Privacy Policy

1. Data controller

The controller of the personal data of Users of the HeatAlgo service, and of people who contact us through the forms on heatalgo.com, is Cratun Sp. z o.o., registered office at Niekłonice 49E, 76-024 Niekłonice, registry number (KRS): 0000971816, tax ID (NIP): 4990690625, REGON: 522021073. Data protection contact: [email protected]. We have not appointed a data protection officer. This is a translation provided for convenience; the Polish version is authoritative.

2. What data we process

If the User chooses Google sign-in, Google authenticates them under its own privacy policy. Through Supabase Auth, HeatAlgo receives the account identifier and identity data needed for sign-in, including the email address and its verification status. This supports account creation and operation, not advertising. The optional business contact email is a separate field for client-facing documents; it is not an account recovery address. We record the accepted terms version and registration completion time. Two-step verification is optional; we store security status and backup-code digests, never plaintext backup codes.

Account data: e-mail address, password (stored only as a cryptographic hash, never in plain form), first and last name, and - if the User provides them - company name, logo, phone number and website address (company details are displayed on the form shared with the client and in PDF documents), plus the preferred language, units (metric or imperial) and display currency (PLN, EUR or USD). When an Account is created, we set imperial units if Cloudflare reports that the request comes from the United States; we keep only the chosen units, not the country or the IP address. The display currency is chosen the same way from the country of that first request - PLN for Poland, USD for the United States, EUR for any other country and PLN if the country is unknown - and we keep only the currency code. Before and after sign-in, the app checks the same way whether the connection comes from the United States, to show prices in US dollars first; we do not store that country or the IP address. The User can change the units and the currency at any time in the Account settings. The exchange rates used to convert prices on screen are fetched from the public table of the National Bank of Poland (NBP); no User data is sent with that request.

Project data: data entered by the User within their projects (building parameters, calculations, drawings), including the User's clients' data, if the User enters it (see section 10).

Building documents: files or text the User pastes or uploads so AI can read data from them (e.g. a building design, a window/door schedule, an energy performance certificate, or photos of such documents) - see section 4.

Data from the contact and order forms on heatalgo.com (including from people who have no Account): name, e-mail address, phone number and the message content, the page the form was sent from, and technical data sent with it: a hashed IP address, browser details, the referring page, campaign tags (UTM) and the analytics session identifier (the technical data is deleted after 30 days, section 7).

Data from the free calculators on heatalgo.com: the first name and e-mail address you give us so that we can send you the calculator result as a PDF file, and the values entered into the calculator itself (floor area, building type, insulation standard, climate zone, or room dimensions and pipe spacing). Each of the three - the heat loss calculator, the heat pump calculator and the underfloor heating calculator - shows its result on the page without these data. Providing them is voluntary and needed only to send the PDF.

Data from the newsletter form on heatalgo.com (also from people without an Account): the e-mail address and the language of the page.

Technical and analytics data: pseudonymized application usage events (account identifier, without form contents - session recordings mask form fields), the AI assistant's technical logs described in sections 4 and 7, and server logs necessary to ensure security. Messages sent from the app ("Report a problem", "Suggest a module" and help questions): the text, the address of the page it was sent from, browser details and, for a problem report, a screenshot attached automatically.

Providing account data is voluntary but necessary to conclude and perform the agreement - without it, an Account cannot be created.

3. Purposes and legal bases

Providing the service and managing the account - Art. 6(1)(b) GDPR (performance of a contract).

Reading data from building documents with AI, at the request of the User - Art. 6(1)(b) GDPR (performance of a contract). Details in section 4.

Responding to a contact-form inquiry and handling an ordered service - Art. 6(1)(b) GDPR (steps taken at the person's request before a contract).

Issuing invoices and billing - Art. 6(1)(c) GDPR (legal obligation).

Service messages: about the Account, purchases, the plan, the subscription and its renewal, client forms, and changes to the terms, prices and the Service that affect the contract - Art. 6(1)(b) and (f) GDPR. These messages cannot be switched off because they are part of the contract; they contain no offers.

We send offers and discounts, reminders encouraging a purchase and the newsletter about what is new in the Service by e-mail only to people who have consented to them (Art. 398 of the Polish Electronic Communications Law) - Art. 6(1)(a) GDPR. Consent can be withdrawn at any time in Settings or through the link in every such message, which does not affect the lawfulness of sending before withdrawal. The newsletter can also be ordered without an Account, with the form on heatalgo.com: we then store the e-mail address, the wording and time of the consent, the page the form was on and the time the sign-up was confirmed with the link in our e-mail. We do not store the IP address itself - for one day we keep only a one-way hash of it, to limit repeated sign-ups. The address of an unconfirmed sign-up is deleted after 30 days, and of a confirmed one right after unsubscribing, including from the history of sent messages; the record of the consent (its wording, time and page) stays, without the address. If the address already is, or later becomes, an Account's, the consent moves to the Account.

Product analytics and development of the Service - Art. 6(1)(f) GDPR (legitimate interest: improving the service). This covers visit and usage statistics, which need no consent because they involve neither recordings on the heatalgo.com website nor advertising profiling; inside the application, after signing in, they also cover session recordings with form-field masking (section 9).

Contacting Users to ask about their experience of the Service (feedback questions and short conversations) - Art. 6(1)(f) GDPR (legitimate interest: developing and improving the service). For this we use the account's e-mail address, the first name if one was given, and information about how the Service is used on that account (for example, the module and how far the project got) - to the extent needed to make the question relevant. The User can object to this contact at any time by replying to the message or through the opt-out link in it. We send no offers or discounts on this basis - those are sent only with a separate consent to receive them.

A phone call after a report purchase: if a User leaves a phone number in the Service after the purchase and ticks the consent to telephone contact, we call that number to ask about the purchase - Art. 6(1)(a) GDPR (consent) and Art. 398 of the Polish Electronic Communications Law. We use the number for that call only and make no offers in it. We record which consent wording the User ticked and when. The consent can be withdrawn at any time with the button in the same place in the Service or by writing to the address in section 1 - we then delete the number at once.

A review after a purchase: after a purchased report is downloaded, we ask for a rating of HeatAlgo. If the User sends it, we store the rating, the text of the review and - if given - the role (homeowner, installer, designer), first name, company name and logo; the logo is stored in the same file storage as the company logo from the Account settings. We read reviews to improve the Service - Art. 6(1)(f) GDPR (our legitimate interest). We show the first name, role, company name, logo and text of a review on heatalgo.com only if the User ticks a separate consent to publication - Art. 6(1)(a) GDPR; we record which consent wording was ticked and when. We ask every buyer for a review whatever their rating, give nothing in return and never change the text of a review. If no review is sent, we remind the User once after 3 days: with a notification in the Service, and by e-mail only if the User has consented to marketing communications. The consent to publication can be withdrawn at any time by writing to the address in section 1 - we then remove the review from the site.

Session recordings on the heatalgo.com website, remembering the browser in our statistics (storing the PostHog identifier on the device, on heatalgo.com and in the heatalgo.app application) and the Google Ads and Meta advertising tools - Art. 6(1)(a) GDPR (consent; storage on the device - Art. 399 of the Polish Electronic Communications Law). Without consent we start neither recordings nor those tools, and we store neither the PostHog identifier nor an advertising click identifier on the User's device. Consent can be withdrawn at any time without affecting the lawfulness of processing before the withdrawal - see section 9.

Sending the result of a free calculator as a PDF file to the address you give us - Art. 6(1)(b) GDPR (steps taken at the request of the data subject). We send our own HeatAlgo offers to that address only if the person ticks a separate, voluntary consent in the calculator form - Art. 6(1)(a) GDPR; without that consent we use the address only to send the result, and consent can be withdrawn at any time. We do not pass calculator data to installers or to any other third party - that would need a separate consent, which we do not ask for.

Ensuring the security of the Service, including analysis of server logs - Art. 6(1)(f) GDPR (legitimate interest: security of the service).

We do not make automated decisions about Users, including profiling, that produce legal effects (Art. 22 GDPR).

4. Building documents and the AI assistant

The Service offers AI-based reading of data from building documents through the assistant: the User pastes or attaches documents in a conversation with the assistant about a project, and the assistant reads the data from them. Documents may include, for example, a building design, a window/door schedule, an energy performance certificate, or photos of such documents.

Values read from documents enter the form as the User has set the assistant: in "Propose" mode only after the User approves them, in "Automatic" mode at once, with a button that undoes them. Separately, on the User's explicit instruction, the assistant can change specified values in a project - described in the next paragraph below. AI never performs the heat demand calculation itself - that calculation is always carried out in full by an algorithm compliant with PN-EN 12831-1.

On the User's explicit instruction the assistant can change data in a project - setting a specified value in the calculation, for example. The instruction is the User's own message. In "Automatic" mode the change is saved immediately, with no separate approval step; in "Propose" mode the assistant only proposes it, and it is saved only by a button the User presses - until then the proposal is kept with the conversation. In that case the list of those actions and their parameters is also sent to the provider of the AI model. For changes to calculation fields, the assistant reports the change in the conversation together with a button that undoes it. To make that undo possible, before each such change we store in the Service a copy of the previous version of the project document; we keep that copy for 30 days and then delete it - after that the change can no longer be undone. The effects of every action are visible in the Service. On the same kind of instruction the assistant can also create a new, empty project, rename the project the User designated in the conversation, or delete the project the User designated in the conversation - never another one. On a rename, the previous name is kept in the conversation, on the receipt of the change, so it can be undone with a button; the 30-day period above does not apply to it. A project deleted this way is marked as deleted, exactly as with a manual deletion, and can be restored with a button in the conversation for as long as it remains only marked as deleted - that is, until the permanent erasure described in section 7; the 30-day period above does not apply to it. On the same kind of instruction the assistant can also add, change or remove an entry in the User's My library; before a change we store a copy of the entry's previous version so it can be undone with a button in the conversation, and delete it after 30 days.

The content of attached files is not read by the model the conversation with the assistant runs on - it sees only their names - and the files are not stored in the Service, with two exceptions. First, a file attached in the Algo workspace or the underfloor heating module can be chosen as the underfloor heating plan, and a file attached in the ventilation module can be chosen by the User as the storey's floor plan. That happens only when the User presses a button; only then is the file stored in the project like any other plan. Second, files attached in a conversation about a project go to the reading of data from building documents when the assistant shows that reading - at once, unless the monthly AI assistant limit is used up; they are then stored for the duration of that reading, and once its result is approved the floor plan pages of the confirmed storeys are stored in the project, on the terms in the paragraph about it below. Outside those two cases we do not store a file. Text pasted into the conversation is part of the conversation and is stored with it. Documents are processed on our behalf by the parties described in the OpenRouter paragraph below - the gateway to the model and OpenAI, the operator of the platform the model runs on - under OpenRouter's data processing agreement; OpenAI retains them for at most 30 days, solely to detect abuse (see the OpenRouter paragraph). Reading data from building documents (for the heat load calculation, the heat pump sizing and the ventilation design) has its own terms, described in the paragraph below.

Reading data from building documents for the heat load calculation, the heat pump sizing and the ventilation (heat recovery) design is a separate task run in the background. The documents the User attached in a conversation about a project start it, and it begins at once; it uses the same monthly AI assistant limit as the conversation. The uploaded files and the images of their pages are stored in the Service for the duration of the reading: 24 hours after the reading starts they are deleted automatically, at the latest within the following hour, and earlier if the User stops or discards the reading or the reading fails. First, an AI model operating on OpenAI's platform, reached through OpenRouter on the terms in the OpenRouter paragraph below, recognises the kind of each page from a reduced image of it and its text layer; the same model reads the descriptive pages that have a text layer, and - it alone, whether or not the page has a text layer - energy performance certificates, energy audits and fuel invoices, from which it reads only quantities (the year of construction, the fuel and its annual consumption, U-values); a value or a quote that contains a PESEL number, a NIP number, a bank account number, a phone number, an e-mail address or an address (a postal code with a street, or a street with a house number) is rejected and not stored; the model is not asked for names and no field reads one, but names are not filtered out. Pages that model has recognised as administrative - decisions, applications, forms and other pages whose subject is a person's data, such as a name, an address or an identification number - are not sent to any other model, and their images are deleted as soon as they are recognised. The other pages - floor plans, sections, schedules of building elements and of windows and doors, central heating and ventilation designs, ventilation unit datasheets, and pages without a text layer, such as scans and photos - together with everything printed on them, including the investor's details on a drawing's title panel, are read by an AI model operating on the same OpenAI platform, also reached through OpenRouter, on the same terms as talking to the assistant (the OpenRouter paragraph below). The result of the reading - the values read, with short quotes of up to 400 characters from the pages they were found on - is kept for at most 30 days from the start of the reading and then deleted. Values the User approves become part of the project and are kept like the rest of the project data (section 7). When the User approves the result, the floor plan page of each confirmed storey - with everything printed on it, including the drawing's title panel - is also stored in the project as the plan for drawing underfloor heating; that page is not deleted after 24 hours but kept like the rest of the project data (section 7) until the User removes it from the project.

Underfloor heating section generation uses a separate saved draft, linked to the project and floor. It contains recognized outlines, proposed sections and rooms, exclusions, selections and manual corrections. Unresolved drafts are kept until the User applies or discards them, or the project or account is erased. Applying saves the selected sections and clears the redundant draft content; discarding clears the draft without changing saved sections. New section Applies do not create an Undo snapshot; sections can be edited or deleted manually. Historical Undo receipts keep their existing 30-day window. Attempt diagnostics are cleared after 30 days. Correcting the draft may send the requested correction and previous recognized area outlines to the same plan reader.

If a building document or a storey plan contains personal data (for example the investor's details in the title block), the User remains its controller under the terms described in section 10 - the Provider, OpenRouter and OpenAI - the operator of the platform the model runs on, as OpenRouter's sub-processor - process it solely on the User's instructions, as part of the reading described above.

Beyond reading documents, the Service offers an AI assistant that answers questions about a project and reviews the calculations it contains. For that purpose a slice of the project data - the building's technical data, the system designed in that module, and the results the Service calculated for them - is sent to the provider of the AI model (through OpenRouter - see the paragraph below). The slice does not include data identifying the User's client: no name, address or contact details. On the assistant's own page (outside a project) the slice covers the project designated in the conversation together with its name, and, when a question concerns the User's other projects, those projects together with the names the User gave them - the assistant could not tell them apart otherwise. A project's name is the User's own label, and the client data stored in a project still takes no part in the slice. When a question needs them, entries from the User's My library (for example building elements and their layers) also go into the slice.

Since 2 October 2026 every connection to the AI model - reading documents, reading a floor plan when drawing underfloor heating sections, talking to the assistant, checking a project, naming conversations and translating conversations for our staff - goes through a gateway: OpenRouter (OpenRouter, Inc., 169 Madison Avenue, New York, USA), on OpenRouter's standard access point (openrouter.ai) in the United States. OpenRouter passes the request - the slice of project data, the conversation, attached files, images of pages and plans, and the list of the assistant's actions - only to the platform of OpenAI (OpenAI, L.L.C., San Francisco, USA) operating in the United States: first to its priority tier and, when that does not answer, to the standard tier of the same platform, never to another platform. The models therefore run outside the European Economic Area, and the transfer rests on Standard Contractual Clauses (section 5). OpenAI is OpenRouter's sub-processor and processes the data under OpenRouter's data processing agreement; by its own terms OpenAI does not use content sent through its API to train models and retains it for at most 30 days, solely to detect abuse, and then deletes it. OpenRouter does not use transmitted content to train models. We do not name a particular model here: we match the model to the task and replace it when a better one appears, and what we undertake to keep is the rule above - OpenAI's platform through OpenRouter. When reading a floor plan for underfloor heating section drawing, what reaches it is the image of the uploaded plan together with its title block and the room names of that storey, and, for a draft correction, the correction itself and the previously recognised outlines; the scale, the calculation results and the client data stored in the project do not. Until 2 October 2026 every one of these connections except reading a floor plan went through OpenRouter's European access point (eu.openrouter.ai) to platforms operating in the European Union, with Zero Data Retention; a conversation with the assistant started before that date may use that route to its end. The Service assigns a model to a conversation when it starts and the conversation uses it to the end; the User does not choose it. We provide the current list of models and platforms on request at the address given in section 1.

To answer a question, the assistant also searches our own material: guides, notices about changes to the Service, and facts we have collected from legal acts and grant programmes. Since 4 September 2026 the search uses a text-embedding model from Voyage AI (Voyage AI Innovations Inc., a MongoDB company, USA), with which we have a data processing agreement (part of its terms of service) and where we have switched off the use of transmitted text for model training - which, by the provider's own statement, means it does not retain the transmitted text. The text of every question put to the assistant - and, for a short follow-up, the preceding question as well (together up to 1000 characters) - is sent to the provider, turned into a numerical form usable for search, and not retained after processing. Under the answer the Service shows which material the assistant used, with the legal-state date for facts about regulations. The assistant can be wrong, on regulations too - the source material is always linked and worth checking.

Conversations with the assistant are stored in the Service, on the User's account, so that the User can return to them - unlike attached files, which are not stored outside the two exceptions described above. A message that concerned a particular project is linked to it: once the project is deleted, the message is no longer shown or used, and its permanent erasure follows the terms in section 7. Other conversations are kept for the duration of the contract.

The User can mark an assistant answer as wrong. The mark is stored with the conversation - with no copy of its content - and can be withdrawn in the same place. Authorised Service staff may read a conversation with the assistant when needed to handle the User's request, investigate a fault or improve the assistant - in particular conversations marked as wrong; every such read is logged. Where a conversation is written in a language other than Polish, such staff may have it translated into Polish - only on their own request, one conversation at a time - by an AI model on the OpenAI platform, through OpenRouter, on the same terms as the conversation with the assistant (the OpenRouter paragraph below), except that the request goes straight to that platform's standard tier. The translation is stored with the conversation and deleted with it.

The Service uses an AI model in three scopes. Checking a project and talking to the assistant work the same way in this respect: to answer, the Service sends the building's technical data - areas, envelope elements, temperatures, the locality, and in the ventilation module also the rooms with their volume and occupancy, the selected unit and the declared operating modes - to an external provider's AI model. Data identifying the User's client takes no part in that technical data. The content of documents attached to the assistant does not reach the model the conversation runs on - in the same conversation the model sees only the file names, and in a conversation about a project the reading of data from building documents described above is shown under its answer. The browser keeps the latest files in memory so they can be passed on that way; the files are released when the User removes them, uploads a replacement batch, changes conversations or projects, or reloads the page. Outside that reading the file is not saved in the Service or in the stored conversation; what remains in the conversation are the file's name and the assistant's answers, and the technical log (section 7) may cover a short summary of the model's reasoning.

5. Data recipients

Data is processed on our behalf by infrastructure providers: Cloudflare (Cloudflare, Inc., USA - content delivery network and attack protection; all traffic to heatalgo.com and heatalgo.app passes through its servers, including the IP address and request content), Supabase (database, authentication and file storage), Railway (application hosting), Resend (e-mail delivery), PostHog (product analytics and session recordings, servers in the EU; on our behalf it may review recordings with AI tools to find faults), OpenRouter (the gateway to AI models - see section 4), the providers of the AI models OpenRouter runs on our behalf (see section 4), and Voyage AI (the text-embedding provider behind search across our material - see section 4). We have data processing agreements in place with each of these providers. In every one of these scopes - talking to the assistant, reading documents in the conversation, reading data from building documents for the heat load calculation, reading a floor plan when drawing underfloor heating sections, checking a project and naming conversations - the platform is OpenAI, OpenRouter's sub-processor, processing data under its agreement; OpenRouter handles these requests on its standard access point in the United States, and the model runs outside the European Economic Area (see section 4). A conversation with the assistant started before 2 October 2026 may use platforms operating in the European Union to its end, which are also OpenRouter's sub-processors. We provide the current list of models and platforms on request at the address in section 1.

For Google sign-in selected by the User, Google Ireland Limited acts as a separate controller for its authentication service in the EEA. Sign-in with Apple (Apple Distribution International Limited) is not currently available; if we offer it, it will work on the same terms. HeatAlgo processes the resulting identity data to provide the account under Art. 6(1)(b) GDPR. This does not require advertising consent. The provider may transfer data outside the EEA under the safeguards in its own privacy policy, including adequacy decisions or Standard Contractual Clauses as applicable: policies.google.com/privacy/frameworks. We do not send project or client content to it for sign-in.

Only after consent to advertising purposes has been given does data also reach Google Ireland Limited (Google Ads) and Meta Platforms Ireland Limited (the Meta pixel and its server interface). For the click identifier, Google acts here as an independent controller, not as a processor on our behalf: it determines the purposes of processing in its own advertising system. For the hash of the e-mail address described in section 9, Google acts as a processor on our behalf (Art. 28 GDPR) under the Google Ads Data Processing Terms. For the collection of data by the Meta pixel on heatalgo.com and its transmission to Meta, we and Meta Platforms Ireland Limited are joint controllers (Art. 26 GDPR) under Meta's Controller Addendum; the essence of that arrangement is available at https://www.facebook.com/legal/controller_addendum, and for the subsequent processing in its own advertising system Meta is solely responsible as an independent controller. Without consent we send no data to Google or Meta for advertising purposes. Google sign-in, described in this policy, is a separate authentication service.

Cloudflare, Resend, Railway, OpenRouter, the AI model providers, OpenAI and Voyage AI may process data outside the European Economic Area (in the United States) - OpenRouter is a US company and handles our requests on its standard access point in the United States, from which it passes them to OpenAI's platform, where the AI models run outside the European Economic Area, in the United States, in every scope (see section 4). Transfers take place on the basis of Standard Contractual Clauses (SCC). The same applies to Google and Meta if the User consents to advertising purposes. A copy of the safeguards can be obtained by contacting us at the address indicated in section 1.

We embed YouTube videos on heatalgo.com. The player does not load on its own: until the user presses play, the browser makes no connection to YouTube and Google receives no data. Once pressed, the player loads from youtube-nocookie.com - privacy-enhanced mode, in which YouTube writes no advertising cookies. Google Ireland Limited is a separate controller in this respect and receives the IP address and the technical browser data needed to play the recording; its terms are described in Google's privacy policy (policies.google.com/privacy). The recordings can also be watched directly on our YouTube channel, without using this site.

6. Stripe as a separate controller

Payments for purchases made directly in the Service are handled by Stripe, which acts as the seller in them. For those transactions Stripe is a separate data controller and not a processor acting on our instructions: it determines its own purposes, including tax settlement, fraud prevention, payment dispute handling and contact with the buyer. We have no processing agreement with Stripe covering that data and we do not instruct it. Stripe's own privacy policy, at stripe.com/privacy, describes what it does.

Payment card details never reach us at any point. Stripe tells us that a payment succeeded, its amount and currency, the buyer's country and the transaction identifiers, and, for subscriptions, their state (renewal, failed payment, cancellation, refund) - the minimum we need to unlock the purchased feature and to keep our own books.

7. Retention period

We store account and project data for the duration of the contract. A project, an AI assistant conversation or a library entry the User deletes is marked as deleted and stops being visible; we erase it permanently 90 days after the deletion, a project together with its floor plan images, or earlier on request. If a purchased report is linked to a deleted project, only the purchase record remains: the project's name, client name, address and contents are erased. After the contract is terminated, or on a request for erasure, we erase account and project data within 30 days, except for data whose longer retention is required by law: billing records are kept for 5 years from the end of the year in which the payment was made. Database backups are overwritten on the provider's retention cycle.

Data entered into a calculator (first name and e-mail address) is kept until you ask us to delete it, and consent to offers until it is withdrawn; we act on either without delay, at the address in section 1 or through the link in the message.

Contact form data (name, email address, phone number and message) is kept for as long as it may be needed for correspondence with the person who sent it and for evidentiary purposes relating to a concluded or prospective contract. You can ask us to delete it at any time at the address in section 1, and we will do so without delay. The technical data sent with a form (hashed IP address, browser details, referring page, campaign tags and analytics session identifier) is deleted after 30 days, and a message marked as spam 30 days after it arrived.

A phone number left after a report purchase is kept for 30 days at most, and deleted at once when the consent is withdrawn. The record of every consent and of its withdrawal (the wording shown, the time and where it was given) is kept for 3 years after the withdrawal or after the erasure of the Account, as proof; it contains no e-mail address or phone number.

A review is kept until the Account is deleted. A review published with consent is removed from the site when the consent is withdrawn or the Account is deleted.

Conversations with the AI assistant are kept for the duration of the contract, on the same terms as account and project data.

Files passed to the reading of data from building documents for the heat load calculation, and the images of their pages, are deleted automatically 24 hours after the reading starts (at the latest within the following hour), and the result of that reading at the latest 30 days after it starts (section 4). Floor plan pages stored in the project when the User approves the result of that reading are kept like the rest of the project data - until they are removed from the project or the project or account is deleted.

A floor plan image and the plan's vector data that the User replaces with another plan or removes from a project stop being shown in the project; we delete them automatically once no saved state of the project refers to them, no earlier than 30 days after they were uploaded.

PostHog keeps product analytics events for one year and session recordings for 30 days. The log of calculation requests (the operation performed, its input data, browser details and the IP address shortened to its first three parts - its /48 prefix for IPv6) is kept for 90 days and pruned daily. Counters that limit repeated security operations are deleted after 1 day, and expired security operations (such as an unfinished account recovery) after 90 days.

Messages sent from the app are kept for the duration of the contract; the screenshot attached to a problem report is deleted 12 months after the report is resolved. In the history of e-mails sent, the recipient's address is removed after 13 months; the record that a message was sent stays, so that it is not sent twice. The ad click identifier stored with the Account is kept for the duration of the contract, and the identifier stored with a payment together with the billing records. Consent to offers and its date are kept until it is withdrawn. An address to which a message could not be delivered permanently, or from which one was reported as spam, is kept on a block list so that we do not send to it again; unsubscribing turns the messages off for an Account, and for an address with no Account (a form or the newsletter) erases the address.

Technical logs of AI assistant calls are kept for 30 days; if the same request content is sent again, its copy is kept for up to 30 days from the last sending. The log includes the content of the request sent to the model - project data, without investor-identifying data - and a short summary of the model's reasoning, which may refer to the conversation's content. The record of our staff opening such a log is kept for 2 years.

An optional comment left in the price survey is deleted after 12 months; the answers chosen from the list are kept without it. The record of actions our staff perform in the administration panel is kept for 2 years. The record of a request to exercise the rights in section 8 (its type, dates and outcome, with the e-mail address stored only as a one-way hash) is kept for 3 years after the request is closed.

8. Rights of data subjects

The User has the right to access their data, to rectify it, to erase it, to restrict its processing, to data portability, and to object to processing based on legitimate interest. Consent can be withdrawn at any time, which does not affect the lawfulness of processing before withdrawal. An objection to direct marketing is always honoured, with no reason needed. Please send requests to the address indicated in section 1; we reply within one month. We also provide Account data in a machine-readable format (§18 of the terms).

The User also has the right to lodge a complaint with the President of the Personal Data Protection Office (UODO, uodo.gov.pl).

9. Cookies, analytics and consent

The Service uses essential cookies and browser storage to maintain the login session, remember the chosen language, and store the consent choice itself. The Service does not work correctly without them, so they are not subject to consent.

Product analytics runs independently of consent and is configured with privacy in mind: PostHog does not store IP addresses, identification is based on the account identifier rather than on personal data, and we pass none of it to any advertising network. The identifier by which PostHog recognises the browser is kept in the browser's storage - on heatalgo.com and in the heatalgo.app application - only with the analytics consent given in the consent panel on heatalgo.com; without that consent the identifier is not stored on the device and exists only in the open page; it reaches the next page only in that page's address - when moving from heatalgo.com to the application and when returning from Google sign-in (that address passes through Google as a random string Google cannot link to anything), and after registration or sign-in events are linked to the account identifier. The basis for the statistics themselves is legitimate interest (section 3), and such processing can be objected to on the terms in section 8.

Session recordings on the heatalgo.com website are started only with consent and only on that basis; inside the application available after signing in they are part of the product analytics described above, on the basis of legitimate interest. Session recordings mask form fields - what the User types into them does not reach a recording (numeric fields, selection lists and the names of rooms, building elements, materials and units, which carry no personal data, are the exception). The rest of the page is recorded as displayed, so we tag the elements that present personal data to keep them out of recordings. The floor plan uploaded in the underfloor heating module is recorded as well - masking does not cover the drawing, so it appears in a recording as it does on screen.

The Google Ads and Meta (the Meta pixel) advertising tools are started only with consent to advertising purposes and only to measure which campaign led to a registration, a first calculation result or a purchase - we do not personalise ads to the User on that basis and build no audiences from that data. The Meta pixel runs without automatic matching and without automatic events: it records the page view and nothing more. The same consent covers storing the advertising click identifier on the device; we keep it for at most 90 days. Until the User decides, the identifier from the page address is held only in the memory of the open browser tab - it is not stored on the device or sent to us, Google or Meta - and it is discarded on refusal or when the tab closes; it is stored only once consent is given. Without consent we store no such identifier and the Google and Meta scripts are never fetched.

If an account registration or a purchase follows a click on a Google or Meta ad and consent to advertising purposes was given, once the account exists or the order is paid our server sends that network the identifier of that click (to Meta, together with the time of the click) and the date and time of the registration or purchase; for a purchase reported to Meta, also the order's amount and currency, which Meta's interface requires. We send no name, no e-mail address in clear, no IP address and no other data; the hash of the e-mail address is described in the next paragraph. Google Ireland Limited and Meta Platforms Ireland Limited are independent controllers of that data. A report already sent cannot be recalled, and requests about the copy Google or Meta holds are directed to that network.

We use the click stored at registration in two more cases, for at most 90 days from the click: when the account's first calculation result appears, our server reports one such event to Google (the click identifier and the date and time, no amount, once per account), and a purchase paid on another device or in another browser is attributed to that click. When the User withdraws consent to advertising purposes in the consent panel on heatalgo.com, we record the withdrawal on our server too at the next move from heatalgo.com to the heatalgo.app application (once signed in), and from then on report nothing based on clicks stored before.

From 18 October 2026, consent to advertising purposes in the consent panel also covers a hash of the e-mail address (Google's enhanced conversions). After a registration or a purchase, our server sends Google a SHA-256 hash of the Account's e-mail address - never the address itself - so that Google can match the event to a click on our ad by a signed-in Google user. The hash goes beside the click identifier, and for a purchase with no stored click it goes alone, at most 90 days after the purchase, also when consent was given after the purchase. The consent reaches our server at the next move from heatalgo.com to the heatalgo.app application (once signed in); consent given before 18 October 2026 covers the click identifier only. We do not store the hash - it is computed at the moment of sending. For the hash, Google Ireland Limited acts as a processor on our behalf (Art. 28 GDPR) under the Google Ads Data Processing Terms, and we build no audiences from this data. Withdrawing consent in the consent panel also stops the hash, from the next move to the application.

Consent can be changed or withdrawn at any time - the “Consent” link in the footer of the heatalgo.com website opens the same panel in which the first decision was made. Withdrawing analytics consent immediately deletes the PostHog identifier stored on that website, and its copy in the heatalgo.app application the next time the User goes from the website to the application. Withdrawing consent to advertising purposes immediately deletes the click identifier stored on that website; the copy stored in the heatalgo.app application is deleted the next time the User goes from the website to the application, and if no such visit follows - at the latest after 90 days, when the identifier expires on its own. Advertising scripts already fetched in the same tab stop collecting data once consent is withdrawn, and are gone from it after the page is reloaded.

10. Data of the User's clients

The User may enter into the Service personal data of their clients (e.g. the investor's first and last name, the project site address, contact details). This data may also reach the Service directly from the User's clients - through forms the User shares with them. In both cases the User remains the controller of that data, and the Provider processes it solely on the User's instructions, for the purpose of providing the service, as a processor, under the data processing agreement in §17 of the terms. On the client form page we do not record sessions or store a browser identifier; we record only technical events (opening, saving and submitting the form, errors) without the content of the answers - for these events we are the controller on the basis of our legitimate interest in the form working reliably (Art. 6(1)(f) GDPR).

The User's instruction also covers use of the AI assistant: to answer the User's question, check their calculation or read data from attached documents - which may contain the client's personal data - the Provider sends, respectively, the building's technical data or the documents' content to an external provider's AI model, and keeps the content of the request in a technical log on the terms in section 7. The User can turn off the keeping of assistant request content in the technical log in Settings; the switch works from that moment on, and content stored earlier leaves the log under the 30-day rule.

11. Changes to this policy

We will inform Users of material changes to this policy by e-mail or by a notice in the Service before they take effect. We announce the addition or replacement of a processor acting on our behalf in this policy at least 14 days in advance.