Privacy Policy | Vector ToDo

Dowiem Sp. z o.o., ul. Zamknięta 10/1.5, 30-554 Kraków, Poland (KRS 0001055145, NIP 6793275343) is the controller of your personal data in Vector ToDo, Vector Notes and related websites, apps and APIs (the "Service"). Contact: [email protected].

1. What we collect

Account data: email, name, password hash, settings. If you sign in with Apple or Google, we receive your name and email from them.
Your content: everything you put into the Service (tasks, notes, files, comments, events and similar) and data from integrations you connect.
Payment data: plan and transaction status from the App Store, Google Play or our payment provider. We do not receive full card numbers.
Technical data: IP address, device and browser data, logs, push tokens, crash reports and usage statistics.
Device data, only with your permission: location, weather, Apple Health data (for example sleep and steps), microphone and speech. We use it only for the feature you turn on. Health data is never used for advertising.

2. Why we use it

To provide the Service under our contract with you (Art. 6(1)(b) GDPR).
For our legitimate interests (Art. 6(1)(f) GDPR): security, abuse prevention, support, analytics, and improving and developing the Service.
To meet legal obligations (Art. 6(1)(c) GDPR), for example accounting and tax.
With your consent (Art. 6(1)(a) GDPR): marketing emails, optional device permissions, non-essential cookies. You can withdraw consent at any time. This does not affect processing done before.

We need account data to create your account. All other data is optional, but some features do not work without it.

3. Who receives it

Providers that run the Service for us: hosting and storage, CDN and security, email, push notifications (Apple, Google), payments and app stores, analytics and crash reporting, support tools, AI providers. They act on our instructions under contracts that protect your data at least as well as this policy.
Other users you share content with, and integrations you connect.
The organization that manages a Space you belong to. It can see, manage, export and delete the content in that Space.
Public authorities, when the law requires it, and a successor in a merger, acquisition or sale of our business.

Some providers process data outside the EEA, for example in the USA. For these transfers we use an EU adequacy decision (including the EU–US Data Privacy Framework) or the Standard Contractual Clauses.

4. AI features

AI features are optional. When you use one, the content you send to it (text or audio) goes to the AI provider behind that feature: a provider you choose with your own API key, or a provider we select.

5. Google user data

If you connect a Google account, we use your basic profile (email, name, picture) and your Google Calendar list and events. We use them to show your calendars in the Service and to sync back to Google the events you create or change in the Service. OAuth tokens are stored encrypted. We keep a copy of synced events while the account stays connected. We share Google data only with providers that run the Service or when the law requires it. We do not use it for advertising or to train general AI models. People do not read it, except at your request, for security, or when the law requires it.

Vector ToDo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Google at any time in Settings → Calendars or at myaccount.google.com/permissions. We then stop syncing. Synced Google data is deleted when you remove the calendar from the Service or delete your account.

6. How long we keep it

We keep your data while your account exists. After you delete the account, we delete or anonymize your data within a reasonable time. Exceptions: backups, which we overwrite on a rolling basis, and data we must keep by law or need for legal claims.

7. Your rights

You have the right to access, correct, delete, restrict and port your data, and to object to processing based on legitimate interests or for direct marketing. Write to [email protected]. You can delete your account in Settings at any time. You can also complain to the President of the Personal Data Protection Office (uodo.gov.pl).

8. Cookies and local storage

We use cookies and local storage that the Service needs to work: sign-in, offline data, preferences. Before we use non-essential ones, such as analytics, we ask for your consent. You can change your choice in Settings.

9. Other

We do not make decisions with legal or similarly significant effects about you solely by automated means. The Service is not for children under 16. We may update this policy. For material changes, we tell you in the app or by email.