Privacy Policy
Version: 2 · Effective from: October 26, 2026
Until October 26, 2026 the previous version applies.
We collect only what PLTest cannot work without. We do not sell data, show ads or use advertising trackers.
1. Who is responsible for your data
The data controller is Oleksii Hyria (a natural person), ul. Wiedeńska 20A, 66-400 Gorzów Wielkopolski, Poland. E-mail: support@pltest.app · phone: +48 880 630 411. We have not appointed a data protection officer (IOD); write to support@pltest.app.
2. What data, why and on what basis
| Data | Why | Basis (GDPR) | How long we keep it |
|---|---|---|---|
| Telegram: ID, username, name; language, exam type, reminder time | the bot and your account work | performance of the contract — art. 6(1)(b) | while the account exists; after deletion — up to 30 days |
| Answers to questions, progress, Readiness Score, Error Deck | learning, the core of the service | art. 6(1)(b) | while the account exists |
| E-mail for signing in to the personal account; when signing in with Google — Google account ID, e-mail, name | sign-in and your account at konto.pltest.app | art. 6(1)(b) (including steps before entering into a contract at your request) | while the account exists; an account where the terms were not accepted is deleted after 30 days |
| Date and version of the accepted Terms | to confirm on what terms the contract was concluded | art. 6(1)(b) and (f) | while the account exists; if there was a payment — together with the payment record (see below) |
| IP address and e-mail address in the sign-in attempts log; log of sign-ins and changes in the personal account | protection against guessing and sending e-mails to other people's addresses | legitimate interest — service security, art. 6(1)(f) | attempts log — 30 days; sign-in log — 12 months |
| Payment: transaction ID, plan, date, amount | to grant PRO access, handle a complaint or refund, tax records | art. 6(1)(b); records — art. 6(1)(c) | at least 5 years from the end of the year in which the tax payment deadline expired (art. 70 § 1, art. 86 § 1 of the Polish Tax Ordinance) — for 2026 payments until 31.12.2032 |
| E-mail given at payment | contact about payment, complaints and refunds | art. 6(1)(b) | while the account exists; after deletion the payment record is kept without the e-mail |
| Website statistics (no IP or browser data; see section 7) | to understand which materials are useful | art. 6(1)(f) | 13 months |
| Technical error reports | to fix failures | art. 6(1)(f) | up to 90 days |
Is providing data mandatory. Without a Telegram ID (in the bot) or an e-mail or Google account (in the personal account) the service does not work; this is a condition of the contract. There is no statutory obligation.
We do not collect: card details, passport data, geolocation, contacts, or messages in other Telegram chats.
3. Who we share data with
Data is seen only by services PLTest cannot work without. They process it on our behalf under a contract (art. 28 GDPR):
| Who | What it does | Where | How the transfer outside the EU is protected |
|---|---|---|---|
| Cloud hosting | servers and database | servers in the EU (Netherlands); company in the US — maintenance and access from the US | European Commission decision on the EU-US Data Privacy Framework or EC standard contractual clauses |
| Website delivery and protection network | serving the website, the "you are not a bot" check on the sign-in page, e-mail on the domain | US, global network | same |
| E-mail sending service | sends sign-in e-mails | sent from Ireland, company in the US | same |
| Error monitoring service | technical failure reports | US | Data Privacy Framework |
Data Privacy Framework decision: 2023/1795 on EUR-Lex; list of certified companies: dataprivacyframework.gov; standard contractual clauses: 2021/914 on EUR-Lex. We will give the names of the specific companies on request at support@pltest.app.
Independent controllers process data under their own rules:
- Link / Stripe accept payment (merchant of record); only they receive card details. The seller of the service is the controller named in section 1. Their rules: link.com/privacy, stripe.com/privacy.
- Google, if you sign in with Google: we receive only the account ID, e-mail and name. policies.google.com/privacy
- Telegram, the messenger the bot runs in.
- Cloudflare, regarding the "you are not a bot" check signals (Turnstile) it uses to improve this protection: cloudflare.com/turnstile-privacy-policy.
Also to authorities, if required by law or a court.
4. Your rights
You have the right to: get a copy of your data; correct it; delete it (in the bot — /delete_my_data, in the personal account — "Delete account"); restrict processing; receive the data in a structured format; object to processing based on legitimate interest; withdraw consent where processing relies on it, without affecting what was done before withdrawal.
Write to support@pltest.app. We reply without undue delay and no later than within a month.
You can lodge a complaint with a data protection authority: in Poland this is the Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl, or the authority of the country where you live or work.
5. Security
There are no passwords: sign-in is by a one-time link (15 minutes) or through Google; the database stores only a hash of the link. Connections use TLS only. Only the controller has access to the database.
6. Cookies and what is stored on your device
The pltest.app website does not set cookies. The browser stores only the interface language (localStorage).
The konto.pltest.app personal account:
| Cookie | Why | How long it lives | Consent |
|---|---|---|---|
pltest_konto | keeps you signed in to the personal account | until you close the browser; if you ticked "Remember this browser", 30 days | until the browser closes: not needed; 30 days: only with your tick (not ticked in advance) |
pltest_konto_lang | the account language you chose | until you close the browser | not needed |
pltest_konto_g | protects sign-in with Google | 10 minutes | not needed |
Cloudflare Turnstile on the sign-in page checks that you are not a bot: it analyses the IP address, connection (TLS) and browser (User-Agent) parameters.
These cookies and the check are needed for the personal account you use to work, so they do not require consent (art. 399 ust. 3 pkt 2 Prawa komunikacji elektronicznej). The only exception is the 30-day sign-in cookie: we set it only when you tick "Remember this browser". If you change your mind, sign out or delete the cookies of konto.pltest.app in your browser settings.
7. Website statistics
We count ourselves which pages are opened and what is clicked on them: the page address, the domain you came from (without the full address), utm tags, whether the page was read to three quarters, clicks on bot buttons, prices and links, the step number of the paths questionnaire (the answers themselves are not sent). We do not record the IP address or browser data. Each view gets a random number that lives while the page is open. When you go to the bot via a button on the website, the link contains a random click number, so the bot learns which page brought you, and this record is linked to your bot account.
Basis: legitimate interest (art. 6(1)(f)), to understand which materials are useful. Records are deleted after 13 months. To object, write to support@pltest.app.
8. Changes to the policy
We will announce significant changes in the bot and in the personal account before they take effect. Previous versions are available in the archive on the website and on request.