This version takes effect on 24 October 2026. Until then, the previous version applies.
This Privacy Policy describes how FUMO – Mateusz Fajst (“Elean”, “we”, “us”, or “our”) collects, uses, and protects your personal data when you use the Elean platform at elean.app.
We process your personal data in accordance with Regulation (EU) 2016/679 (GDPR) and the Polish Act of 10 May 2018 on the Protection of Personal Data.
We do not make decisions about you based solely on automated processing (profiling) that would produce legal effects or similarly significantly affect you.
Data Controller
The controller of your personal data is:
FUMO – Mateusz Fajst
al. Jana Pawła II 43A/37B, 01-001 Warsaw, Poland
NIP: 7292752057 | REGON: 526628843
Email: [email protected]
Definitions
-
Personal data — any information relating to an identified or identifiable natural person.
-
Controller — FUMO – Mateusz Fajst, who determines the purposes and means of processing your personal data.
-
Sub-processor — a third-party service provider processing personal data on our behalf.
-
Cookies — small text files stored on your device when you visit elean.app.
-
Service — the Elean platform accessible at elean.app.
-
User — any person visiting elean.app or using the Service.
What Data We Collect
We collect only the data necessary to provide the Service.
Our Service is not directed to individuals who have not reached the age of majority in their jurisdiction. We do not knowingly collect personal data from individuals under the age of majority. If you are a parent or guardian and you are aware that your child has provided us with personal data without your consent, please contact us at [email protected]. If we become aware that we have collected personal data from any individual who has not attained the age of majority, we will take immediate steps to remove that information from our servers and terminate the associated account.
Data you provide directly
- Email address — required for registration and authentication;
- Profile details — display name, avatar and job title; all optional and visible to other members of your Workspace;
- Subscription data — received from DodoPayments: customer and subscription identifiers, plan, status and related dates (e.g. activation, renewal, cancellation). Used solely to manage your Workspace’s paid plan. Billing details (name, company name, tax number, address and payment data) are collected and processed directly by DodoPayments as Merchant of Record;
- Workspace and Project names and slugs — created by you during onboarding;
- Content and tasks — any data you create, upload, or generate within the Service.
Data collected automatically
- IP address and approximate location — collected by our server infrastructure (UpCloud / Cloudflare);
- Browser type and operating system — collected via server logs and analytics;
- Website usage data (elean.app marketing pages) — pages visited, links and buttons clicked, the referring site and campaign parameters, and page performance measurements (Core Web Vitals) — collected via PostHog. If you accept analytics cookies, a PostHog cookie lets us recognise your return visits and we derive an approximate country from your IP address, which is then discarded. If you decline, visits are counted without any cookies, using a hash of your IP address and browser that changes every day and is not stored;
- Application usage data — actions in the Service such as signing up, completing onboarding or creating a project, linked to your account ID (never your name or email address), and anonymous screen-level statistics collected without cookies — processed via PostHog. You can object to this at any time by writing to [email protected];
- Error and performance data — error reports (error type, stack trace, the page or endpoint involved and your account ID) and performance traces of requests, used to keep the Service stable and fast. The contents of your tasks, comments and requests are not included — processed via PostHog;
- Authentication data — login events, session tokens — processed by Stytch Inc.;
- Account activity data — the time your account was last active and the calendar days on which it was active, linked to your account ID and the Workspace you were using. No IP address, device data or browsing history is stored with these records. Used for internal usage statistics (e.g. daily and monthly active users) and to apply the inactivity rules described in Section 5.
Data we do NOT collect
- We do not collect phone numbers;
- We do not collect bank account numbers — payments are handled entirely by DodoPayments as Merchant of Record;
- Social media profiles — links to X and Discord in our footer are simple redirects. Clicking them does not activate any social media tracking widgets or transmit any additional personal data to us.
How We Use Your Data
We process your data only for specific, legitimate purposes. Below is a full list of purposes and the legal basis for each under GDPR.
| Purpose | Legal basis |
|---|---|
| Creating and maintaining your account | Art. 6(1)(b) — performance of a contract |
| Providing access to the Service | Art. 6(1)(b) — performance of a contract |
| Managing your subscription status (via DodoPayments) | Art. 6(1)(b) — performance of a contract |
| Applying Workspace inactivity rules | Art. 6(1)(b) — performance of a contract |
| Responding to support requests | Art. 6(1)(b) — performance of a contract |
| Sending service-related notifications | Art. 6(1)(b) — performance of a contract |
| Fulfilling legal obligations (e.g. tax, accounting) | Art. 6(1)(c) — legal obligation |
| Notifying users about data breaches and security incidents | Art. 6(1)(c) — legal obligation |
| Establishing or defending legal claims | Art. 6(1)(f) — legitimate interest |
| Website analytics without cookies (PostHog) | Art. 6(1)(f) — legitimate interest |
| Website analytics with cookies, incl. ad campaign attribution | Art. 6(1)(a) — consent |
| Application usage analytics (PostHog) | Art. 6(1)(f) — legitimate interest |
| Error tracking, logs and performance monitoring | Art. 6(1)(f) — legitimate interest |
| Internal usage statistics based on account activity data | Art. 6(1)(f) — legitimate interest |
| Sending marketing communications | Art. 6(1)(a) — consent |
How Long We Store Your Data
We retain your personal data only for as long as necessary for the purposes described in this Policy or as required by applicable law.
| Data type | Retention period |
|---|---|
| Account data (email, name) | Anonymized immediately upon account deletion request. Inactivity is assessed at the Workspace level: if no member of a Workspace has logged in for 180 days, a warning email is sent to the Workspace owner; if no member logs in within 30 days of that notice, the Workspace and all associated data are permanently deleted (total: 210 days from the last login by any member). This does not apply while the Workspace has an active paid Subscription, regardless of individual login activity. If you stop being a member of any Workspace — because you were removed from it or because it was deleted — we notify you by email; if within 24 hours of that notice you have not created your own Workspace, joined another one or been invited to one, your account data is anonymized. |
| Account activity data | For the duration of the account. Upon account deletion, activity records are kept only linked to the anonymized account, with no identifying data, and are used solely for aggregated statistics |
| Content and tasks (Client Data) | Deleted together with the Workspace. If you delete your account while being a member of a Workspace owned by someone else, content you created in that Workspace remains part of it, and your name is replaced with an anonymous label (e.g. “Deleted User”), including in Workspace audit logs |
| Backups | 7 days (rolling) |
| Subscription data | Deleted together with the Workspace. All billing, invoicing and payment data is retained by DodoPayments as an independent controller — see dodopayments.com/legal/privacy-policy |
| Legal claims | For the duration of the statute of limitations, not exceeding 3 years from the termination of the Main Agreement |
| Support correspondence | 3 years from the date of last contact |
| Server logs | 90 days |
| Analytics and error data (PostHog) | Up to 7 years (PostHog’s fixed retention period). Linked only to a random identifier or your account ID, never to your name or email address. Data linked to your account ID is deleted when your account is deleted |
| Performance traces (PostHog) | 90 days |
| Analytics data (Umami, being phased out) | Retained on self-hosted infrastructure; no fixed expiry — anonymized by default, no personal identifiers stored |
| Authentication data (Stytch) | For the duration of the account + as per Stytch’s retention policy |
Recipients
We transfer personal data to other entities only to the extent necessary for the performance of the Agreement, to fulfill legal obligations imposed on the Controller, or within the scope resulting from the legitimate interests pursued by the Controller. Your data may be transferred to the following categories of recipients:
- Infrastructure and Hosting Providers: Entities ensuring server maintenance and secure storage of data and backups (UpCloud Ltd, Cloudflare R2).
- Email Delivery: Transactional and notification emails are sent via Amazon Web Services EMEA SARL (Amazon SES, eu-central-1 region, Frankfurt, Germany). Data is processed within the EU — no transfer outside the EEA.
- Authentication Service Providers: Entities handling secure login and account management (Stytch Inc.).
- Payment and Billing Partners: An independent data controller operating in the Merchant of Record model, responsible for processing transactions, taxes, and issuing invoices (DodoPayments). When you start a checkout, we pass your email address to DodoPayments; billing details are then provided by you directly to DodoPayments. We store only subscription data (customer and subscription identifiers, plan, status and related dates). Your billing name, email, phone number and a summary of your payment method (e.g. card brand and last four digits) are retrieved from DodoPayments only to display them in your Workspace’s billing settings and are not stored by us.
- AI Solution Providers: Entities providing artificial intelligence technologies that support platform features (Anthropic, PBC – Claude API); this data is not used for model training.
- Customer Support Platform: Intercom, Inc. (55 2nd Street, 4th Floor, San Francisco, CA 94105, USA) — providing customer support functionality (live chat and ticketing) within the logged-in application. Intercom is activated only for users who have given explicit consent (Art. 6(1)(a) GDPR). Data collected by Intercom includes your name, email address, company name, subscription plan, pages visited within the application, session activity, browser type and version, operating system, and approximate location (city and country). This data is used solely for the purpose of providing technical support. Data is transferred to the USA on the basis of the EU-U.S. Data Privacy Framework (Art. 45 GDPR). You may withdraw your consent at any time via Settings → Security in the application. For more information, see Intercom’s Privacy Policy, Data Processing Agreement, and Security Practices.
- Analytics Providers: PostHog, Inc. — website and application analytics, error tracking, logs and performance monitoring. Data is stored in PostHog’s EU Cloud (AWS, Frankfurt, Germany); PostHog’s AI features, which would involve providers outside the EU, are disabled. PostHog, Inc. is a US company; any access from outside the EEA is covered by Standard Contractual Clauses. IP addresses are not stored. For more information, see PostHog’s Privacy Policy. While we phase it out, self-hosted analytics (Umami) also runs on our own infrastructure in Poland — no personal data is shared with third parties through it.
- Collaborators and Advisors: Persons authorized by the Controller to provide technical or legal support for the service, bound by confidentiality obligations.
- Public Authorities: In cases where we are legally obliged to provide your data under applicable law.
In the case of data transfers to third countries (e.g., the USA), such transfers take place based on an adequacy decision (EU-U.S. Data Privacy Framework) or Standard Contractual Clauses.
Your Rights
Under GDPR, you have the following rights regarding your personal data:
| Right | What it means |
|---|---|
| Access (Art. 15) | You can request a copy of your personal data |
| Rectification (Art. 16) | You can request correction of inaccurate data |
| Erasure (Art. 17) | You can request deletion of your data (“right to be forgotten”) |
| Restriction (Art. 18) | You can request we limit processing of your data |
| Portability (Art. 20) | You can request your data in a machine-readable format |
| Objection (Art. 21) | You can object to processing based on legitimate interest |
| Withdraw consent (Art. 7(3)) | You can withdraw consent at any time for consent-based processing (e.g. marketing communications) |
The right to erasure does not apply to data we are required to retain to comply with a legal obligation or to establish, exercise or defend legal claims (Art. 17(3)(b) and (e) GDPR), for the periods described in Section 5.
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days of receiving your request, in accordance with GDPR Art. 12(3).
You also have the right to lodge a complaint with
the Polish Data Protection Authority (PUODO):
Urząd Ochrony Danych Osobowych
ul. Stawki 2, 00-193 Warsaw
uodo.gov.pl
Cookies
Cookies are small text files stored on your device when you visit elean.app. Strictly necessary cookies are always set. Analytics cookies are set only if you accept them in the cookie banner on elean.app; you can change your choice at any time via “Cookie preferences” in the bottom corner of the website. We do not use marketing cookies.
The application itself does not set analytics cookies: usage in the Service is measured on our servers and without cookies (see Section 3.2).
Cookies we use
| Cookie | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
| Session token | Stytch | Authentication | Strictly necessary | Session |
cf_clearance |
Cloudflare | Security and DDoS protection | Strictly necessary | Up to 1 year |
cc_cookie |
Elean | Remembers your cookie choice | Strictly necessary | 6 months |
__ph_opt_in_out_<id> |
PostHog | Remembers your analytics choice | Strictly necessary | 1 year |
ph_<id>_posthog |
PostHog | Recognises return visits for website analytics | Analytics — only with consent | 1 year |
ad_ref |
Elean | Records that a visit came from an ad campaign | Analytics — only with consent | 30 days |
Data Security
We implement appropriate technical and organizational measures to protect your personal data, including:
- encryption of personal data in transit (TLS/SSL);
- encryption of personal data at rest (AES-256), including databases, files, and backups;
- pseudonymisation of personal data where technically feasible;
- storage of data in the European Union (Cloudflare R2, EU region; UpCloud Ltd, Poland — PL-WAW1 region);
- access controls limiting who can access personal data;
- authentication handled by Stytch, a SOC 2 Type II and ISO 27001 certified provider;
- measures ensuring confidentiality, integrity, availability and resilience of processing systems and services, including access controls, audit logging, network security, and infrastructure redundancy;
- the ability to restore the availability of and access to personal data in a timely manner in the event of a physical or technical incident, taking into account defined recovery time and recovery point objectives appropriate to the nature of processing;
- a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of processing, including periodic backup restoration tests, security assessments, and continuous monitoring and logging;
- daily backups retained for 7 days. Backups kept for 7 days serve solely for disaster recovery purposes; following any system restoration, the Controller/Processor shall promptly re-execute the deletion instructions; after 7 days, restoring the data is technically impossible.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay, in accordance with GDPR Art. 33-34.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes via email or an in-platform notification at least 14 days before the changes take effect.
The current version is always available at https://elean.app/legal/privacy-policy.
Contact
If you have any questions about this Privacy Policy or wish to exercise your rights, contact us:
FUMO – Mateusz Fajst
al. Jana Pawła II 43A/37B, 01-001 Warsaw, Poland
NIP: 7292752057
Email: [email protected]
Website: https://elean.app/contact