Privacy policy
In force from December 1, 2026. We will send earlier versions on request.
Who is the controller
The controller of the data is Wisecorner Łukasz Szyszkowski, ul. Hubska 62/30, 50-502 Wrocław, Poland, tax ID (NIP) 6151754467. Contact for everything about data: contact@tunti.app. We have not appointed a data protection officer.
We are the controller of account data, billing data, data from this site and the emails we send you. The data a company enters into the application about its team (logged time, names, email addresses, approvals) we process as a processor, under the Data Processing Agreement. The controller of that data is the company.
If you are a person in a company's team and want to use your rights about such data, write to your company. You can also write to us: we will pass the matter to the company and help it deal with it.
What data we collect
We collect only what the application needs to work and to bill:
- Account: name, email address, role in the company, language, notification settings.
- Working time: logged hours, projects, tasks, the company's clients, weeks sent and approved, comments.
- Payments and invoices: company details for the invoice, information about the plan and payments, the card brand and its last four digits.
- Email: the address, subject and time of the messages the application sends (invitations, reminders, budget notices, confirmations).
- Contact and complaints: what you write to us.
- Technical logs: IP address, time and path of a request, needed for security and to find faults.
- Source of the first visit: the utm parameters of the address, the domain of the page you came from, and your answer to the question where you heard about us. We save them with the new company.
- Site statistics: the number of visits and basic details about the browser, without identifying people.
Why we process it
Each purpose has its legal basis under the GDPR and its retention period:
| Purpose | Data | Legal basis | Period |
|---|---|---|---|
| Account | name, email address, role, language | contract (Article 6(1)(b)) | until the account is deleted, and 30 days |
| Providing the service | logged time, projects, tasks, approvals | contract (Article 6(1)(b)) | until the company is deleted, and 30 days |
| Payments and invoices | company details for the invoice, plan, payments, card brand and last 4 digits | contract and legal obligation (points (b) and (c)) | 5 years from the end of the tax year |
| Transactional email | email address, content and time of the messages | contract (Article 6(1)(b)) | until the account is deleted, and 30 days |
| Contact and complaints | what you write to us, email address | contract or our legitimate interest (point (b) or (f)) | until the matter is closed and claims lapse |
| Security and logs | IP address, time and path of a request | our legitimate interest (Article 6(1)(f)) | up to 90 days |
| Site analytics | visits and browser details, without identification | our legitimate interest (Article 6(1)(f)) | aggregate data |
| Sign-up source report | utm parameters, referring domain, the answer to “where did you hear about us” | our legitimate interest (Article 6(1)(f)) | until the company is deleted, and 30 days |
Legitimate interest means for us the security of the service, finding abuse and faults, pursuing claims, and knowing where new users come from. You can object to such processing.
We do not sell data, we do not send ads and we do not profile users. We make no automated decisions.
Who processes it for us
We keep data in the European Union. We use providers who process it on our behalf under data processing agreements:
| Provider | What for | Where |
|---|---|---|
| Supabase | database and sign-in | Frankfurt, Germany |
| Hetzner | application server | Germany |
| Resend | sending email | EU and USA |
| Stripe | card payments | Ireland and USA |
| iFirma | invoices | Poland |
| Cloudflare | DNS, email at contact@, site analytics without cookies | EU and USA |
| Google sign-in and Google Calendar, only if you choose them | USA |
Stripe and Google also process part of the data as independent controllers, on their own terms. We may pass data to public authorities if the law requires it, and to legal and accounting advisers who are bound by secrecy.
Transfers outside the EEA
Most data stays in the European Union. Some providers are based in the USA: Stripe (Stripe, Inc.), Resend, Google and Cloudflare. We pass data to them only with the safeguards of Chapter V of the GDPR: on the basis of the adequacy decision for companies in the Data Privacy Framework, or the European Commission's standard contractual clauses.
You can get a copy of the safeguards by writing to contact@tunti.app.
How long we keep it
We keep account data as long as the account exists. After a company is deleted we delete its data within 30 days, except for invoices and billing data, which we must keep for 5 years from the end of the tax year.
We keep server logs for up to 90 days. Backups of the database are kept by our provider, Supabase, for its own retention periods, after which the data disappears from them.
Your rights
You have the right to access your data, to have it corrected or deleted, to restrict its processing, to data portability, and to object to processing based on our legitimate interest. If we process data on the basis of your consent, you can withdraw it at any time. Withdrawing consent does not affect what we did before.
Write to us at contact@tunti.app and we will reply within a month. You can also export the data from the application yourself.
If you think we are breaking the rules, you can complain to the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland.
Giving us your data is voluntary, but without your name and email address we cannot create an account, and without the details for an invoice we cannot sell a paid plan.
Payment data
We never see your card number: Stripe handles it. We see the card brand and its last four digits, and information about payments.
Google Calendar
If you connect Google Calendar, tunti reads the events of your calendar (title, start and end time) only to show them on the Day view, so you can log time for a meeting in one click.
We do not store the events. We store only the encrypted access tokens and the address of the Google account, and delete them when you disconnect the calendar or delete your account. An entry you add from a meeting keeps its title as the note, and the event's id and start time.
We do not share calendar data with anyone, do not use it for ads, and do not use it to train AI models. tunti's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
Security
Data is encrypted in transit. Only authorised people have access to it. We make backups of the database, and sign-in can be protected with two-step codes.
Children
The service is for companies and their teams, and people aged 16 and over can use an account. We do not knowingly collect data of younger people.
Changes to this policy
When we change the policy, we change the date at the top of this page, and we write to company administrators about significant changes.
Contact
Wisecorner Łukasz Szyszkowski, ul. Hubska 62/30, 50-502 Wrocław, Poland. Email: contact@tunti.app.