Version 0.3 · Last updated: 2026-10-22
The data controller is DajTermin.pl, trading as AppealNotes, Chmieleniec 12, 30-348 Kraków, Poland. Privacy contact: crippton+al@gmail.com (subject line "Privacy request"). We are established in Poland (EU), so no EU representative under GDPR Art. 27 is required. We do not currently have a UK establishment or UK representative; if we start targeting UK users at scale we will appoint one as required by UK GDPR Art. 27.
We collect as little as possible. The table below reflects the site as implemented today:
| Data | What exactly | Where it is stored / where it comes from |
|---|---|---|
| Free diagnosis form | Platform, account type, country, email address, your description of what happened (free text) | Stored in our Cloudflare D1 database (Cloudflare Pages Functions endpoint /api/lead); submitted by you |
| Consent record | Your 18+/terms confirmation and privacy confirmation, the terms version shown to you, and the consent timestamp | Stored with your form submission in D1 |
| Attribution data | The page path you submitted from, UTM campaign parameters if present in the link you used, and your browser user-agent string | Stored with your form submission in D1 |
| Paid orders | Email address, name/billing details you give Stripe, pack/tier, amount, order ID and payment status; we do not receive your full card number | Stripe, our payment processor |
| Communications | Emails and attachments you choose to send us for your case | Our support mailbox (Google Gmail), accessed by us |
| Local browser storage | The email address you typed in the form may be saved in your own browser's local storage so that Stripe checkout can prefill it. It stays on your device and is not sent to us again by that feature. | Your browser only |
| Cookieless counters | Event type (page view, form start, form submit, checkout click), page path and pricing tier only. No IP address, no cookie ID, no user-agent, no cross-site tracking. | Stored in aggregate form in D1 via /api/hit; sent by your browser unless you have Do Not Track enabled |
| Technical request data | Our hosting provider processes standard request data (including IP address) transiently to deliver pages and protect the service, under Cloudflare's own policies. | Cloudflare; we do not store IP addresses in our own database |
What we never ask for and do not want: your password, one-time/2FA codes, recovery codes, session cookies, remote access to your account or device, full payment card numbers, and ID documents. If you send any of these by mistake, contact us and we will delete them. If a platform needs identity documents, send them directly through the platform's official verification form, not to us.
| Purpose | Legal basis (GDPR/UK GDPR) |
|---|---|
| Reply to your free diagnosis request and prepare your plan | Steps taken at your request before a contract (Art. 6(1)(b)) and our legitimate interest in responding to enquiries (Art. 6(1)(f)) |
| Deliver a paid pack and provide customer support | Performance of our contract with you (Art. 6(1)(b)); legal obligation for invoices and tax records (Art. 6(1)(c)) |
| Keep records, prevent fraud, abuse and chargebacks, secure the site | Legitimate interests (Art. 6(1)(f)) |
| Measure aggregate traffic and form activity during our validation test | Legitimate interests (Art. 6(1)(f)) in understanding whether the service is useful; the counters store no IP address or cookie ID |
| Optional emails about the service (only if you opt in) | Consent (Art. 6(1)(a)), which you can withdraw at any time |
We do not use your data for automated decisions that significantly affect you, and we do not sell it or share it for cross-context behavioural advertising. The age and privacy confirmations are required to submit the form; if you do not provide them, the form cannot be submitted.
We use service providers ("processors") that process data on our behalf or as independent controllers for their own services. They are only allowed to use the data to provide their service to us:
We do not use Cloudflare Web Analytics, third-party analytics, advertising pixels or tracking scripts. We may also disclose data if required by law, to protect our legal rights, or to investigate fraud or abuse. We do not sell personal data.
Our providers may process data outside the EU/EEA (typically in the United States). Where that happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an applicable adequacy decision (including the EU–US Data Privacy Framework where the provider is certified). You can ask us for more information about the safeguards used at crippton+al@gmail.com.
When you ask us to delete data, we do so within one month (or earlier where possible), except for records we must keep by law. Email crippton+al@gmail.com with the subject "Privacy request".
We do not use cookies. Our own pages set no cookie files, and we do not run Cloudflare Web Analytics, third-party analytics, advertising pixels or cross-site trackers. Two other mechanisms are used:
/api/hit (page view, form start, form submit, checkout click) with the page path and pricing tier only — no IP address, no cookie ID, no user-agent, no cross-site tracking. If your browser sends Do Not Track, the counters are skipped.Where our checkout is provided by Stripe, Stripe's own pages set strictly necessary cookies to process payments; those are governed by Stripe's privacy and cookie policies. You can block or delete cookies in your browser settings.
If you are in the EU/EEA or UK, you have the right to: access your personal data (Art. 15), correct it (Art. 16), delete it (Art. 17), restrict processing (Art. 18), receive it in a portable format (Art. 20), object to processing based on legitimate interests (Art. 21), and withdraw consent at any time where processing is based on consent (Art. 7(3)). To exercise any of these rights, email crippton+al@gmail.com with the subject "Privacy request". We reply within one month and do not charge a fee for normal requests. You also have the right to complain to your local data protection supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO), uodo.gov.pl.
California (CCPA/CPRA), where it applies: you may have the right to know what personal information we collect, to request a copy, to request deletion or correction, to opt out of the sale or sharing of personal information, to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights. We do not sell personal information and we do not share it for cross-context behavioural advertising. Submit requests to crippton+al@gmail.com; we may need to verify your identity. If CCPA/CPRA does not apply to us (for example because our revenue and data volumes are below the statutory thresholds), we still aim to honour these requests.
The site and our services are not directed at children. Paid services are for adults 18+, and the free diagnosis form is intended for adults. The static free guides can be read by anyone. We do not knowingly collect personal data from children; if you are under 18, please do not submit the form. If we learn that we have collected data from someone under 18, we will delete it and cancel any related paid order with a refund. Contact crippton+al@gmail.com if you believe a child has submitted data.
We use reasonable technical and organisational measures to protect the data we hold: the site is served over HTTPS, access to form submissions is limited to the operator through a token-protected internal endpoint that is excluded from search engines, and we do not collect passwords or card data. No method of transmission or storage is completely secure, and email is not a perfectly secure channel — please send only what is needed and redact sensitive details in documents. If you believe your data is at risk, contact crippton+al@gmail.com immediately.
We may update this policy from time to time. We will post the new version and change the "Last updated" date. Material changes will be notified by email or a notice on the site where appropriate.
AppealNotes — DajTermin.pl, Chmieleniec 12, 30-348 Kraków, Poland. Email: crippton+al@gmail.com (subject "Privacy request"). You can also complain to the Polish data protection authority (UODO, uodo.gov.pl) or to your local data protection authority in the EU/EEA or UK.