Privacy, in plain sight.

1. Scope and current app status

This Privacy Policy explains how Pufidreams Anna Zgid, operating its mobile software branch as Pufidreams Studio, handles personal data in connection with this corporate website, communications, and its mobile app activities. PufiHome and PufiTrack are upcoming concepts; no public app downloads, app accounts, or app data collection are offered through this website. App-specific data practices will be described here or in a clearly linked app notice before a public release. This policy does not imply that unreleased app features are operating.

2. Who is responsible for your data?

The data controller is Pufidreams Anna Zgid, ul. Morcinka 14/5, 46-203 Kluczbork, Poland. Pufidreams Studio is our brand and mobile software branch. Contact fabian.c.nflv@gmail.com for privacy questions or to exercise your rights. You may also write to our postal address. This is our privacy contact; it is not a claim that a statutory Data Protection Officer has been appointed.

3. Data we process and where it comes from

• Messages you send: your email address, name if provided, message contents, attachments, and related correspondence. Please avoid sending passwords, payment details, or sensitive personal information.
• Technical website requests: serving a website involves processing an IP address, requested URL, request time, browser information, and connection metadata by the hosting infrastructure. Whether access logs are retained and their exact duration depends on the hosting service configured for this site.
• External styling: this site loads Tailwind CSS through cdn.tailwindcss.com. Your browser sends a request directly to that external service, which receives your IP address and technical request metadata. No external fonts, advertising scripts, analytics tools, contact forms, or tracking pixels are included in this website’s source.
• Upcoming mobile apps: no app telemetry, advertising identifiers, location data, contacts, photos, health data, or account information are collected by these website pages. Each released app’s actual data categories, permissions, SDKs, recipients, and retention rules will need to be disclosed before collection starts.

4. Purposes and GDPR legal bases

We use correspondence to answer enquiries and provide requested assistance, relying on our legitimate interests in communicating with users and managing our business (Article 6(1)(f) GDPR). Where your enquiry concerns entering into or performing a contract, Article 6(1)(b) applies. Necessary website delivery, security, and proportionate abuse prevention rely on our legitimate interests in operating a reliable website (Article 6(1)(f)). We process data required to meet a specific legal obligation under Article 6(1)(c), identifying that obligation where relevant. Optional processing requiring consent will only begin after valid consent under Article 6(1)(a); you may withdraw it at any time without affecting earlier lawful processing. We do not use this website for automated decisions with legal or similarly significant effects or for profiling.

5. Cookies and your choices

The supplied website code does not set cookies, use local storage, or run analytics or advertising. The copyright year script runs locally without storing visitor information. External CDN and hosting services process the requests needed to deliver the site; their operation must be reviewed when configuring hosting. If optional cookies or tracking are introduced, we will explain their purposes and providers and obtain any legally required consent before activation. Contact links open your own email application; sending a message is your choice.

6. Recipients and international transfers

Data may be handled by the hosting/CDN services necessary to deliver the website and by email providers when you contact us. Gmail is used for the published contact mailbox. Authorized personnel and, where necessary, professional advisers may access relevant correspondence. We may disclose information when required by a valid legal obligation or to establish, exercise, or defend legal claims. We do not sell personal data or use this website for behavioral advertising. We use processors under appropriate contractual arrangements where required. Service providers may process data outside the European Economic Area. Any transfer requiring a GDPR safeguard must use a valid mechanism, such as an applicable European Commission adequacy decision or standard contractual clauses with supplementary measures where necessary. Contact us for the safeguards applicable to your information. App-specific SDK and service-provider disclosures will be published before the relevant app launches.

7. How long data is kept

Correspondence is kept only while needed to handle your enquiry and any directly related follow-up. It is then deleted or anonymized unless a specific legal obligation or an unresolved legal claim requires continued retention; in that case only the necessary records are retained for the applicable statutory or claim period. Technical request metadata is processed for delivery and security; retained server logs, if enabled by the chosen host, must have a documented, limited retention period. We do not specify an unverified hosting log duration. You may ask us for the retention criteria applicable to your request. Future app notices will specify retention periods or meaningful criteria for each app data category. Uninstalling an app may remove local data, but does not necessarily remove Android backups or server data.

8. Data protection and security

Our data-protection approach is to limit collection to what is necessary, restrict access to authorized people, use secure transmission for deployed services, protect service accounts, and remove information when it is no longer needed. The live website must be served over HTTPS. Security measures must be proportionate to the data and risks; no internet service can guarantee absolute security. Where a personal data breach triggers GDPR reporting duties, we will notify the competent supervisory authority and affected people as required by Articles 33 and 34. Mobile permissions and any sensitive-data access will require appropriate disclosure and safeguards before use.

9. Your rights under the GDPR

Depending on the circumstances, you have the right to access your personal data and receive a copy; correct inaccurate or incomplete data; request erasure; restrict processing; receive data you provided in a structured, commonly used, machine-readable format and transmit it to another controller where portability applies; and withdraw consent. You may object to processing based on legitimate interests on grounds relating to your particular situation, and may object to direct marketing at any time. These rights have legal conditions and exceptions.

Email fabian.c.nflv@gmail.com with your request, or use our postal address. Provide enough information for us to locate the relevant data; do not send identity documents unless we explain why proportionate verification is necessary. Requests are normally free. We respond without undue delay and within one month of receipt; where lawful, this may be extended by two further months for complex or numerous requests, with reasons communicated within the first month. We will explain any refusal and your options to challenge it.

10. App data and account deletion requests

You can request deletion of personal data held in correspondence by emailing fabian.c.nflv@gmail.com with the subject “Personal data deletion request.” Identify the relevant correspondence or, once available, app name and account identifier; never send a password. We will explain what is deleted and any records that must be retained under a lawful exception. There are currently no app accounts offered by this website. If a future app supports account creation, it must provide an accessible in-app account-deletion route and an external web route, with app-specific instructions, scope, and retention details published before launch. This contact route does not imply that an unreleased app has an account system.

11. Children and sensitive information

This corporate website is intended for general business information and is not directed at children. We do not intentionally solicit children’s personal information through these pages. If you believe a child has sent personal information, contact us so we can assess and address it. Age suitability and any parental-consent requirements for future apps will be addressed before release. Please do not send special-category data, such as medical information, in general enquiries.

12. Complaints and providing information

You can raise concerns with us at fabian.c.nflv@gmail.com. You also have the right to complain to a supervisory authority in the EU/EEA, particularly where you live, work, or believe an infringement occurred. In Poland, the authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO); see uodo.gov.pl/en for official contact and complaint information. Providing information in an enquiry is voluntary, but we may be unable to reply without contact details or enough information to understand the request. Necessary network metadata is required to deliver the website.

13. Changes to this policy

We will publish revisions on this page with an updated date. Material changes affecting existing processing will be communicated as legally required. Before launching PufiHome, PufiTrack, or another app, we will publish accurate disclosures reflecting its implemented behavior and align them with the app’s Google Play Data safety declaration. No change to this policy itself constitutes consent to new optional processing.