Privacy Policy
This policy explains how we handle the personal data of people who use https://zanreal.com, our customer panel, our store and our services. It has applied since 17 December 2025 and was last updated on 20 October 2026.
Who we are and how to reach us
The controller of your personal data is ZANREAL Mateusz Janota, ul. 3 Maja 30A, 44-200 Rybnik, Poland, VAT ID (NIP) PL6423261225 ("we", "us").
For anything to do with your personal data, email privacy@zanreal.com or write to the postal address above.
What data we use and where it comes from
You give us most of it directly; the rest is collected when you use the site. We process:
- Contact details and message content when you write to us through a form or by email (your name or company name, email address, and a phone number if you choose to give one).
- Account data when you create an account in the customer panel (name, email address and, optionally, company name and tax ID). If you sign in with Google, GitHub or Vercel, that provider passes us your basic profile details.
- Order and invoice data when you buy from the store or use our paid services (name, company name, address, tax ID, email address, payment details). A phone number is optional; we never require it and only use it to contact you about your order.
- Newsletter data (email address and, optionally, your first name).
- Messages you send to the assistant on our site.
- Technical and usage data (IP address, device and browser information, pages visited), to the extent allowed by the choices you make in our cookie banner.
Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account, providing our services, concluding and performing a sales contract | Art. 6(1)(b), contract |
| Issuing invoices, bookkeeping, handling complaints and withdrawals | Art. 6(1)(c), legal obligations under tax, accounting and consumer law |
| Replying to your message or enquiry | Art. 6(1)(f), our legitimate interest in replying to people who contact us, or Art. 6(1)(b) where the enquiry is about entering into a contract |
| Keeping the site secure, preventing abuse, finding and fixing faults | Art. 6(1)(f), our legitimate interest in protecting the site and its users |
| Establishing, pursuing and defending legal claims | Art. 6(1)(f), our legitimate interest in protecting our rights |
| Replies from the assistant on our site | Art. 6(1)(f), our legitimate interest in answering the questions you ask it |
| Statistics on how AI agents use our documentation (MCP server) | Art. 6(1)(f), our legitimate interest in maintaining and improving our documentation |
| Newsletter and other electronic marketing messages | Art. 6(1)(a), consent |
| Visit statistics and ad measurement using cookies | Art. 6(1)(a), consent |
You can withdraw your consent at any time; this does not affect anything we did lawfully before. Every newsletter has an unsubscribe link, and you can change your cookie choices in the cookie settings on our site.
Do you have to give us your data?
It is up to you. Fields marked as required are needed to create an account, place an order and issue an invoice, and we cannot reply without a way to contact you. Invoice details are required by tax law.
Cookies
We use cookies and similar technologies in four categories:
- Necessary: signing in, your cart, remembering your cookie choices and security. These work without consent because the site cannot function without them.
- Functional: remembering your settings, such as your conversation with the assistant, in your own browser. Only with your consent.
- Analytics: visit statistics (PostHog, Google Analytics, Vercel Web Analytics, Promptwatch). Only with your consent.
- Marketing: measuring how well our ads perform (Google Ads, Meta Pixel). Only with your consent.
On your first visit our banner asks for your consent, and nothing outside the necessary category runs until you give it. You can change your mind at any time in the cookie settings, and you can also manage cookies in your browser.
Who receives your data
We never sell your data, and we only share what each purpose requires.
Processors. These companies process data on our behalf under data processing agreements (Article 28 GDPR):
| Provider | Based in / region | Purpose | Data | Basis / transfers outside the EEA |
|---|---|---|---|---|
| Vercel Inc. | USA; may process outside the EEA | Hosting the website and applications | Technical data, form submissions | DPF, SCCs |
| Supabase Inc. | USA; EU | Database and user accounts | Account data, order data | SCCs |
| OVH SAS (server provider) | France; EU | Running our infrastructure | Account data, order data | EEA, no transfer |
| Stripe Payments Europe, Ltd. | Ireland; may process outside the EEA | Processing payments | Contact details, payment data | DPF, SCCs |
| inFakt sp. z o.o. | Poland; EU | Issuing invoices | Invoice details | EEA, no transfer |
| Amazon Web Services EMEA SARL | Luxembourg; EU | Cloud infrastructure | Contact details, order data | DPF, SCCs |
| Upstash, Inc. | USA; may process outside the EEA | Storing temporary data | Technical data | SCCs |
| PostHog, Inc. | USA; EU | Visit statistics (with consent) and service reliability | Technical data, usage data | DPF, SCCs |
| Google Ireland Limited | Ireland; may process outside the EEA | Statistics and ad measurement (with consent) | Technical data, usage data | Consent, DPF |
| Meta Platforms Ireland Limited | Ireland; may process outside the EEA | Ad measurement (with consent) | Technical data, usage data | Consent, DPF |
| Promptwatch | EU | Statistics on visits from AI tools (with consent) | Technical data | EEA, no transfer |
| NVIDIA Corporation | USA; may process outside the EEA | Replies from the assistant on our site | Messages sent to the assistant | DPF |
| Slack Technologies, LLC | USA; may process outside the EEA | Internal team communication | Contact details | DPF, SCCs |
Separate controllers. If you sign in with Google, GitHub or Vercel, that provider handles your data under its own terms. Invoices issued to buyers with a Polish tax ID are submitted to the National e-Invoicing System (KSeF), as Polish VAT law requires. We also disclose data to public authorities where the law obliges us to.
Transfers outside the EEA
Some of the companies above are based outside the European Economic Area or may process data outside it, as the table shows. In those cases we rely on the company's certification under the EU-U.S. Data Privacy Framework, which the European Commission has found to provide adequate protection, or on the European Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR). Email privacy@zanreal.com if you would like a copy of these safeguards.
The assistant on our site
Our assistant, Zanek, answers questions about ZanReal. Messages you send it go to the provider listed in the table purely to generate a reply. They are not used to train AI models, and we do not keep a record of your conversations. Please do not share sensitive personal data with the assistant.
Documentation for AI agents (MCP server)
Our public documentation is also available to AI agents at https://zanreal.com/mcp, with no account needed. We keep usage statistics that include the query the agent sends and technical details of the client software, but not your IP address. Please keep personal data out of questions your agent asks our documentation, and do not use the service if you do not want these statistics recorded.
How long we keep your data
- Account data: until you delete your account.
- Order and invoice data: for as long as tax and accounting law requires, generally 5 years from the end of the calendar year in which the related tax payment fell due.
- Messages and enquiries: until the matter is closed, then until any related claims become time-barred.
- Newsletter data and anything else based on consent: until you withdraw consent.
- Cookie data: until you withdraw consent or the cookie expires.
- Data needed to pursue or defend claims: until those claims become time-barred.
Your rights
You have the right to:
- access your data and get a copy,
- have inaccurate data corrected,
- have your data erased,
- restrict how we process it,
- receive data you gave us under a contract or consent in a portable format,
- object to processing based on our legitimate interests, and to direct marketing at any time,
- withdraw consent at any time.
To use any of these rights, email privacy@zanreal.com. We will reply without undue delay and within one month at the latest. You can also complain to the Polish data protection authority, the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warszawa, https://uodo.gov.pl).
Automated decisions and profiling
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. If you accept marketing cookies, ad providers may use data about your visits to measure and tailor ads.
Security
We use appropriate technical and organisational measures to protect your data against unauthorised access, loss or alteration.
Changes to this policy
We may update this policy, for example when the law or our services change. The current version is always on this page, and we will flag significant changes on the site.
Contact
ZANREAL Mateusz Janota
ul. 3 Maja 30A
44-200 Rybnik, Poland
privacy@zanreal.com
