Privacy Policy of the “Lokavi Home” app

Version 2.2.1 – published 9 November 2026. Amends version 2.2 solely with regard to reports of AI-generated content made with the “Report” button in the App (section 2 – new row, section 5d – new paragraph, section 6 – retention period). The remaining content is unchanged. Version 2.2.1 applies from the date of publication.

The Operator's contact details were updated on 7 November 2026 (editorial change – the rest of the text is unchanged).

1. Who is responsible for the data

The “Lokavi Home” app (hereinafter: the App) is made available by Sebastian Jabłoński spółka komandytowa with its registered office in Warsaw, ul. Bonifraterska 17, 00-203 Warszawa, entered in the register of entrepreneurs of the National Court Register (KRS) under number 0000855880, NIP 5252833038, REGON 386820681 (hereinafter: the Operator). Contact regarding personal data: privacy@lokavi.pl.

The App is used to organise work in a private home: planning tasks for domestic workers, registers, reports, chat, meals and “right now” requests. Each home in the App has an administrator (the person who created it). With respect to the data of domestic workers and other persons that the home administrator enters into the App for purposes going beyond purely personal or household activities, the controller of the data within the meaning of the GDPR is the home administrator, and the Operator processes that data on the home administrator's behalf as a processor, under a data processing agreement (Annex 2 to the Terms of Service). Where the home administrator uses the App solely for personal or household purposes, the Operator applies the same rules and safeguards to that data. The Operator is the controller with respect to: account data (e-mail address, password, sign-in logs), security and logs, the balance, subscription and payments, marketing (section 5a), content reports (section 5d), and the shopping agent, reading a list from a photo or dictation and store selection for shopping list items (section 5b).

2. What data is processed

The App does not collect location data, does not read contacts or files on the phone and does not launch the camera without user action. The App displays and sends offers and marketing information only to persons who have consented to this, and profiling for the purpose of selecting offers takes place only with consent (section 5a). Payment card data is not stored in the App – the shopping agent uses the payment method saved in the administrator's shop account, and top-ups of the agent balance and the AI subscription are handled by Stripe (card or BLIK details are entered only on the Stripe payment page).

2a. Signing in with Apple and Google

You can sign in to the App using “Sign in with Apple” or “Sign in with Google” (in the Android app – Google only). This is a convenient alternative to a password – using it is voluntary, and signing in with a PIN, a QR code or an e-mail address and password continues to work.

• What data is received. After you sign in, Apple or Google provides the App with: the account identifier (permanent, assigned by the provider), the e-mail address together with information on whether it is confirmed (Apple – also whether it is a relay address), and the name (if you share it; with Google usually first and last name), which the App stores at the first sign-in. Google additionally provides the profile photo address; it is stored together with the account data, but the App does not use or display it. When signing in with Apple, you can hide your real e-mail address; Apple will then provide a relay address (usually in the form …@privaterelay.appleid.com), and Apple may forward messages sent to that address to your mailbox. The App does not request access to the e-mail, contacts, calendar or files in your Apple or Google account.
• Passwords. The App never receives the password to your Apple or Google account – you enter the password only with the provider.
• Purpose. The data is used to sign you in to the App and to link the account with your person in the home. The home administrator or coordinator may enter a person's e-mail address for that person; if the address confirmed by Apple or Google is the same, the account is linked with that person automatically. You can also link the account yourself: after signing in with a PIN or QR code, you select “Link” and then sign in with Apple or Google; if there is no e-mail address yet for your person, the App stores the confirmed address of that account there (including an Apple relay address).
• Legal basis. Performance of the contract for the use of the App (Article 6(1)(b) GDPR) – in the same way as for other account data (section 3). The controller of this data is the Operator; the e-mail address entered for a person by the home administrator or coordinator is processed as described in section 1.
• Apple and Google as separate controllers. During sign-in, Apple and Google do not act on behalf of the Operator: they provide their own sign-in service and themselves determine the purposes and means of processing the data they need for it – in accordance with their own privacy policies (Apple, Google). The provider may know that you are signing in to the “Lokavi Home” App.
• How to disconnect sign-in. An Apple, Google or e-mail account can be unlinked from a person in the home in the App: this is done by the home administrator (Settings → People), the coordinator (for workers and household members) or the person themselves (More → My account → “Disconnect account”). An account can only be unlinked from a person who has a PIN set – so that no one loses access to the home. After unlinking, the sessions signed in with that account for that person are deleted, and signing in with a PIN and QR code continues to work. Independently of this, you can revoke the App's access at any time in the settings of your Apple account (Sign in with Apple) or Google account (connected third-party apps). Revoking access with the provider does not delete the account in the App. You delete the account, together with the stored Apple/Google identifier and e-mail address, as described in section 7 (Account deletion); deleting the account also clears the e-mail address stored for your person in the home, and the person's entry itself is subject to the retention rules in section 6.

3. Legal bases

• performance of the contract for the use of the App (Article 6(1)(b) GDPR) – account, sign-in, App features;
• legitimate interest of the Operator (Article 6(1)(f) GDPR) – security, abuse prevention, technical statistics;
• with respect to the data of the home's workers – the bases indicated by the home administrator in the information notice that the worker accepts in the App (performance of a contract, legitimate interest of the home administrator);
• consent (Article 6(1)(a) GDPR) – push notifications; consent can be withdrawn in the phone settings;
• performance of the AI services contract concluded with the home administrator (Article 6(1)(b) GDPR) – transfer of data to the AI model provider and the offer search engine as part of the shopping agent, list reading and store selection (section 5b); with respect to other persons whose data may be visible on screenshots of the shop or on the photo of the list (e.g. the delivery recipient, household members) – the legitimate interest of the Operator and the home administrator consisting in carrying out the shopping order (Article 6(1)(f) GDPR);
• translation of content entered in the home (section 5e) – performance of the contract for the use of the App with respect to persons who use it (Article 6(1)(b) GDPR), and with respect to authors of content without an account and persons mentioned in the content – the legitimate interest of the Operator and the household members consisting in enabling people who speak different languages to communicate with each other (Article 6(1)(f) GDPR); with respect to the data of workers and other persons for whom the home administrator is the controller (section 1) – the basis indicated by the home administrator, and the Operator acts on the home administrator's instructions;
• performance of the contract (Article 6(1)(b) GDPR) – agent balance, top-ups, AI subscription, charges for runs and refunds of those charges, withdrawal from the contract and refunds of payments, transactional e-mails about the balance, confirmations of payment and withdrawal;
• legal obligation of the Operator (Article 6(1)(c) GDPR) – retention of payment documentation, invoices and sales records required by tax and accounting laws, confirmation of conclusion of the contract and of acceptance of withdrawal (Consumer Rights Act), handling content reports and appeals (Digital Services Act);
• legitimate interest of the Operator (Article 6(1)(f) GDPR) – the record of the granted starter gift (so that the gift is granted only once per account), retention of statements made before payment as evidence, and establishment and pursuit of claims related to payments;
• marketing of products and services of the Operator and of partners, profiling for the purpose of selecting offers and transfer of data to partners — consent (Article 6(1)(a) GDPR), separately for each purpose and contact channel;
• consent of the home administrator (Article 6(1)(a) GDPR) – home scan, i.e. the transfer of images of interiors to an AI model (section 5i); consent can be withdrawn at any time, as described in section 5i.
• virtual AI manager (section 5j) – with respect to the data of workers and other persons for whom the home administrator is the controller (section 1) – the basis indicated by the home administrator (performance of the contract under which the work is performed, or the home administrator's legitimate interest in organising work in the home), and the Operator acts on the home administrator's instructions; with respect to the data of the home administrator – performance of the contract for the use of the App (Article 6(1)(b) GDPR).

4. Data recipients

A copy of the standard contractual clauses can be obtained by writing to the Operator. Data is not sold. Apart from the recipients listed in this section, the Operator shares data only with Lokavi Home partners and only the data of those persons who have consented to the transfer of data to partners (section 5a), within the scope of that consent: first name, e-mail address and – if provided – phone number. Data may be disclosed to authorised authorities if required by law.

5. Who sees data in the home

The home administrator and persons with administrator rights see all data of their home. The coordinator sees tasks, the schedule, registers and reports. A worker sees their own tasks, registers, chat and whatever relates to their work. A household member sees meals, items, shopping, “right now” requests and chat. Data of one home is not visible to other homes.

5a. Marketing and consents

Marketing consents are voluntary, independent of one another and are not a condition for creating an account or using the App. The Operator asks for separate consent for each of the following purposes and contact channels.

• Lokavi Home offers – sending information about Lokavi Home products and services, in particular cleaning, cooking and driver services.
• Partner offers – presenting offers of Lokavi Home partners in the following categories: electricity and gas, insurance, home services, shopping and goods, equipment servicing, pet care, seasonal and holiday items, bills, utilities and subscriptions, without passing your data to them.
• Transfer of data to partners – sharing with selected partners from these categories your first name, e-mail address and, if you provide it, phone number, so that they can present their offers to you; the partner then becomes a separate controller of that data.
• Matching offers to your home – profiling, i.e. selecting offers based on data about the home (described below).
• E-mail channel – receiving commercial and marketing information at your e-mail address.
• SMS and phone channel – contact for marketing purposes via SMS and phone calls, at the number you provide.
• Notification channel – receiving commercial and marketing information in App notifications on your phone.

Profiling. If you consent to offer matching, the Operator selects offers for your home based on: the number of household members, the presence and age range of children, pets, the size of the home and the use of App features. Health data, workers' data, photos, chat and daily plans are not used for profiling. Profiling serves solely to select offers and does not produce legal effects concerning you.

For the purpose of offer matching, the Operator is the controller of the listed characteristics of the home on the basis of the home administrator's consent; in all other respects, the Operator processes the data entered by the home about its members and workers on behalf of the home administrator.

5b. Shopping agent and AI models (including list reading and store selection)

The shopping agent, reading a shopping list from a photo or dictation and store selection for shopping list items are optional features based on artificial intelligence (AI) models; their responses may contain errors. The agent runs on the Operator's servers. The controller of the data processed in these features is the Operator.

What goes to the AI model. Items of shopping lists and orders (names, quantities, notes, amount limits), answers of the home's users to the agent's questions, the home address (if the administrator has entered it – to choose delivery and check its cost), screenshots of shops taken during shopping (which may show, among other things, the delivery address, the recipient's first and last name and order history), and, for list reading, a photo of the note or the dictated text. Speech recognition is performed by the phone's system or the browser (e.g. Apple, Google) on their own terms; the App receives only the text. When searching for and comparing offers, the agent provides the SerpApi offer search engine with the name of the product searched for and the home's city.

Purpose. Carrying out the order: selecting products, comparing offers, placing the order, converting a photo or text into list items, indicating the store in which the agent is to look for an item. The Operator does not use this data for marketing, profiling or training models. Shopping lists may indirectly reveal health information (e.g. medicines); the Operator does not draw any such conclusions from them.

Model provider. With billing from the balance or subscription (“our tokens”) and always for list reading and store selection, the App uses Anthropic PBC (USA) models on the Operator's account – Anthropic processes the data as a processor on behalf of the Operator. With the home's own API key, the agent uses the home's account with the provider chosen by the administrator from among those made available by the Operator: Anthropic PBC, OpenAI or xAI (all in the USA) – the data goes to the provider on the terms of the agreement the home has concluded with that provider. Store selection does not use the home's key (see below).

Store selection. In a home in which the shopping agent is enabled and the home administrator has given the permission described at the end of this section, after an item is added to the shopping list the App determines in which of the home's stores the agent is to look for it. It first checks earlier store selections (store corrections and purchases) saved for the home's owners and shared across their homes – without an AI model. Where there is no such selection, the AI model receives the item's name and quantity (as entered on the list), the names of the home's stores and the home's shopping preference; the model returns the store and the item's category. Store selection always uses an Anthropic PBC (USA) model on the Operator's account – Anthropic processes the data as a processor on behalf of the Operator – also in a home that has provided its own API key for the agent, including where that home's agent uses OpenAI or xAI; the home's key is not used for this, and item names are not sent to the provider chosen by the home. With the item we save the selected store, marked as indicated by an AI model, and separately – the model, store, category, confidence, time and cost of each model response (without the item name); item names are not written to logs. A store chosen manually or resulting from a product link always takes precedence.

Shop passwords and the API key. The login and password for the shop account and the own API key for the model provider are encrypted on the administrator's phone with their agent's key; the database contains only the ciphertext (for the API key, also the provider name and the last 4 characters). They are decrypted only on the agent server, automatically and for the duration of the agent's work; during that time the Operator technically has access to them. Passwords and the key are not passed to the AI model (the API key goes only to its provider as login credentials), and are not stored in logs, results, notifications, e-mails or screenshots.

Retention. Agent screenshots – 30 days; the list photo and dictated text – are not stored or logged after reading; orders and run results – for as long as the home exists.

Permission in the App. Before first use, the home administrator confirms in the App that they have read these rules and allows data to be passed to the model provider (we record the version of the text, the person and the time). The basis for processing is the contract (section 3), not consent. Permission can be withdrawn at any time by writing to the Operator – the agent, list reading and store selection by an AI model then stop working. Disabling the agent in the App (Agent tab) stops the agent from accepting new orders.

5c. Agent balance and payments

Balance and history. Each home has a payer – one of the home owners with an account (Terms of Service, section 6 point 3). The Operator maintains the payer's agent balance, shared by the homes for which they pay, and the transaction history (top-ups, charges for AI usage with the name of the home, the model and the number of tokens, starter gift, adjustments, refunds). The payer sees the balance and the history of charges in all homes for which they pay. Other owners and coordinators of the home see the charges of their home, and the balance amount – only when the balance relates to a single home. After a change of payer, the previous payer keeps the history of charges from the period in which they paid; they see the charges of a home to which they no longer have access as “another home”, without a description. The balance of a home to which an owner other than the payer made payments remains a separate balance of that home and is visible to all owners of the home. The legal basis is performance of the contract (Article 6(1)(b) GDPR). The record of the granted gift contains the identifier of the home owner's account – so that the gift is granted only once per account.

Payments. Top-ups and orders of the AI subscription take place on the Stripe payment page, only in the browser version of the App. We accept payments from consumers with a billing address in Poland or in another European Union country and from businesses with a Polish NIP and a billing address in Poland: the Operator checks the country of the billing address and the type of tax number, and a payment with a billing address outside the European Union or with a tax number other than a Polish NIP is automatically refunded in full. For a payment from a consumer from another European Union country, the Operator additionally records the billing address country, the amount, the date and the Stripe payment identifier (section 5h). Stripe Payments Europe, Limited (Ireland) processes payer data (including first and last name or company name, e-mail address, card or BLIK details, NIP – if the payer provides it) in order to carry out the payment and – as a separate controller – for its own purposes described in Stripe's privacy policy (e.g. fraud prevention, legal obligations). The Operator receives a payment confirmation from Stripe (identifier, amount, currency, status) and has access in the Stripe dashboard to the payer data needed for an invoice and a refund; it does not receive full card data.

Balance e-mails. Home owners with an e-mail address receive transactional e-mails about the agent balance (welcome, low balance, insufficient funds, change to billing rules), sent by Resend Inc. from agent@send.lokavi.pl. These are not marketing e-mails and do not require marketing consent. After sending, the e-mail address is removed from the sending queue; a record remains that an e-mail of a given type was sent to the home (so as not to send it again).

AI subscription. For the subscription, the Operator processes the Stripe customer and subscription identifier, plan, status, billing periods, subscription payments and invoices, and usage within the limit – for the performance of the contract (Article 6(1)(b) GDPR) and tax obligations (Article 6(1)(c) GDPR).

Statements before payment. Before each payment, the home owner ticks acceptance of the Terms of Service and the request to commence performance before the withdrawal period expires. We record their wording (version), the version of the Terms of Service, the person, the time and the payment identifier – in order to demonstrate conclusion of the contract and settlements (Article 6(1)(b), (c) and (f) GDPR) – and send them in the payment confirmation e-mail.

Withdrawal from the contract. A statement submitted using the “Withdraw from the contract” button contains the first and last name and e-mail address provided in the window, the contract and the time of submission. We send a confirmation to that address, and the Operator receives a notification so that it can make the refund in the Stripe dashboard.

5d. Content reports and appeals

We accept reports of content considered illegal and appeals against the Operator's decisions (section 4a of the Terms of Service) by e-mail. We process the reporter's data (first and last name or company name, e-mail address – unless the report concerns offences against sexual freedom and decency involving minors), the content of the report, the indicated content, the decision and its statement of reasons – in order to handle the report or appeal and fulfil the obligations under the Digital Services Act (Article 6(1)(c) GDPR). The Operator notifies law enforcement authorities of information indicating an offence threatening the life or safety of persons.

Reports of AI content in the App. You can report content generated by AI features (the shopping agent, the virtual AI manager, store selection, the home scan, offers) with the “Report” button, stating the reason and a short description (up to 500 characters – without data of other people). We record the home, the account and the reporting person, the type and identifier of the content (without a copy of it), the reason, the description, the time and the status of the report. Reports are used to check AI content, improve the AI features and comply with the rules of app stores (Apple, Google) – the Operator's legitimate interest (Article 6(1)(f) GDPR). Such a report does not replace the report of illegal content described above. Reports are visible only to the Operator; the number of reports from one account is limited per day.

5e. AI translation

App texts. App labels, system messages and documents in languages other than Polish are translated in advance using an AI model from Anthropic PBC. No user data goes into this translation.

Content entered by users. When the Operator makes available translation of content entered in the home (e.g. chat messages, descriptions of tasks and faults, meals, instructions; excluding the shopping list), the text and the target language will be passed to the AI model of Anthropic PBC (USA, standard contractual clauses) solely for the purpose of showing the translation to people in the home who use the App in another language. The translation is stored alongside the original, marked as translated by AI, with the option of displaying the original, and is deleted together with the original. Anthropic acts as a processor on behalf of the Operator, and with respect to the data of workers and other persons for whom the home administrator is the controller (section 1) – as a further processor; the Operator notifies home administrators by e-mail at least 14 days before this feature is enabled (Annex 2 to the Terms of Service). The legal bases are given in section 3. The home administrator may disable content translation for the entire home. Any person may object to the translation of their content – to the home administrator or to the Operator (section 7). The provider does not use this data to train models, and the Operator does not use the translated content for other purposes; in particular, it does not draw conclusions about health from it.

5f. Shopping agent in other countries

In countries where shops require a connection from an address in that country, the shopping agent may connect to shops through an intermediary service provider (a proxy server in the shop's country). This provider forwards the agent browser's traffic to the shop, including data visible on the shop's pages (e.g. delivery address, cart contents), and acts as a processor on behalf of the Operator. The Operator will state the provider's name in this policy before launching the agent in such a country.

5g. Transfers of data outside the European Economic Area

App data is stored in the European Union (Ireland), including for users outside the Union. Outside the European Economic Area (EEA), data goes only to the recipients indicated in section 4, on the bases stated there: decisions of the European Commission finding an adequate level of protection (including the EU–US Data Privacy Framework where the recipient is certified under it) or standard contractual clauses approved by the European Commission. A user outside the EEA uses the App on the same terms – their data is processed in the European Union.

5h. Taxes on payments

The Operator settles payments from consumers from other European Union countries with Polish VAT as long as the total value of such sales does not exceed the threshold set by VAT law (EUR 10,000 per year). For this purpose it keeps a record of these payments (billing address country, amount, date, Stripe payment identifier) – on the basis of a legal obligation (Article 6(1)(c) GDPR) – and stores it in the same way as other payment data (section 6). When the threshold is exceeded or payments become available outside the European Union, the Operator may use the Stripe Tax service to calculate tax on payments (e.g. VAT according to the payer's country): Stripe receives the payer's country and billing address and – if provided – the NIP or VAT number, in order to determine the applicable rate and for tax documentation.

5i. Home scan and the item register

The home scan is an optional function of the “Items” module and is switched off by default. The home administrator switches it on by their own action and consents to the transfer of images of interiors to an AI model (we record the version of the consent, the person and the date); without this consent, scanning does not work. Scanning also requires the consent to use the AI model described in section 5b.

Who scans. Administrators and household members can scan. Household staff (workers, coordinators, cooks) scan only if the administrator allows it or assigns them a scan of a specific place. Before the first scan, the App asks that no people or open documents be in the frame.

What goes to the AI model. During a scan the phone picks sharp, distinct frames from the camera image (or photos taken by the user) and passes them to the Anthropic PBC model (USA) together with the names of places and items already entered in the scanned place. With dictation, the model receives the text dictated or typed on the place's card. The model returns a list of recognised items and furniture. A schematic room model is also created from the scan frames: the outline of the walls, doors, windows and the position of furniture. An uploaded home plan goes to Anthropic's model for recognition, to read the rooms from it. The data is used solely to recognise items and places in the home; the model provider processes it as the Operator's processor and does not use it to train models. A scan always uses the Operator's account with the provider, including in homes that have entered their own API key for the shopping agent.

What we store. Recognised items go to the “To review” list and become part of the register only after approval by the administrator or by the person who scanned. We store: the names of items, the place, quantity, category, a small crop of the image showing the item, who scanned and when, and the cost of the scan. We store scan frames only if the model did not recognise a person or a document containing data in them; frames with people or documents are not stored at all (they are processed only for the duration of recognition). We do not create crops that show a person or a document. We keep the plan without a time limit until you delete it (“Delete plan”).

Who sees it. Scan frames are visible to home administrators and to the person who scanned. Items and their crops are visible to the people who can see the place where they are kept; items marked as valuable and places marked as private are not visible to household staff.

Billing. A scan is billed like the agent's work (section 5c): from the agent balance or from the home's subscription limit; in a home that has provided its own API key for the agent, the scan is free of charge. Before a scan the App shows a cost estimate, and during it – a counter. Fees for the scan apply from the date version 1.8 of the Terms of Service enters into force (6 December 2026); until that date the scan is free of charge.

Withdrawing consent. Consent can be withdrawn at any time – by switching off the scan in the App (Items → Scan settings) or by e-mail to the Operator; withdrawal does not affect the lawfulness of processing before withdrawal. Approved items remain in the register until the administrator or a household member deletes them.

5j. Virtual AI manager

The virtual AI manager (“Lokavi AI”) is an optional function, switched off by default, based on an artificial intelligence (AI) model. It is switched on by a home administrator with the owner role after reading the information card (we record the version of the card, the person and the time). The manager handles matters from the escalation chain: it reminds of tasks, hands them over to people on shift, reschedules deadlines, closes matters with a reason given by the assignee, writes to workers and passes matters to the administrator; it approves purchase requests only according to the administrator's rules. It does not evaluate workers and does not make decisions on the terms of their work. Its messages and actions may contain errors.

What goes to the AI model. Only the data of one home needed for current matters: the titles, types and deadlines of open reports, the first names of assignees, their languages and reactions in the matter from the last 7 days, reasons for skipping tasks, information on whether there is a photo (without the photo itself), today's schedule (who is on shift, in which position and during which hours), up to 10 most recent messages from workers' threads with the AI manager from the last 48 hours, purchase requests awaiting approval together with the purchase rules, the administrator's instructions for the manager, the time zone and language of the administrator. The following do not go to the model: the home's address, telephone numbers, e-mail addresses, the balance, photos, statements, other chat conversations or data of other homes.

Model provider. Anthropic PBC (USA) on the Operator's account – also in a home with its own API key. With respect to the data of workers and other persons for whom the home administrator is the controller, Anthropic acts as a further processor, and the Operator – as a processor under Annex 2 to the Terms of Service; the transfer to the USA takes place on the basis of standard contractual clauses (section 5g). The Operator does not use this data for marketing, profiling or training models.

Workers. In its first message to a given person, the AI manager introduces itself as artificial intelligence and informs them that the home owner sees the conversation; its messages are marked “Lokavi AI”. Before the manager is switched on, the home administrator informs the workers about this function – the App provides ready-made information, which the workers confirm. A worker may write directly to the home administrator about any matter, and submits an objection to the handling of their matters by the AI manager to the home administrator or to the Operator (section 7).

Log. Each action of the AI manager (type of action, matter, result, a short explanation for the administrator) and each of its runs (time, model, number of tokens, cost) is recorded and visible to the home administrator in the App and in the weekly report. Technical logs do not contain the content of messages or task titles.

Switching off. The home administrator switches off the AI manager at any time with a single button; from that moment the manager does not perform any actions, and the home's data no longer goes to the model.

6. How long data is stored

• photos from check requests – deleted automatically after 30 days; other photos – after 90 days (the home administrator may shorten these periods);
• tasks, registers, reports, chat – for as long as the home exists in the App and up to 12 months after the person is removed from the home;
• account – until it is deleted by the user; after account deletion, account data is erased within 30 days, entries in homes (e.g. ticked-off tasks) remain without a link to the account, and the e-mail address stored for the person in the home is cleared;
• sessions of signed-in devices – deleted after signing out, disconnecting the device or unlinking the account from the person; a session unused for 120 days expires and is automatically deleted;
• technical logs – up to 12 months;
• agent balance history, subscription and payment data – 5 years from the end of the calendar year in which the tax payment deadline expired (Article 70 § 1 and Article 86 § 1 of the Tax Ordinance, Article 112 of the VAT Act), including after the home or account is deleted – in that case without a link to the home and the person; run details that do not constitute accounting evidence – until claims become time-barred;
• statements made before payment and statements of withdrawal from the contract – until claims under the contract become time-barred, including after the home or person is deleted;
• agent screenshots – 30 days; orders and run results – for as long as the home exists; list photo and dictated text – not stored;
• earlier store selections (simplified item name, store and category, saved for the home owner's account and shared across the owner's homes) – until the owner's account is deleted (they are deleted together with the account), and where the account is no longer linked to any person in a home – no later than the following day; model responses in store selection (model, store, category, confidence, time, cost; without the item name) – for as long as the home exists;
• content reports and appeals – until claims related to the decision become time-barred;
• record of the granted starter gift (account identifier) – also after the home and account are deleted, solely so that the gift is not granted again;
• record of a sent balance e-mail (home, type, date; without the address) – for as long as the home exists;
• own API key for the model provider (ciphertext) – until it is deleted or changed by the home administrator or the home is deleted;
• register of decisions on marketing consents – until consent is withdrawn, and then as evidence for the limitation period for claims, including after account deletion (an exception to the deletion of account data within 30 days);
• home scan frames – deleted automatically after 30 days; frames showing people or documents are not stored;
• schematic room model (outline, doors, windows, position of furniture) – until the room is changed or deleted;
• uploaded home plan – without a time limit, until you delete it (“Delete plan”);
• item register and crops – until an item is deleted by the administrator or a household member, at most for as long as the home exists in the App; entries rejected in “To review” are marked inactive (so that the same scan does not add them again) and are deleted together with the home;
• messages of the virtual AI manager and workers' replies – as for chat (for as long as the home exists in the App and up to 12 months after the person is removed from the home); the log of actions and runs of the AI manager – for as long as the home exists in the App.
• reports of AI content – we close an unprocessed report at the latest after 3 months, and delete closed reports 12 months after closing; earlier – together with the home.

7. User rights

Everyone has the right of access to their data, to rectification, erasure, restriction of processing and portability of the data, the right to object to processing based on legitimate interest, and the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa). For matters concerning data entered in a specific home, the administrator of that home will be able to help most quickly; you can also write to the Operator.

Consent can be withdrawn at any time, as easily as it was given: More → Marketing consents, the account page or an e-mail to the Operator; withdrawal does not affect the lawfulness of processing carried out before it. Everyone has the right to object to profiling.

Account deletion: on the sign-in page (start), after signing in – “Delete account” (from the App: More → My account → “Account (Apple / Google / email): consents and account deletion”), or by e-mail to the Operator. The home administrator can deactivate a person in Settings → People and delete the entire home in Settings → Home.

8. Children

Only adults may create e-mail/Apple/Google accounts. A child's (household member's) profile is created by a parent or guardian who is the home administrator; such a profile does not require an account or an e-mail address, and the profile is fully controlled by the parent. Children sign in with a PIN or a one-time QR code that the administrator or coordinator displays on their own device. Linking a profile with an Apple or Google account is intended for adults (Apple and Google do not offer this sign-in to persons below the age required by the providers), so the administrator should not enter a child's e-mail address.

9. Security

Connections are encrypted (HTTPS). Passwords and PINs are stored only as cryptographic hashes. Access to data in the database is restricted by isolation between homes at the database level. After 5 incorrect PIN attempts, the account is temporarily locked. The shopping agent and list reading are marked in the App as artificial intelligence (AI) systems: the agent's messages, questions and notifications are labelled “AI agent”.

10. Changes

The Operator will announce material changes to this policy in the App. The current version is always available at the address of this page. The rules for the agent balance, subscription and payments are set out in the Terms of Service.

11. Language versions

This policy is available in several languages. The original text is the Polish version; versions in other languages are translations prepared using an AI tool. If the versions differ, the Operator applies the one that is more favourable to the data subject. Rights under the GDPR apply to the same extent regardless of the language version.