Controller

The controller of personal data is Evgenii Shiriaev, Calle de Mendez Alvaro 2, 28045 Madrid, Spain, e-mail: info@catius.app (see Legal information).

Which data we process

The photo or PDF of the nakaz zapłaty (payment order) that you upload.
The details read out of it and confirmed by you, for example the court, the sygnatura akt (case number), the amount and the day of service.
For zarzuty (objections): the facts and the list of evidence that you enter.
Your e-mail address, to deliver the result and for any queries.
Payment data, which arises solely at our payment provider Stripe.
Technical data for abuse protection: your IP address is counted in order to limit the number of requests and is stored only briefly.

The scan you upload

The uploaded photo or PDF is used solely for automated text recognition and is deleted immediately afterwards. For that single step the file is passed to the providers named below under "Recipients of data"; which of them receives it depends solely on whether the file already contains machine-readable text. Deletion takes place immediately after processing, whether it succeeded or not.

Automated reading: please check it

The court, the sygnatura akt, the amount, the day of service and the other details are read out of the scan by machine, through text recognition and a language model. The reading may be wrong. We show you the details read out for confirmation before the document is created; check them carefully.

How long your order is stored

Until you pay, the order is deleted after 48 hours. After payment it remains stored for 14 days, or 30 days if you choose the extension. After that period we delete the files and clear your e-mail address and the other details of the case. For accounting only the order ID, the amounts, the country relevant for VAT and the time data of the order remain, for the period required by tax and accounting rules.

Contact details for marketing

If you separately consent to the use of your e-mail address for our similar offers, we store it separately from the order in a separate contact list, on the basis of your consent. You can object to this use informally at any time.

Recipients of data

Cloudflare: hosting, database, file storage and rate limiting against abuse. The database and storage are located in the EU.
Google Ireland Limited, Dublin, Ireland: measuring the effectiveness of advertising through Google Tag Manager and Google Ads, solely after your consent. Transfer to Google LLC in the USA cannot be ruled out; Google LLC is certified under the EU-US Data Privacy Framework.
Stripe: payment processing. We do not see full payment details; they remain with Stripe.
Resend: sending our e-mails. The e-mail with your result carries your documents (PDF and DOCX) as attachments, so their content, including the details of your case, passes through Resend's systems. Resend processes data in the USA and is certified under the EU-US Data Privacy Framework. The subject and the text of our e-mails contain no details of your case.
Cloudflare Workers AI: reading text out of PDFs with a text layer, and the language model that splits the recognised text into the individual details. According to its own statement, Cloudflare does not use processed content to train models. For this step an EU location is not guaranteed; the processing is based on a data processing agreement with standard contractual clauses.
Mistral AI SAS, Paris, France: text recognition for photos and scanned PDFs without a text layer. According to the provider, processing takes place in the EU. We have expressly switched off the use of our requests to train Mistral AI models.

Third-party data in your document

Your nakaz zapłaty and the prepared sprzeciw or zarzuty contain personal data of other persons, in particular the claimant. We process it because it is necessary to create the document you ordered.

Legal basis

Art. 6(1)(b) GDPR: performance of the contract with you, including processing of the scan and the confirmed details.
Art. 6(1)(f) GDPR: legitimate interest in creating the ordered document, even if it contains third-party data.
Art. 6(1)(a) GDPR: your consent, if you consented to marketing.
Art. 6(1)(c) GDPR: legal obligations to retain accounting data.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection to processing. Contact info@catius.app or use the contact form.

Supervisory authority

You have the right to lodge a complaint with a supervisory authority, in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, PUODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. For the controller the Spanish authority Agencia Española de Protección de Datos (AEPD) is also competent.

Measurement with Google Tag Manager and Google Ads

We advertise our service on Google Ads. To know which advertisement visitors come to us through, we use Google Tag Manager and, through it, Google Ads tags. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

These services load only after your consent in the banner. Until then nothing is passed to Google and no Google cookies are set. You can withdraw your consent at any time through "Cookie settings" in the footer of the page; from the withdrawal on, the services do not load.

After consent, Google processes in particular your IP address, the page visited, the date and time and browser data, and stores identifiers in cookies on your device. The legal basis for storing and reading information on the device is your consent under art. 399 of the Electronic Communications Law (ustawa z dnia 12 lipca 2024 r. Prawo komunikacji elektronicznej), and for the subsequent processing Art. 6(1)(a) GDPR.

We store your answer to the banner in a cookie on your device so that we do not ask again on every page. This cookie is set even if you refuse and contains only your answer.

None of this is needed to prepare your document.

Privacy policy