This Privacy Policy explains how we process personal data when you visit the StatSwift website, create an account, use the StatSwift service or buy a subscription. It covers:
- the website at statswift.io;
- the account and billing area at admin.statswift.io;
- the statistics application at app.statswift.io.
1. Who is responsible for your data
1.1. The controller of your personal data is BPROBOTICS sp. z o.o., ul. Jagiełka 6A lok. 1, 30-240 Kraków, Poland, KRS 0000771643, NIP 6772441782 ("StatSwift", "we", "us").
1.2. For any question about your personal data or to exercise your rights, contact us at privacy@statswift.io or by post at the address above. We have not appointed a data protection officer.
1.3. Purchases are made through Link. Paid subscriptions are sold through Link, a Stripe company, which acts as the merchant of record (see our Terms of Service). Stripe and Link process your payment and purchase data, such as your payment method, billing address and tax ID, as independent controllers under their own privacy policies: the Stripe Privacy Policy and the Link Privacy Policy. We never receive your full card number.
2. What data we process and why
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating and running your account, signing you in | Email address; name and profile picture (if you add them or your Microsoft or Google account provides them); sign-in method; passkey public credentials; sign-in times and sessions; display preferences | Performance of the contract (Art. 6(1)(b)) |
| Organizations, members and invitations | Organization name; your memberships and roles; who invited whom and when; email addresses of people invited | Performance of the contract (Art. 6(1)(b)); for invited people, our and the inviting organization's legitimate interest in letting them join (Art. 6(1)(f)) |
| Subscriptions, seats, trials and billing | Billing profile (legal name, billing email, address, country, tax ID); plan, subscription status and seat assignments; trial use; copies of subscription, invoice, payment and refund records we receive from Stripe, including payment card brand, last four digits and expiry date | Performance of the contract (Art. 6(1)(b)); compliance with accounting and tax obligations (Art. 6(1)(c)) |
| Running the statistics application | The data you analyse and the results, processed on our servers only to compute results and not kept there (see section 3); your sign-in token, checked to confirm your licence | Performance of the contract (Art. 6(1)(b)) |
| Transactional emails | Email address, name, organization name and role, sign-in links and codes, invitation details | Performance of the contract (Art. 6(1)(b)) |
| Security, accountability and fraud prevention | Records of changes to accounts, organizations, memberships, invitations, billing profiles and seats (what changed, when and by which account); records of sign-ins, sign-outs, passkey changes and staff support access; technical logs of our hosting providers, including IP addresses | Our legitimate interest in securing the service and being able to show who did what (Art. 6(1)(f)) |
| Support and complaints | Your messages and the account data needed to answer them | Performance of the contract (Art. 6(1)(b)); our legitimate interest in answering enquiries (Art. 6(1)(f)) |
| Optional website analytics | Interactions on the website, pages visited, device and browser information, session recordings (see section 6) | Your consent (Art. 6(1)(a)), which you can withdraw at any time |
| Legal claims | Data relevant to a dispute | Our legitimate interest in establishing, exercising or defending claims (Art. 6(1)(f)) |
2.1. You must give us your email address to create an account; without it we cannot provide the service. Everything else is optional or needed only for the feature you use (for example, billing details to buy a subscription).
2.2. We do not sell your personal data, do not use it for advertising, and do not send marketing emails. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
2.3. Authorized StatSwift staff can view account and organization data across the service and, for support, can act within an organization's account. Such access is limited to what is needed and is recorded.
3. Your analysis data in the statistics application
3.1. When you run an analysis, the application sends the data needed for it to our servers, which compute the result and send it back. We do not store your analysis data or results on our servers and do not write them to logs.
3.2. Your worksheets, drafts and results are saved in your browser's storage on your device (local storage and IndexedDB) so that you can continue your work. They are not synchronized to your account or to our database. You can remove them by clearing your browser's site data.
3.3. If you use the service for an organization and your analysis data contains personal data about other people, we process it on that organization's behalf as a processor under our Data Processing Agreement.
4. Where the data comes from
We collect most data from you. Some data comes from:
- Microsoft or Google, if you sign in with them: your email address, name, profile picture and account identifier;
- members of your organization, who may invite you (your email address) and assign you roles and seats;
- Stripe and Link, which send us records of your purchase, subscription, invoices, payments and refunds.
5. Cookies and browser storage
5.1. Strictly necessary storage (no consent required, because the service cannot work without it):
| Name | Where | Purpose | Duration |
|---|---|---|---|
sb-…-auth-token (may be split into several cookies) | Cookie for .statswift.io, read by the website, the account area and the application | Keeps you signed in across StatSwift sites. Contains your sign-in tokens, email address and the names of your organizations and roles | Up to 1 year, or until you sign out |
| Sign-in and checkout helpers | Local and session storage on admin.statswift.io | Remember the page to return to after sign-in, the email address a sign-in link was sent to, a pending sign-in method, passkey prompt choices, and the plan you were buying | Until sign-in or checkout completes, or until you clear them |
| Worksheets and results | Local storage and IndexedDB on app.statswift.io | Save your work in the application (section 3) | Until you delete them or clear site data |
statswift.website.analytics-consent | Local storage on statswift.io | Remembers your analytics choice, its date and the notice version | 6 months |
5.2. Optional analytics cookies are set on the website only after you accept them (section 6).
5.3. The account area and the statistics application do not use analytics or advertising cookies.
6. Optional website analytics
6.1. If you accept analytics on the website, we load Microsoft Clarity to understand how visitors navigate and to improve the website. Clarity captures interactions such as clicks and scrolling, pages visited, device and browser information, and session recordings used to produce heatmaps. This data is sent to Microsoft. Clarity's first-party cookies _clck and _clsk recognize a browser and connect page visits into a session; Microsoft documents additional cookies it may use. See Microsoft's Clarity cookie documentation and the Microsoft Privacy Statement.
6.2. Before you accept, we do not load these services, and rejecting them does not limit your use of the website. Advertising consent always stays denied.
6.3. Your choice is stored only in your browser for six months; another browser or device, private browsing or cleared storage may ask you again. You can change your choice at any time with Cookie settings in the footer or the button below. If you withdraw consent, we stop analytics, remove the website's accessible analytics cookies and reload the page. This does not erase data already sent to Microsoft or cookies on Microsoft's own domains.
6.4. Pages of the website embedded in the StatSwift sign-in page do not show the consent banner and never load analytics.
7. Who receives your data
7.1. We use the following service providers, which process personal data on our behalf under data processing agreements:
| Provider | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Database, sign-in, file storage for profile pictures, server functions | EU (Ireland), hosted on Amazon Web Services |
| Microsoft Ireland Operations Ltd. (Azure) | Hosting of the website, the account area and the statistics application | EU (West Europe) |
| Amazon Web Services EMEA SARL (Amazon SES) | Sending transactional emails | EU (Stockholm) |
| Plus Five Five, Inc. (Resend) | Sending transactional emails | Emails sent from the EU (Ireland); account and delivery records in the USA |
| Cloudflare, Inc. | Domain name service, content delivery and protection of our websites against attacks; processes IP addresses and request data | Global network, including the USA |
| Microsoft Ireland Operations Ltd. (Clarity) | Optional website analytics, only with your consent | EU and USA |
7.2. Other recipients, acting as independent controllers:
- Stripe and Link, for purchases, payments, taxes, invoices, payment support and refunds (section 1.3);
- Microsoft and Google, if you choose to sign in with them; they receive your sign-in request under their own privacy policies;
- members of your organization: owners and administrators see the names, email addresses, roles and seat assignments of members and invited people;
- public authorities, courts and our professional advisers (such as accountants and lawyers), where the law requires it or it is necessary to establish, exercise or defend legal claims.
7.3. If you upload a profile picture, it is stored at a web address that are not listed publicly but can be opened by anyone who has the link.
8. Transfers outside the European Economic Area
Some providers (Stripe, Link, Cloudflare, Microsoft, Google, Resend and the US parent of Supabase) may process data in the USA or other countries outside the EEA. Where they do, the transfer is based on an adequacy decision of the European Commission, in particular the EU–US Data Privacy Framework for certified companies, or on the European Commission's standard contractual clauses with additional safeguards where needed. You can ask us for a copy of the relevant safeguards at privacy@statswift.io.
9. How long we keep data
| Data | Retention |
|---|---|
| Account and profile data | As long as your account exists; deleted within 30 days after you ask us to delete your account |
| Organization, membership and seat data | As long as the organization exists; records of seat assignments and trial use for paid subscriptions are kept as billing records (next row) |
| Billing records (billing profiles, subscription, invoice, payment and refund records) | 5 years from the end of the calendar year in which the transaction took place, as required by Polish accounting and tax law |
| Invitations | Until accepted or expired (invitations expire after 7 days), then up to 12 months as part of the organization's history |
| Security and change records | Up to 3 years, then deleted, unless needed longer for a specific security incident or legal claim |
| Technical logs of hosting providers | Short periods set by the provider, generally no longer than 90 days |
| Support messages and complaints | Up to 3 years after the matter is closed |
| Website analytics choice | 6 months in your browser |
Data needed to establish, exercise or defend legal claims may be kept until the claims become time-barred.
10. Your rights
10.1. Under the GDPR you have the right to:
- access your personal data and receive a copy;
- rectify inaccurate data — you can change your name and profile picture yourself in your account;
- erase your data ("right to be forgotten"), for example by asking us to delete your account;
- restrict processing;
- data portability — receive the data you gave us in a structured, machine-readable format;
- object to processing based on our legitimate interests;
- withdraw consent at any time, without affecting processing before the withdrawal — for website analytics, use Cookie settings.
10.2. To exercise your rights, including to delete your account, email privacy@statswift.io from the email address of your account. We will respond within one month; in complex cases this may be extended by two further months, and we will tell you why. We may need to confirm your identity first. Deleting your account does not remove billing records that we must keep by law, and it does not delete an organization that other members still use — an organization's owner can delete the organization in the account area.
10.3. You also have the right to lodge a complaint with a data protection supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl. You can also complain to the authority in the EU country where you live or work.
11. Security
We protect data with encryption in transit (HTTPS), access controls that separate each organization's data at the database level, passwordless sign-in options, and access to production systems limited to authorized staff. No system is completely secure; if you find a security issue, please report it to us.
12. Children
The service is not intended for anyone under 18, and we do not knowingly collect their data.
13. Changes to this policy
We may update this Privacy Policy when our services or the law change. We will publish the new version on this page with a new date and, for significant changes, notify account holders by email in advance.