Privacy Policy

Last updated: 08 August 2025
Effective as of: 08 August 2025

Controller (we/us):
Michał Sztuka (Appfero)
ul. Nadwarciańska 50, 98-324 Toporów, Poland
VAT ID (NIP): PL8322083763
Contact: support@appfero.com

Merchant of Record (payments/invoicing/refunds):
Paddle.com Market Limited, 70 Wilson Street, London, EC2A 2DB, United Kingdom (“Paddle”).

Distribution platform (where applicable):
JetBrains s.r.o. (“JetBrains”) operates JetBrains Marketplace. JetBrains and Paddle are separate, independent controllers for their respective processing.

Summary of Key Points

We collect minimal personal data, primarily from Paddle to validate licensing and manage subscriptions.
Sources: you (e.g., support emails), Paddle (payments/subscriptions), and JetBrains (licensing/marketplace metadata where applicable).
We do not collect operational or tracking data from Plugin usage. Your YouTrack data stays in your environment.
We do not knowingly collect data from users below the local digital age of consent (13–16 depending on country; e.g., up to 16 in parts of the EU).
No analytics. No marketing trackers. No cookies except strictly necessary ones. We do not respond to “Do Not Track” signals.
GDPR/UK GDPR and CCPA rights are respected.
Retention: accounting/payment data per Polish law (5 tax years from the end of the calendar year), support emails up to 12 months.

1) What We Collect and Why

We act as an independent controller for the limited data we receive.

1.1 Data we may receive from Paddle (Merchant of Record)

Purchaser name, email, country (for tax/VAT), transaction details (plan, price, dates, status), order/invoice IDs.
Purpose: license validation, subscription management, invoicing queries, compliance (tax/accounting).
Legal bases (GDPR/UK GDPR): contract performance, legal obligation, legitimate interests (fraud prevention, service integrity).
We do not receive or store full payment card details; Paddle processes them directly.

1.2 Data we may receive from JetBrains (where applicable)

Marketplace/license metadata (e.g., marketplace account email, license status, plugin listing info).
Purpose: distribution and licensing where JetBrains Marketplace is used.
Legal bases: contract performance, legitimate interests.

1.3 Data you provide directly

Support emails and their contents; optional diagnostic attachments you choose to share.
Purpose: responding to requests, troubleshooting, improving reliability.
Legal bases: contract performance or legitimate interests (support).

1.4 Data we do not collect

No operational/project data from the Plugin’s runtime (Cloud on JetBrains or Server on your infra).
No behavioral analytics, tracking pixels, or advertising identifiers.

2) Minors

We do not knowingly collect or process personal data from individuals below the local digital age of consent for online services (13–16 depending on jurisdiction). If we discover such data, we will delete it.

3) Retention

Payment & accounting records: kept for 5 tax years counted from the end of the calendar year in which the obligation arose (per Polish law).
Support correspondence: retained up to 12 months, then deleted or anonymized.
Longer retention may occur where required to establish/exercise/defend legal claims.

4) Your Rights

Under GDPR/UK GDPR, you may: access, rectify, erase, restrict, object, and port your personal data.
For California (CCPA/CPRA) residents: rights to know/access, delete, correct, and to opt‑out of sale/share (we do not sell or share personal data as defined by CCPA). We also do not use personal data for cross‑context behavioral advertising.

How to exercise: email support@appfero.com. We may request information to verify your identity. We respond within applicable statutory deadlines (typically 1 month under GDPR).
If your request concerns data controlled by Paddle or JetBrains, we will indicate this and you should submit the request directly to that controller.
You may lodge a complaint with your local data protection authority. In Poland: UODO (President of the Personal Data Protection Office).

5) Cookies and Tracking

We do not use analytics or marketing cookies.
Any strictly necessary cookies are session‑based, non‑profiling, and used solely for security or essential functionality (e.g., CSRF protection).
We do not respond to browser “Do Not Track” signals.

6) International Transfers & Subprocessors

We may transfer data outside the EEA/UK only with appropriate safeguards (e.g., Standard Contractual Clauses or equivalent).

Categories of subprocessors (limited to what’s necessary):

Payments: Paddle.com Market Limited — order/billing/refunds.
Email hosting & delivery: Zoho Mail — handling inbound/outbound emails to our domains.
Hosting/website delivery: Vercel — hosting static pages/landing pages (no analytics by default).

Subprocessor changes: We will post a notice on this page at least 14 days before adding or replacing a subprocessor in a way that materially affects you.

7) Security

We use appropriate technical and organizational measures, including transport encryption (TLS), least‑privilege access, and secure key management. No method is 100% secure; residual risk remains.

8) Sharing and Disclosure

We do not sell or rent personal data. We share data only with:

Paddle (as Merchant of Record),
Our subprocessors listed above (under data processing agreements),
Authorities where required by law, court order, or to protect our rights.

9) Changes to This Policy

We may update this Privacy Policy. Material changes will be communicated with notice (e.g., posting a new effective date and/or email to admin contacts). Continued use after the effective date means you accept the changes.

10) Governing Law

As per the EULA and Terms of Service: Polish law applies; mandatory consumer protections in your country of residence remain unaffected.

11) Contact

Support: support@appfero.com
Mailing address: Michał Sztuka (Appfero), ul. Nadwarciańska 50, 98-324 Toporów, Poland