Privacy Policy

1. Data controller

The data controller is Piotr Gorczyca, conducting business as DrONE Piotr Gorczyca, ul. Czesława Wroczyńskiego 6/63, 21-500 Biała Podlaska, Poland, NIP (tax ID): 7171814753, REGON: 382029631 (the "Controller"). The Service is available at pozitreo.com. For data protection inquiries, contact: [email protected].

2. Data we collect

When using the Service, we may process the following data:

• Account data — email address, name (upon registration). Providing this data is voluntary but required to create an account.
• Audit data — URL of the audited website, selected package, analysis results. The URL is necessary for service delivery.
• Invoicing data — company name, tax ID, address, postal code, city and country. Provided voluntarily in your account settings and used solely to issue a sales document.
• Payment data — processed exclusively by the payment providers (tpay for PLN, Polar for EUR). Pozitreo does not store payment card data.
• Testimonials — if you choose to leave one: rating, testimonial text, a signature (first name or company name), and optionally a role and website address. Published on the Service after approval and only with your consent.
• Technical data — browser type, operating system and data stored in your browser (see the Cookie Policy). Collected to ensure proper Service operation.
• IP address in the free rank checker — the tool is open without an account, so the network address is the only way to limit abuse. Your IP address is hashed on our own server (SHA-256 with a secret salt) and only the irreversible digest reaches our database — never the IP address itself. The digest serves solely as a per-day request counter.

3. Purposes and legal bases

Purpose	Legal basis (GDPR)
SEO audit service delivery	Art. 6(1)(b) — contract performance
User account management	Art. 6(1)(b) — contract performance
Payment processing	Art. 6(1)(b) — contract performance
Service security	Art. 6(1)(f) — legitimate interest
Abuse limiting in the free tools (hashed IP address)	Art. 6(1)(f) — legitimate interest
Publishing testimonials on the Service	Art. 6(1)(a) — consent
Statistics and analytics (Google Analytics)	Art. 6(1)(a) — consent
Legal obligations (e.g., tax)	Art. 6(1)(c) — legal obligation

4. Data recipients

Personal data may be shared with:

• Convex — backend infrastructure provider (account and audit data storage).
• tpay (Krajowy Integrator Płatności S.A.) — PLN payment processor (transaction processing).
• Polar — EUR payment processor (transaction processing for customers outside Poland).
• Google — PageSpeed API (technical analysis — only the audited page URL is transmitted) and Google Analytics 4 (visit statistics, only after consent is given in the cookie banner).
• Anthropic — AI model provider (content analysis — only audited page content is transmitted, not User personal data).
• DataForSEO — SEO data provider. It powers Google rank checking, backlink and domain authority analysis, and the AI search visibility test. We transmit only the audited website address, keywords and queries about the analysed brand — never account or payment data.

Data may also be disclosed to public authorities where required by law.

4a. Transfers outside the European Economic Area

Some of the providers listed above process data outside the European Economic Area (including in the United States). Such transfers take place on the basis of the mechanisms provided for in Chapter V of the GDPR — an adequacy decision or standard contractual clauses. We will provide information about the safeguards applied to a specific provider on request: [email protected].

5. Data retention

• Account data — until you delete your account.
• Audit data — until your account is deleted or you request erasure. Audits ordered without an account are kept until such a request is made. After account deletion, audits tied to retained billing documents remain in the system in anonymised form — without an email address and with no link to the User.
• Testimonials — until you withdraw consent or delete your account.
• Free rank checker data — query results are cached for 24 hours and hashed request counters are kept for 3 days. Both are then deleted automatically.
• Billing data — for the period required by tax law (5 years). We cannot delete this data earlier, even on request; after account deletion we strip its link to the User.

6. User rights

Under GDPR, you have the following rights:

• Right of access — obtain information about your processed data.
• Right to rectification — correct inaccurate data.
• Right to erasure (right to be forgotten) — request data deletion.
• Right to restriction — request limitation of processing.
• Right to data portability — receive data in a structured format.
• Right to object — object to processing based on legitimate interest.
• Right to lodge a complaint — file a complaint with the Polish Data Protection Authority (UODO).

To exercise your rights: [email protected]. We will respond within 30 days.

7. Data security

We implement appropriate technical and organizational measures to protect personal data, including transmission encryption (HTTPS), secure password storage, and system access controls.

8. AI data processing

As part of audit delivery, the content of the audited website is sent to AI models (Anthropic Claude) to generate analysis and recommendations. Only the audited page content is transmitted — User personal data (email, payment details) is not sent to AI models.

In packages that include the AI visibility test, we additionally put questions to AI search engines (ChatGPT, Gemini, Claude, Perplexity) via DataForSEO to check whether and in what context they mention the audited brand. These queries concern only the audited website and its industry — they contain no User personal data.

9. Cookies and browser storage

The Service uses cookies and your browser's local storage (localStorage) — among other things to keep you signed in and to remember your consent choice. For details, see our Cookie Policy.

10. Policy changes

The Controller reserves the right to modify this Privacy Policy. Users will be notified of material changes through the Service.

11. Contact

For data protection matters: [email protected].