Version: 1.2
Effective date: 2026-10-04
This Privacy Policy applies to InstalTrack mobile applications published on Google Play and Apple App Store.
To the extent functionally linked to a user account, this policy also covers data processed through the InstalTrack website and web portal (e.g. registration, sign-in, contact form, and service communications).
InstalTrack is the controller for account data, including login, billing, security, and abuse-prevention data. InstalTrack is the service trade name and the legal service provider is Tomasz Szymoński, VAT ID 6792895776, ul. Białoruska 61/7, 30-638 Krakow, Poland, European Union.
The user, or the organization on whose behalf the user enters data into the app, is the controller of that data. This includes data of clients, employees, contractors, and team members, and projects, documents, photos, and project addresses. InstalTrack processes that data only on the user's or organization's documented instructions, including instructions given by using the app, and does not use it for InstalTrack's own marketing, analytics, or product development. The user or organization determines the legal basis for that processing.
Where the law requires it, or where it is necessary to remove unlawful or harmful content, InstalTrack may access or remove user content and, for that limited action, acts as a controller.
Contact: [email protected]. Address: ul. Białoruska 61/7, 30-638 Krakow, Poland, European Union.
InstalTrack mobile applications are published and managed through Google Play and Apple App Store developer accounts held by the legal service provider.
App store operators (Google Play and Apple App Store) may process personal data as independent data controllers under their own terms and privacy policies. Such independent processing is outside the controller-processor scope of this policy.
The exact set of data depends on features used in the app, account configuration, and enabled technical integrations.
The purposes below apply to account, security, and technical diagnostic data for which InstalTrack is the controller.
Data entered by the user — projects, documents, photos, client and team data, and addresses — is processed only on the user's or organization's documented instructions. Those instructions include using app features, such as saving a project, sharing it with authorized people, and generating a document. A project address is sent to OpenStreetMap, Nominatim, or Photon by Komoot only when the user uses the map feature. Those providers may process the address under their own terms.
The legal bases below apply to data for which InstalTrack is the controller. Those bases are: performance of a contract (providing the account and service), legitimate interests (security and technical diagnostics), legal obligations, and consent where required by law. The user or organization, as controller, determines the legal basis for personal data entered by the user.
The user or organization entering data into the app declares that they have rights and authorization to use such data (including customer data, team-member data, email addresses, and phone numbers), obtained required notices and consents, and that entered data is true, accurate, and up to date.
Data may be shared with trusted technical service providers strictly as needed to operate the app (e.g. hosting, authentication, email delivery, push notifications, error monitoring).
We use DigitalOcean for application infrastructure and database hosting (EU region environment). We may also use other comparable infrastructure providers where necessary for service operation, security, scalability, or continuity.
For traffic security, abuse prevention, and edge security controls, we may use Cloudflare, which may process standard request technical data (e.g. IP address and browser/WebView metadata).
For error monitoring and service stability, we may use Sentry, which may process technical diagnostic data and error events.
More information: DigitalOcean Data Processing Agreement.
More information: Cloudflare Privacy Policy.
More information: Sentry and Your Data, Sentry Data Processing Addendum.
We do not sell users' personal data.
We use Google Firebase, including Firebase Authentication and Firebase Cloud Messaging (FCM), to support sign-in, account security, and push notifications. As a result, selected technical data and identifiers (e.g. account identifiers, device/push tokens, and technical metadata) may be processed by these services under their terms and privacy policy.
We may use Mailgun (Sinch Email) for transactional email delivery and service communications, which may process contact details and technical email delivery metadata.
More information: Firebase Privacy and Security, Firebase Data Processing and Security Terms.
More information: Mailgun Terms, Sinch Data Processing Agreement.
For map features, we also use external map and geocoding providers. A project address is sent to OpenStreetMap (map tiles) and Photon by Komoot (geocoding) only when the user uses the map feature, so the project location can be displayed. These services may also receive standard request technical data (e.g. IP address and WebView/browser metadata) and may process the address under their own terms.
More information: OpenStreetMap, Nominatim Usage Policy, Photon by Komoot.
We retain data for as long as needed to provide the service, perform contractual obligations, ensure security, comply with legal obligations, and resolve disputes. After required periods, data is deleted or anonymized.
To protect users, legal compliance, and platform security, we may remove, block, or restrict data and content that is unlawful or includes abusive, sexual, violent, hateful, infringing, or otherwise prohibited material.
We may also temporarily suspend or terminate access where reasonably required for legal, security, or abuse-prevention reasons.
The app is not directed to children. We do not knowingly collect personal data from children. If we learn that child data was provided, we will take steps to delete it.
If data is transferred outside the European Economic Area, we apply appropriate legal safeguards such as standard contractual clauses or other mechanisms required by law.
We use appropriate technical and organizational measures to protect data against unauthorized access, loss, misuse, or disclosure.
We may update this policy. Changes are published on this page together with the updated version and effective date.
We are not liable for delays, interruptions, or unavailability of the service caused by events beyond our reasonable control, including war, armed conflict, terrorism, civil unrest, sanctions, government actions, natural disasters, epidemics, internet outages, third-party infrastructure failures, or energy shortages.
This Privacy Policy and all matters related to the service are governed by the laws of Poland.
Any disputes arising from this Privacy Policy or use of the service shall be resolved exclusively by the competent courts in Poland.