Privacy policy

1. Controller and contact

The controller of the personal data described in this policy is ALEKSANDER LUBYCH, a sole proprietorship registered in the Polish Central Register and Information on Economic Activity (CEIDG), address: ul. Przy Forcie 10 lok. 41, 02-495 Warszawa, Tax ID (NIP): 1231402029, REGON: 380570421, email: kontakt@klino.pl (“Klino”, “we”). For anything to do with personal data, email kontakt@klino.pl. We have not appointed a data protection officer; the controller is directly responsible.

2. What this policy covers

• klino.io and www.klino.pl — the Klino website in English and in Polish, with pricing (and, in Polish, a guide);
• app.klino.pl — the Klino app for cleaning companies and their staff.

It does not cover other companies' websites we link to (e.g. Airbnb, Booking.com, channel managers).

3. Data on the website

There are no forms on the website. We only collect what follows from visiting it:

• Server logs — IP address, browser and device, the page visited, time, and the address of the page you came from.
• Campaign parameters — if you arrive via a link with utm_* parameters (or with a headline variant from an ad), we carry them in link addresses between pages and add them to the app sign-up link, so we know where new accounts come from. The website does not store them on your device.
• Visit statistics — Vercel Web Analytics counts page views and button clicks (e.g. “Start free trial”) in aggregate. It does not use cookies or browser storage and does not recognise you between visits or across other companies' websites.

We do not use analytics tools that set cookies or advertising tools (e.g. the Meta pixel) on the website. If we ever enable them, they will only work with your consent, and we will update this policy before enabling them.

4. Data in the app.klino.pl app: two roles

1. Account data — here we are the controller. Name, company name, email, phone number, password (stored only as a hash); when signing in with Google or Microsoft — the identifier and email of that account; invoicing data (company name, address, tax ID, invoice email) and the number of billed cleanings; sign-up source (campaign parameters passed from the website); technical data and logs (IP address, device, activity history, app errors); correspondence with us, including submissions from the “Feedback and ideas” feature with a screenshot, if you attach one.
2. Data a company enters into the app — here we are the processor. A cleaning company (our customer) enters into Klino data about its employees and contractors, clients and apartment owners, apartment addresses and details, bookings and guest data from iCal calendars, and photos and reports from cleanings. That company is the controller of this data. We process it only on the company's instructions, to provide the service (Art. 28 GDPR), under the data processing agreement, which is an annex to the Terms of Service. If you work for such a company or are its client, please contact that company first about your data. Requests that reach us will be passed on to the company, and we will help it handle them.

5. Purposes and legal bases

• Creating an account and providing the service (the app, support, account and security messages) — Art. 6(1)(b) GDPR (contract), and where you act on behalf of a company — our legitimate interest in serving that company (Art. 6(1)(f) GDPR).
• Invoices, accounting, taxes — Art. 6(1)(c) GDPR (legal obligation).
• Security, bot protection (Turnstile), logs, error detection — Art. 6(1)(f) GDPR (our legitimate interest: a working and secure service).
• Sign-up source (campaign parameters) and website visit statistics — Art. 6(1)(f) GDPR (interest: knowing which campaigns and content work).
• Business contact (replying to your message, information about changes to the service and new features for customers) — Art. 6(1)(f) GDPR. Newsletters, offers, or phone and text-message marketing — only if you allow it (Art. 398 of the Polish Electronic Communications Law). You can withdraw consent at any time.
• Establishing and defending legal claims — Art. 6(1)(f) GDPR.
• Data entered by companies (point 4.2) — we process it under the data processing agreement (Art. 28 GDPR); the legal basis is determined by the company that is its controller.

Providing account data is voluntary, but without it you cannot create an account or use the app.

6. Who we share data with

We use providers who process data on our instructions, under data processing agreements:

• Vercel Inc. (USA) — hosting of klino.io and www.klino.pl and visit statistics (Vercel Web Analytics);
• Cloudflare, Inc. (USA) — app hosting (Cloudflare Pages), DNS, CDN, email forwarding, bot protection (Turnstile);
• Supabase, Inc. (USA, servers in Ireland, AWS eu-west-1) — database, login and app files;
• Plus Five Five, Inc. — Resend (USA, servers in Ireland, Amazon SES) — sending emails from the app;
• Functional Software, Inc. — Sentry (USA, data in Germany) — app error monitoring;
• Google Ireland Limited / Google LLC — maps, address geocoding and fonts in the app, and Google sign-in if you choose it;
• Microsoft Ireland Operations Ltd — Microsoft account sign-in, if you choose it;
• browser push notification services (e.g. Google, Apple, Mozilla) — delivering notifications if you turn them on; the notification content is encrypted;
• OVH SAS (France) — routing engine server (ordering cleanings based on apartment addresses);
• Atlassian Pty Ltd — Jira (Australia) — handling “Feedback and ideas” submissions;
• our email provider, invoicing software and accounting office.To check: add names (e.g. Gmail / Fakturownia / inFakt) and whether accounting is external.

Public authorities may also receive data where the law requires it. We do not sell data. The full list of sub-processors of app data is in the data processing agreement.

7. Transfers outside the EEA

Some providers (e.g. Vercel, Cloudflare, Supabase, Resend, Google, Microsoft, Atlassian) are based or have infrastructure outside the European Economic Area (USA, Australia). We only transfer data with GDPR safeguards: on the basis of a European Commission adequacy decision (including the EU-US Data Privacy Framework, where the provider is certified) or standard contractual clauses. You can get a copy of the safeguards by emailing kontakt@klino.pl.

8. How long we keep data

• account data — for the duration of the contract and 90 days after it ends (time to export on request), and to the extent needed to defend claims — until they become time-barred (as a rule 3 years for claims between businesses);
• data entered by companies — for the duration of the contract; report photos for 3 months (Start plan) or 12 months (Pro plan); after the contract ends we delete it or return it to the company, in line with the data processing agreement;
• backups — data disappears from them in the normal overwrite cycle, up to 30 days after deletion from the app;
• invoices and accounting records — 5 years from the end of the year in which the tax payment deadline passed;
• correspondence — up to 3 years from the last message;
• logs and error information — up to 90 days;
• cookies and browser storage — periods in the table in point 11;
• data processed on the basis of consent — until consent is withdrawn.

9. Your rights

You have the right to:

• access your data and get a copy of it,
• rectification (correction) of your data,
• erasure of your data,
• restriction of processing,
• data portability (for data processed on the basis of a contract or consent),
• object to processing based on our legitimate interest, including marketing,
• withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal,
• lodge a complaint with the President of the Polish Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).To check: lawyer: add that EU residents may also complain to the supervisory authority in their own country (Art. 77 GDPR)?

To exercise your rights, email kontakt@klino.pl. We will reply within one month. We may ask you to confirm your identity.

10. Automated decisions and profiling

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. The app automatically suggests how to split and order cleanings, but a person at the company can always change that decision. We do not profile you for advertising.

11. Cookies and browser storage

“www” means klino.io and www.klino.pl, “app” means app.klino.pl. We do not use analytics or advertising tools in the app.

We only use strictly necessary storage, which does not require consent. You can delete or block it in your browser settings; blocking it in the app will prevent you from logging in.

12. Security

We use encrypted connections (HTTPS), separation of company data in the database, role-based permissions (everyone sees only their own company's data, according to their role), passwords and PIN codes stored as hashes, and backups. Only a small number of people on our side have access to data. Details are in the data processing agreement.

13. Changes to this policy

We update this policy when the app or our tools change. The current version is always at this address, and we tell customers about significant changes by email or in the app.