Privacy policy
This policy says what data we process in the Complizer service, why, for how long, and what rights the people concerned have. It is written from what the Service actually does.
1. Data controller
The controller of the data of people using the Service is Momentum AI sp. z o.o., ul. Olsztyńska 58, 11-500 Wilkasy (KRS 0001171902, NIP 8452007341, REGON 541679702). Contact about data: hello@complizer.eu. We have not appointed a data protection officer.
Personal data inside a company's files and documents (for example the names of contact persons at its customers and suppliers) we process on that company's behalf, as a processor, under section 10 of the Terms of service. For that data the controller is the company that uploaded it.
2. What data we process
| Data | Where from |
|---|---|
| Account: email address, password (stored as a hash, never in clear), language, role in the company, who invited the person, the dates of logging in and of confirming the address. | From the person at sign-up or when accepting an invitation. |
| Company: name, email domain, plan, tax or VAT number, address, email for invoices, the text of the "Contact us" form. | From the company's administrator in Settings. |
| Files and documents: uploaded source files and templates, prepared documents and their versions, the text read from files (kept so a file is not read twice), page thumbnails, notes on documents, who uploaded or prepared what and when. | From the company's people as they work in the Service. |
| Usage: how many documents and translations the company asked for and when, how many scans the model read; needed to account for the plan. | From the Service's operation. |
| Technical data: the IP address at sign-up and login (to limit attempts), server logs (IP address, time, page address), the cookies in section 7. | From the browser. |
We collect no data from other sources, do not profile people and take no automated decisions about them.
3. Why, and on what basis
- Running the account, preparing documents, invitations, notices about the account and the plan: performance of the agreement (article 6(1)(b) GDPR).
- Invoices and accounting: a legal obligation (article 6(1)(c) GDPR, tax and accounting law).
- Security of the Service: limiting sign-up and login attempts from one address, server logs, detecting abuse: our legitimate interest (article 6(1)(f) GDPR).
- Answering complaints and enquiries: performance of the agreement and our legitimate interest.
We send no marketing messages. The emails we send concern the account, invitations, the password and the plan.
4. Who receives the data
- The AI model provider. To read a file, prepare a document, translate it or check a list of elements, we send the content of files (text, tables, page images of scans and photos) to an Anthropic model through its API. Under the terms of that API the provider does not use the data sent to train models and keeps it only as long as handling the request and abuse monitoring require.
- The hosting provider, on whose servers the Service runs and files are stored.
- The email delivery provider, through which messages about the account go out.
- The accounting office, for invoices.
- Public authorities where the law requires it.
Conversion of Word files to PDF happens on our own servers. We do not sell data and do not share it with advertisers. People of one company see only their company's data.
5. Transfers outside the European Economic Area
The AI model provider processes data in the United States. The transfer rests on the European Commission's adequacy decision (the EU-US Data Privacy Framework) or on the standard contractual clauses in our agreement with the provider. The other recipients process data in the European Economic Area.
6. How long we keep data
- The account and the company's data: as long as the account exists. We delete the account at the company administrator's request.
- Files, documents, read text and thumbnails: until a person of the company deletes them in the Service or the account is deleted. A deleted file leaves the server at once, with its reading and thumbnails.
- A person removed from the company: access ends at once, and their address stays with the documents they prepared for as long as the company's account exists. At that person's request we delete their address and password; the documents stay with the company without their name.
- Plan usage: as long as the account exists.
- Invoices and their details: 5 years from the end of the year the invoice was issued in (tax law).
- The IP address at sign-up and login: up to one hour.
- Server logs: up to 30 days.
- Cookies: see section 7.
7. Cookies
The Service uses only the cookies it needs to work. We use no analytics or advertising tools and no third-party scripts.
| Cookie | Purpose | How long |
|---|---|---|
| sessionid | Keeps you logged in on this computer. | 30 days |
| csrftoken | Protects forms against forged requests. | A year |
| django_language | Remembers the chosen language. | A year |
8. Your rights
Every person whose data we process as a controller may ask for access to the data, its rectification, erasure or the restriction of processing, for data portability, and may object to processing based on our legitimate interest. Requests go to the address in section 1; we answer within a month. The email address and the language can be changed in Settings.
A person also has the right to lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw).
Requests about data inside a company's files and documents we pass to that company as the controller and help it fulfil them.
9. Security
The connection to the Service is encrypted (TLS). Passwords are stored only as hashes. Each company's data is separated from other companies' data and available only to that company's people, according to their roles. Sign-up and login attempts from one address are limited. Only the people who maintain the servers have access to them.
10. Changes to this policy
We tell company administrators of a material change to this policy by email. The date of the last change is at the top of the page.