Data controller and contact
The controller for account, sign-in and contract administration data is Soft-Yoo Piotr Kosmala, registered address: ul. Malechowska 10, 78-111 Sianożęty, Poland, tax identification number (NIP): 6711769643. For data matters, write to [email protected] or the registered address. We have not appointed a Data Protection Officer.
A company that adds its customers', workers' or other people's data to projects and determines its purpose is the controller of that data. Kaldrix provides a tool for processing it. For project content or access matters, also contact the company that added the data. This policy does not replace data processing terms required for such cooperation.
The data we receive
- Registration and profile: email address, first and last name, account or company details, language and, if provided, tax number and profile picture. For password sign-in we store a protected password hash, not your password in plain text. Connecting Google sign-in gives us data needed to identify the account, including its identifier, email and profile details.
- Team: memberships, roles, permissions, invitations and data provided by the person inviting you or managing the company.
- Application work: projects and their addresses, plans and models, measurements, estimates, tasks, documents, photos, materials and other content you add or an authorised person shares with you. Files can contain personal data in their content and descriptions.
- Security: sign-in time and result, sign-in method, IP address, device and browser information, active sessions, security changes and, where available, approximate location based on the IP address. This is an approximate area, not phone location tracking.
- Account administration: trial or granted access status and end date, acceptance of registration terms, deletion requests and correspondence.
- Options you enable: data needed to connect an external service you choose, the access you grant, and a delivery address for device notifications.
Data comes from you, people working within an account or company, the sign-in provider you choose and your device. Its scope depends on the features you use. Optional fields are not required.
Purposes and legal bases
| Purpose | Basis |
|---|---|
| Creating and maintaining your account, sign-in, feature access, the trial and leaving | Performing a contract or taking steps at your request before it — GDPR Article 6(1)(b). |
| Managing company staff and collaborator access, and contact with its representative | GDPR Article 6(1)(f); the legitimate interest is working with the company and managing access. Content entrusted by the company is processed on its behalf. |
| Account protection, sign-in history, abuse detection and security notifications | GDPR Article 6(1)(f); the legitimate interest is protecting the application and its users. |
| Replying to messages and complaints | GDPR Article 6(1)(b) for contract matters; Article 6(1)(c) for a legal obligation; for other correspondence, Article 6(1)(f) — handling enquiries. |
| Meeting legal obligations and lawful requests from competent authorities | GDPR Article 6(1)(c). |
| Establishing, exercising or defending legal claims | GDPR Article 6(1)(f); the legitimate interest is protecting rights. |
We do not base all account operation on consent to data processing. A newsletter needs a separate subscription. Payments are disabled at launch.
AI assistant in the help window
In the help window, we use an AI assistant to answer questions about Kaldrix and handle support requests. AI answers can be wrong; check them before use. Do not include passwords, access tokens or unnecessary personal data about other people.
We process the content of your request, email address, company name, account or company identifiers and the address of the page concerned to provide support. The request and page address may contain personal data. Authorised support staff and providers of communication and AI services may access these data as necessary.
We keep conversations in the help window for 14 days. We do not use their content to train models or share it for that purpose. The How long we keep data section describes separate retention rules for data needed to handle a matter, meet legal obligations or deal with claims.
For contract matters, handling questions and support requests is based on performing the contract under GDPR Article 6(1)(b). For other matters, Article 6(1)(f) applies; our legitimate interest is handling correspondence. We meet legal obligations under Article 6(1)(c).
The rights described below also cover data in questions and support requests. Ask [email protected] about recipients, processing locations, retention periods, transfer safeguards or exercising your rights.
Sign-in, device storage and notifications
We use necessary cookies for sign-in. Normally, a session expires after 7 days of inactivity and the sign-in cookie is valid for 7 days from issue. You may need to sign in sooner, for example after security changes or signing a device out.
Your browser remembers settings such as language, views, recently opened projects and selected supporting data. Some settings remain until changed or cleared with website data. You can clear them in your browser; this may sign you out and reset settings. Signing out or deleting an account does not replace clearing local data on a shared device.
You enable device notifications separately. You can revoke permission in your browser and turn notifications off in the application. The information website's analytics settings are explained in its separate policy.
Sign-in history and location
Security history lets you check sign-ins and security changes. We infer an approximate town or city from the IP address when a suitable database is available. It may be inaccurate or unknown, for example on a company network or a connection that hides its address. We do not use your device's precise location for this. An IP address alone does not prove who used an account.
We normally keep security history for 90 days. You can check active sessions and sign other devices out. Notices about suspicious sign-ins or security changes protect your account and are not advertising.
How long we keep data
- Account and access: while the account is maintained and related matters are handled. A trial ending makes the account read-only; it does not automatically delete data.
- Projects, documents and team data: while the account is used or until the relevant content or account is deleted within the applicable scope. Other authorised people may still need company data after a team member leaves.
- Security history: normally 90 days. Active sessions expire or are revoked according to sign-in settings.
- Deletion: with delayed deletion, you normally have 7 days to cancel before deletion starts. Relevant parts of the service delete data in stages. A minimal record of a completed deletion normally remains for 30 days after completion.
- Correspondence, complaints and claims: while handling the matter, then as necessary to meet legal obligations or establish, exercise and defend claims.
- Technical data used to maintain and protect the service: as necessary for those purposes, taking account of incident investigation and legal obligations.
Deleting a company and deleting the entire sign-in account have different scopes. Check the application's description before confirming. Deleting data from Kaldrix does not delete copies previously downloaded by a recipient or kept in an external service you control.
Your rights
Under the GDPR's conditions, you may request access and a copy, correction, erasure, restriction and data portability. Where we rely on legitimate interests, you may object on grounds relating to your particular situation. Where consent is the basis for an activity, you can withdraw it at any time without affecting the lawfulness of earlier processing.
Write to [email protected]. We may request information needed to verify your identity and understand the request. Do not send your password. If the matter concerns data controlled by your company or another user, we will explain the need to contact that controller.
You can complain to the President of the Polish Personal Data Protection Office. Find information at uodo.gov.pl.
Providing data and access decisions
Providing the data needed to create an account and sign in is voluntary, but we cannot provide these services without it. You add other data according to your chosen features and cooperation. Special category data, such as health data, is not required for ordinary account use.
The system uses permissions and access dates to make features available. If you see an incorrect refusal or date, contact us to have the matter checked.
Policy version
The policy's date and version appear on this page. If data use changes, we will update the information and provide additional explanation where the law requires it. A new policy alone is not consent to a new purpose that requires consent. The application terms set out account use rules.