policy
Language: Polski · Українська · English
This policy describes how we process data in connection with: (A) using the TachoPomoc mobile app and (B) using the tachopomoc.pl website, serving business customers (code packages for companies) and the partner programme.
1. Who is the data controller
The controller of personal data is Michał Sondej, running a sole proprietorship, Polish tax ID (NIP) 578-317-82-18, REGON 541736370, place of business: Elbląg (Poland). We provide the full postal address on request sent to the contact address below.
Contact on all matters concerning personal data: [email protected]. We have not appointed a data protection officer (there is no obligation to do so).
2. In a nutshell
- The app does not require an account. Its content (scenarios, rules, message dictionary, SOS, the “Working time assistant” module, the driver profile with deadlines) works offline and is stored only on your device - we do not send it anywhere.
- The app connects to the internet only to: download industry news, handle an in-app purchase, check a referral code or activate a company (fleet) code. Details in section 3.
- The tachopomoc.pl website does not use cookies or analytics tools (section 7).
- The app contains no ads and uses no advertising analytics. We do not profile you and do not make automated decisions about you.
- The “Request a quote” form on the business page collects company contact details solely to prepare a quote and a contract (section 4).
3. Mobile app - what data and why
3.1. In-app purchases
To handle the one-time full access purchase we use Google Play Billing and the RevenueCat service. The following are processed: an anonymous app user identifier generated by RevenueCat, the purchase transaction identifier and history, the store country, device type and system version, and the IP address (RevenueCat uses it to determine the approximate country). The data is used to link the purchase to your installation and to restore purchases. Payment is handled by Google Play - we have no access to your card details. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and accounting obligations (Art. 6(1)(c) GDPR). RevenueCat policy: revenuecat.com/privacy.
3.2. Partner referral code
If you enter a referral code or install the app from a partner link, the app: (a) checks that the code is valid with a request to tachopomoc.pl (we send only the code itself, none of your data), (b) passes the partner code to RevenueCat as an installation attribute so that a commission can be assigned to the partner if you make a purchase. We do not link this to your identity. Legal basis: our legitimate interest - settling the partner programme (Art. 6(1)(f) GDPR).
3.3. Company (fleet) code
If you activate a company code, the app sends to tachopomoc.pl: the code itself and a technical device identifier (an irreversible cryptographic hash of the Android identifier - we do not send the raw identifier). On the server we store: the code, the device identifier hash, an IP address hash and a pseudonymous customer identifier in RevenueCat (derived from the company code). This is used solely to assign the licence and enforce the device limit per code (protection against unauthorised code sharing). Legal basis: performance of the contract with the company that bought the package (Art. 6(1)(b) GDPR) and our legitimate interest in limiting abuse (Art. 6(1)(f) GDPR).
3.4. Industry news
The app downloads a publicly available news file from tachopomoc.pl with an ordinary GET request. Our hosting provider (Cloudflare) may briefly process your IP address in standard security logs at the edge of its network. We do not store that address or link it to your installation. The most recently downloaded news is stored locally on the device (to show something offline). News summaries are prepared automatically by an AI model from Anthropic based on content from industry portals (including 40ton.net, truckfocus.pl) - the news content is processed, not your data. Each news item links to the original article at the source.
3.5. Data stored only on the device
- Settings: the selected tachograph model, interface language, completed tutorial, favourite scenarios, confirmation that you have read the terms and the policy (date and document version).
- Working time assistant: activity entries (type of activity, times, an optional note you enter) and the activity log. The module automatically deletes entries older than 21 days.
- Driver profile: expiry dates of the periodic qualification (code 95), driver card, driving licence, medical and psychological examinations, ADR certificate and the date of the last card download. You enter them yourself or - with your consent - we read them from a card file you load into the app yourself. They are used solely for local reminders.
- Backup: if you save a backup of the assistant and profile data yourself, a file is created on your device. You decide where to save it or whom to give it to - we do not receive it.
- SOS: an information section. It does not call for help, does not use location, and does not access contacts or the network.
We do not send this data anywhere and have no access to it. It is deleted when you uninstall the app. Based on it, the module schedules local notifications on the device (without an external push server), which requires notification permission in Android - you can withdraw it in the device settings.
3.6. Voice search
If you use voice search, the app uses the speech recognition built into the system and requests that it runs on the device (without sending the recording to a cloud speech recognition service). If your device does not support offline mode for the selected language, the feature may be unavailable. The recognised text is used only to fill in the search field and is not sent to our servers. The feature requires microphone permission, which you can withdraw in the device settings.
3.7. Fonts
The app includes font files in its own package and does not download them from external servers.
3.8. App feedback (“Rate the app”)
If you use the “Rate the app” module, we send to our server: a rating on a 1-5 scale, the answer to “is the app useful”, items ticked from ready-made lists (“what is missing”, “what to improve”), the app version number, platform and language. The “Comment” field is optional and free-form - please do not enter personal data in it (name, registration number, phone). Instead of your IP address we store only its irreversible hash (to limit the number of submissions). The form does not require logging in or giving your identity. Legal basis: our legitimate interest in developing the app (Art. 6(1)(f) GDPR). We keep feedback for up to 12 months and do not share it with anyone. If you give 4 or 5 stars, after sending the feedback the app may show the Google Play system rating dialog - this is handled entirely by Google; we receive no data from it.
4. The tachopomoc.pl website, business customers and partners
4.1. “Request a quote” form (for companies)
We collect: company name, tax ID, e-mail address, phone, fleet size, the package of interest and the message, as well as an IP address hash (to limit form abuse). We use this data - including a named e-mail or phone of the contact person - solely to prepare a quote, for business contact, to conclude and perform the contract and to issue an invoice. Legal basis: steps prior to entering into a contract and its performance (Art. 6(1)(b) GDPR), accounting obligations (Art. 6(1)(c) GDPR) and our legitimate interest in business contact and securing the form (Art. 6(1)(f) GDPR). Providing the data is voluntary but necessary to prepare a quote. We do not share the content of the enquiry with any third parties.
4.2. Company codes - server side
Company code activations are described in section 3.3. On the server we store the company name (for a batch of codes), the code, the device identifier hash, the IP address hash, a pseudonymous customer identifier and activation dates. The admin panel shows this data only to us, to manage licences and detect abuse.
4.3. Partner programme
Creator applications. If you apply to the partner programme (the form on the “for creators” page or by e-mail), we process: the name and address of the Channel, e-mail address, tax ID, company name, the message, the proposed identifier in the link and the recorded accepted version of the Partner Programme Terms; to limit form abuse - an IP address hash. Purpose: considering the application and concluding and settling participation in the programme. Legal basis: steps prior to entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in handling the application (Art. 6(1)(f) GDPR). Applications that did not lead to cooperation are deleted after 12 months.
For partners (people and companies recommending the app) we process:
name, e-mail address, tax ID, company name, the agreed commission rate, the
accepted version of the Partner Programme Terms, settlement and payout
data. The referral link tachopomoc.pl/go/<code> counts
clicks only in aggregate (a daily counter per code) - without the IP
address, without cookies and without identifying the person
clicking - and redirects to Google Play. When a purchase is made
with a given code, RevenueCat sends us a notification (webhook), from which
we store: the event identifier, partner code, pseudonymous customer
identifier, event type, store, amount, currency and date - in order to
calculate the commission. Legal basis: performance of the contract with the
partner (Art. 6(1)(b) GDPR), accounting obligations (Art. 6(1)(c) GDPR) and
our legitimate interest in settling the programme (Art. 6(1)(f) GDPR).
4.4. “I want an iOS version” poll
The button stores only an aggregate vote counter. To limit repeated voting, we temporarily (up to 24 hours) store a hash of your IP address. Legal basis: our legitimate interest in a reliable poll result (Art. 6(1)(f) GDPR).
5. Data recipients and transfers outside the EEA
We use the following providers (processors or separate controllers), to whom we entrust or disclose data to the extent necessary for the stated purposes:
| Provider | Role | Location |
|---|---|---|
| RevenueCat, Inc. | In-app purchases and entitlements, partner programme webhooks | USA |
| Google Ireland Ltd / Google LLC | Google Play Billing (payments), app distribution; depending on the device - system speech recognition services | Ireland / USA |
| Cloudflare, Inc. | Hosting of tachopomoc.pl, database and storage (D1, KV), security logs | USA |
| Anthropic PBC | Automatic summaries of industry news (news content is processed) | USA |
| OVH Sp. z o.o. / OVH SAS | Server running the news preparation process | Poland / EU |
Some providers are based in the USA. Transfers of data outside the European Economic Area take place on the basis of safeguards provided for in the GDPR - in particular standard contractual clauses and, where the provider participates in the Data Privacy Framework, on that basis. We will provide a copy of the safeguards on request. Otherwise, data may be disclosed to entities authorised by law (e.g. tax authorities).
Provider policies: RevenueCat, Cloudflare, Google, Anthropic.
6. How long we keep data
| Category | Period |
|---|---|
| Transaction data (purchases, invoices) and partner programme settlements | 5 years from the end of the year in which the tax obligation arose (Polish Accounting Act) and, if longer, until claims become time-barred |
| “Request a quote” enquiries that did not lead to a contract | up to 12 months from the last contact |
| Creator applications to the partner programme that did not lead to cooperation | up to 12 months |
| Partner data (contact, tax ID, rate) | for the duration of cooperation, then until claims become time-barred and accounting periods expire |
| Company code activations (code, device hash, IP hash) | for the licence validity period + up to 6 months |
| Aggregate counters (partner link clicks, iOS votes) | clicks: up to 24 months; IP hashes from the poll/forms: 1-24 hours |
| App feedback from “Rate the app” (rating, list choices, comment, IP hash) | up to 12 months from sending |
| Cloudflare security logs | according to Cloudflare's policy (short term) |
| Data stored only on the device (section 3.5) | until you delete it or uninstall the app; assistant entries - automatically after 21 days |
7. Cookies and browser local storage
The tachopomoc.pl website does not use cookies or any analytics or tracking tools. The only thing stored in your browser is a technical flag indicating that you have already voted in the iOS poll - it contains no identifier and is not sent anywhere.
8. Automated decisions and profiling
We do not make decisions about you based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you.
9. Your rights
You have the right to: access your data and obtain a copy, rectification, erasure, restriction of processing, data portability (for data processed on the basis of a contract or consent and by automated means), and to object to processing based on our legitimate interest (Art. 6(1)(f) GDPR) - on grounds relating to your particular situation. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before the withdrawal.
Send requests to [email protected]. You also have the right to lodge a complaint with a supervisory authority - the Polish President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw) or the data protection authority in your EU country of residence.
10. Data security
We apply technical and organisational measures appropriate to the risk - including encryption in transit (HTTPS), restricted access to the admin panel, and pseudonymisation of device identifiers and IP addresses. However, no transmission or storage of data is 100% secure and we cannot fully guarantee it.
11. Children
The app is aimed at professional drivers and is not intended for children under 18. We do not knowingly collect data from such persons.
12. Changes to the policy
We will announce material changes in the app update notes, and on the first launch after a change the app will ask you to confirm again that you have read the documents. The current version of the policy is always available at this address.