1. PERSONAL DATA WE COLLECT

We collect the following categories of personal data:

• Account data: name, email address, company name and address, account credentials, and account settings that you provide when you register on our websites, in Stimulsoft Designer, or in Stimulsoft cloud services.
• Order and billing data: contact name, email address, telephone number, company name and address, tax identifiers, and order history. Payment card and bank details are processed by our payment providers; we do not store full payment card numbers.
• Support and communication data: messages, attachments, screenshots, and diagnostic information that you send to us through support tickets, email, chat, forums, or messengers.
• Website and service usage data: pages visited, links clicked, and search terms on our websites, together with device and connection data such as IP address, browser and operating system type, device identifiers, and crash data. In Stimulsoft cloud services, we do not collect detailed usage statistics.
• License activation and validation data: license key or trial identifier, product name and version, IP address, timestamps of activation and validation requests, and technical identifiers of the computer or server on which the software is installed. In older versions of our software, these identifiers include the computer name and the operating system user name. See the section LICENSE ACTIVATION AND VALIDATION below.
• AI feature data: prompts, expressions, code, and other content that you submit to AI features of our software, and the generated outputs, as described in the section AI FEATURES below.
• Advertising data: cookie identifiers and information about your visits to our websites, which our advertising partners use, only with your consent, to show you Stimulsoft ads on other websites and to measure their effectiveness.
• Marketing data: your newsletter subscription and communication preferences.
• Data from third parties: contact and order data that we receive from resellers and business partners, and data provided by other users, for example when a colleague designates you as the billing or technical contact of an organization account.

Where we need personal data to conclude or perform a contract with you, for example to create an account or process an order, we cannot provide the respective service without it. Providing other personal data is voluntary.

2. PURPOSES AND LEGAL BASES

We process personal data for the following purposes and on the following legal bases under Article 6(1) GDPR:

• to create and manage your account, provide our cloud services, software, and AI features, process orders and payments, and provide support - performance of a contract with you or steps taken at your request before entering into it (Article 6(1)(b));
• to send you service communications about your account, licenses, subscriptions, renewals, trial periods, and security, and non-promotional notices about updates available under your active subscription - performance of a contract (Article 6(1)(b)) and our legitimate interest in informing our customers (Article 6(1)(f));
• to activate our software, validate licenses, and prevent unlicensed use and fraud - performance of the license agreement (Article 6(1)(b)) and our legitimate interest in protecting our intellectual property (Article 6(1)(f));
• to keep invoices, tax, and accounting records - compliance with our legal obligations (Article 6(1)(c));
• to secure our websites and services, prevent abuse, and investigate errors and crashes - our legitimate interest in the security and reliability of our services (Article 6(1)(f));
• to improve our products and services on the basis of aggregated usage data - our legitimate interest in developing our products (Article 6(1)(f));
• to establish, exercise, or defend legal claims and enforce our agreements - our legitimate interest in protecting our rights (Article 6(1)(f));
• to send you marketing emails about Stimulsoft products and services, including newsletters, product news, release announcements, promotions, and special offers - your consent (Article 6(1)(a));
• to use analytics and advertising cookies, including remarketing by our advertising partners - your consent (Article 6(1)(a)).

Where you act on behalf of a business customer rather than as a party to the contract yourself, we process your business contact, account, and support data on the basis of our legitimate interest in establishing and managing that business relationship and providing services to the organization you represent (Article 6(1)(f) GDPR).

Marketing email consent may be given, for example, when you create a Stimulsoft account or subscribe to our newsletter. Providing consent is optional and is not required to register, use a trial, purchase our products, or maintain a subscription. Once given, consent applies to the marketing communications described above regardless of whether your subscription is active or expired, and does not need to be renewed when you make additional purchases or renew your subscription. Consent remains valid until you withdraw it.

Each marketing email contains an unsubscribe link. You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal. Withdrawal of marketing consent does not affect non-promotional service communications relating to your account, orders, licenses, subscriptions, security, or updates available under an active subscription.

Where we rely on legitimate interests, you may object to the processing as described in the section YOUR RIGHTS below. We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

3. LICENSE ACTIVATION AND VALIDATION

When you activate Stimulsoft software or sign in to your Stimulsoft account from it, and periodically afterwards, the software sends the license activation and validation data described in the section PERSONAL DATA WE COLLECT above to Stimulsoft's licensing services.

We use this data only to activate the software, verify license status, apply the limits of the licensed tier, such as the number of developers, installations, or servers, prevent unlicensed use, protect accounts, and enforce our license agreements, including to establish, exercise, or defend related legal claims. We do not use it for marketing or advertising.

4. AI FEATURES

Some of our software and services include optional AI features. When you use them, the prompts, source code, SQL queries, expressions, connection strings, and other text that you submit ("Inputs"), and the generated outputs, are processed by Stimulsoft and by our AI subcontractor. AI processing takes place in the United States under the safeguards described in the section INTERNATIONAL TRANSFERS below.

Our software sends your Inputs to our AI subcontractor, and we do not store Inputs or outputs on our servers. Stimulsoft does not use your Inputs or outputs to train AI models unless you expressly agree, and our AI subcontractor does not use them for training. Our AI subcontractor generally retains abuse-monitoring logs, which may contain Inputs and outputs, for up to thirty (30) days. Where our AI features keep the context of a conversation, our AI subcontractor also stores the conversation data for that purpose for at least thirty (30) days, in accordance with its data retention terms. Longer retention may apply where required by law or reasonably necessary to protect its services or third parties from harm.

A current list of our AI subcontractors is available on request at the email address set out in the section CONTACT below.

5. COOKIES

Our websites use cookies and similar technologies. Strictly necessary cookies are required for the websites to work, for example to keep you signed in, and do not require your consent. We use analytics and advertising cookies only with your consent, which you can give or withdraw at any time in the cookie settings on our websites. Details of the cookies we use, including their providers, are available in the cookie settings on our websites and in our Cookie Policy.

6. RECIPIENTS

We share personal data only as described in this Privacy Policy:

• Service providers that process personal data on our behalf under contracts requiring them to protect it and to use it only on our instructions, including providers of cloud hosting and infrastructure, customer support, AI services, email delivery, website analytics, security and bot protection, and IP-based country detection. A current and complete list of our service providers is available on request.
• Payment providers, which process payment and transaction data to complete your purchase and may also act as independent controllers for their own legal, regulatory, and fraud-prevention purposes, as described in their privacy policies.
• Advertising partners, which, with your consent, receive data collected through their cookies on our websites and may process it as independent controllers under their own privacy policies.
• Providers of embedded features, such as the support chat and videos, which receive data when you open them and process it under their own privacy policies.
• Resellers and business partners, where you purchase our products through them or they take part in fulfilling your order.
• Professional advisors, such as accountants, lawyers, and auditors, who are bound by confidentiality.
• Public authorities, courts, and law-enforcement bodies, where required by law or necessary to establish, exercise, or defend legal claims.
• A buyer or successor of our business, in connection with a merger, acquisition, or sale of assets.

7. INTERNATIONAL TRANSFERS

We host our websites, Stimulsoft accounts, and cloud services in the United States. Some of our other service providers and partners, including providers of AI services, customer support, analytics, and advertising, also process personal data outside the European Economic Area, in particular in the United States. Where personal data is transferred to a country that is not covered by an adequacy decision of the European Commission, we protect it with the Standard Contractual Clauses approved in Commission Implementing Decision (EU) 2021/914, supplemented by the UK International Data Transfer Addendum and the adaptations required under Swiss data protection law where applicable, and with additional safeguards where appropriate. Transfers to recipients in the United States that are certified under the EU-U.S. Data Privacy Framework rely on the adequacy decision for that framework. A copy of the relevant safeguards is available on request.

8. RETENTION

We keep personal data only for as long as necessary for the purposes for which we collected it:

• Account data: for as long as your account exists. If you delete your account, we delete the account data without undue delay; copies in backups are deleted in the ordinary backup rotation cycle. If we terminate your account, we delete the account data after the export period described in the Terms of Service.
• Order, billing, and tax records: for the retention periods required by applicable Polish tax and accounting law. Tax-related records are generally retained for five (5) years from the end of the calendar year in which the relevant tax payment fell due, subject to any applicable suspension or interruption of the limitation period and any longer statutory retention requirement.
• License records: information about the licenses and subscriptions you hold, including license keys and license tier, for as long as the license exists and thereafter until the limitation periods for related claims expire.
• Installation and activation records: for as long as the license exists and thereafter until the limitation periods for related claims expire.
• Trial records: for as long as necessary to apply the trial limits and prevent repeated use of trial versions.
• Support and communication data: for as long as necessary to handle your request and to keep a record of our support history with you, and no longer than the limitation periods for related claims.
• Marketing data: until you withdraw your consent or unsubscribe. We keep a record of your consent for as long as we may need to demonstrate it.
• Security logs, technical request logs including IP addresses, and identifiers used to prevent abuse: no longer than reasonably necessary for the protection of our services, our customers, and third parties.
• Cookie data: for the periods shown in the cookie settings on our websites.
• Records of cookie choices: two years.

We do not store Inputs and outputs of AI features; our AI subcontractor retains them as described in the section AI FEATURES above. Where the law requires us to keep personal data for longer, we keep it only for that purpose. Where specific records are needed for an ongoing dispute or investigation, we keep them until it is resolved.

9. YOUR RIGHTS

Under the GDPR, you have the right to:

• access your personal data and receive a copy of it;
• have inaccurate data rectified and incomplete data completed;
• have your data erased where there is no longer a legal basis for keeping it;
• restrict the processing of your data in the cases set out in the law;
• receive the data that you provided to us in a structured, commonly used, machine-readable format and have it transmitted to another controller, where we process it by automated means on the basis of a contract or your consent;
• object, on grounds relating to your particular situation, to processing based on our legitimate interests;
• withdraw your consent at any time, without affecting the lawfulness of processing before its withdrawal.

You have the right to object at any time to the processing of your personal data for direct marketing, in which case we will stop such processing.

You can update your account data and delete your account yourself in your Stimulsoft account settings. For other requests, contact us at the email address set out in the section CONTACT below. We may ask you to confirm your identity before acting on your request. We respond within one month; where necessary, this period may be extended by two further months, in which case we will inform you.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. In Poland, the supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, www.uodo.gov.pl).

10. ORGANIZATION ACCOUNTS

If your Stimulsoft account is part of an organization account, for example one managed by your employer, the owner and administrators of that organization account can manage your access and the data associated with your use of that organization account. Your use of our services within an organization account may also be subject to the organization's own policies. Please direct requests concerning data controlled by the organization, including Customer Content, to that organization.

11. CHILDREN

Our websites and services are intended for businesses and individuals aged 18 or older and are not directed at children. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected such data, we will delete it without undue delay. If you believe that a child has provided us with personal data, please contact us.

12. SECURITY

We use appropriate technical and organizational measures to protect personal data. No method of transmission over the Internet or of electronic storage is completely secure, and we cannot guarantee absolute security.

13. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. We will publish the updated version on our websites and indicate the date of the last revision at the top of this Privacy Policy. If we intend to process personal data for a new purpose, we will inform you before we start doing so. Where a change requires your consent, we will ask for it.

14. CONTACT

CloudReports sp. z o.o. (dba Stimulsoft)
ul. Marynin 25B/47, 01-469 Warsaw, Poland
KRS: 0000727788
EU VAT: PL5223121890
Email: This email address is being protected from spambots. You need JavaScript enabled to view it.

For questions about this Privacy Policy or to exercise your rights, contact us at the email address above. You may also lodge a complaint with a supervisory authority as described in the section YOUR RIGHTS above.