Privacy Policy

1. Controller

The controller of your personal data is Katarzyna Górecka, Nowogrodzka 31, 00-511 Warszawa, Poland, NIP: 7412060624 ("we"). Contact for all privacy matters: fox@siftfox.com. We process personal data in accordance with the EU General Data Protection Regulation (GDPR).

2. What data we process and why

Account and sign-in. Email address, display name, public handle, sign-in tokens and session identifiers. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Without an email address an account cannot exist - sign-in works through one-time email links; we never store passwords.

Your activity on the Service. Boosts, comments, tool submissions, profile claims (including the work email you use to verify a claim) and maker profile edits. Legal basis: performance of a contract, and our legitimate interest (Art. 6(1)(f)) in keeping rankings honest - for example detecting manipulated boosts.

Payments. When you buy a paid service, payment is handled by Stripe. We receive order data (what you bought, amount, status, billing details required for accounting) but never your full card number. Legal bases: contract performance and our legal obligations in tax and accounting law (Art. 6(1)(c)).

Newsletter and waitlists. Email address, subscribed on your request. Legal basis: consent (Art. 6(1)(a)), which you can withdraw at any time via the unsubscribe link or by emailing us.

Correspondence. If you write to us, we process the content to answer you (legitimate interest).

Technical and analytics data. Server logs (IP address, requested URL, browser data) for security and abuse prevention (legitimate interest), and - subject to your consent where required - statistics and marketing measurement described in section 5.

3. Recipients of data (processors)

We use carefully selected service providers who process data on our behalf under data-processing agreements:

- Cloudflare (hosting, database, CDN, security); - Stripe (payment processing - Stripe also acts as an independent controller for its own compliance duties); - Resend (transactional email - sign-in links and claim codes); - a newsletter delivery provider for The Weekly Sift; - Google (Google Analytics 4, Google Search Console) and Meta Platforms (Meta Pixel) - if you consent to analytics/marketing cookies; - accounting services for invoices.

4. Transfers outside the EEA

Some providers (Cloudflare, Stripe, Google, Meta, Resend) may process data in the United States or other countries outside the European Economic Area. Transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified, or on Standard Contractual Clauses with supplementary measures.

5. Cookies and similar technologies

Necessary cookies keep you signed in (session cookie) and remember security-relevant state. They are required for the Service to work and are used on the basis of our legitimate interest.

Analytics and marketing tags - Google Analytics 4 (traffic statistics) and Meta Pixel (measuring the effectiveness of our promotion) - are loaded only after you give consent through the cookie banner, and you can withdraw consent at any time via the cookie settings link in the footer. Withdrawing consent does not affect the lawfulness of processing before withdrawal. We also use Google Search Console, which processes aggregated search data and does not set cookies on our site.

6. How long we keep data

Account data: for as long as the account exists and up to 12 months after deletion (security and claims defence). Public content (comments, boosts) is deleted or anonymised together with the account. Order and invoice data: 5 full tax years, as required by Polish accounting law. Newsletter data: until you unsubscribe. Server logs: up to 90 days. Correspondence: up to 24 months.

7. Your rights

You have the right to access your data, receive a copy, rectify it, erase it, restrict processing, data portability, and to object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time. To exercise any right, email fox@siftfox.com - we respond within one month. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) or your local supervisory authority.

8. Automated decisions and profiling

We do not make decisions producing legal effects concerning you based solely on automated processing. Rankings reflect boosts and editorial curation of tools, not profiling of users.

9. Data of makers and public profiles

Public maker pages show the display name and handle you choose, and the tools you claimed or launched. Tool profiles seeded editorially contain business information about tools, sourced from public websites; if a profile concerns your business and you want it corrected or removed, claim it or email fox@siftfox.com.

10. Changes

We will update this Policy when our practices or providers change, and note the new effective date above. Significant changes will be announced on the Service or by email.

See also our Terms of Use.