Fishki Privacy Policy

The controller of your personal data is:

Mateusz Buczak, operating as an unregistered business activity under Polish law Address: ul. Ks. Alojzego Koziełka 106, 44-190 Knurów, Poland Email: support@fishki-med.com

Hereinafter: the "Controller".

This Privacy Policy explains what data we process, for what purposes, on what legal basis and what rights you have. It may serve to provide the information required when data is collected, including the controller's identity, purposes, legal bases, retention period and data subject rights.

Depending on how you use the website or application, we may process:

• email address,
• full name where provided,
• preferred device platform for possible free beta testing (iOS, Android, both or undecided),
• answers submitted through the waitlist form,
• preorder purchase information, including the checkout identifier, amount, currency and transaction status,
• payment data provided by the payment provider,
• technical data such as IP address, device type, browser, operating system and cookie identifiers,
• website or application usage data,
• the content of support requests, bug reports and feature suggestions, together with contact details associated with a submission,
• content added by the user after the application launches.

We process data for the following purposes:

3.1. Waitlist management We process data to add you to the waitlist, send Fishki development updates and notify you about the application launch. Legal basis: consent or the Controller's legitimate interest in serving people interested in the product.

3.2. Preorder management We process data to accept and fulfil the preorder for a 12-month Fishki Premium subscription from public launch, confirm payment, link the subscription, and handle refunds and complaints. We may also use the email address and preferred platform to send an optional, free private beta invitation. Legal basis: performance of a contract or steps taken before entering into a contract; for a testing invitation, the Controller’s legitimate interest in product development.

3.3. Product communication We process data to send information about development, tests, surveys and Fishki updates. Legal basis: consent or the Controller's legitimate interest where communication concerns a product in which the user has previously shown interest.

3.4. Marketing With your consent, we may send marketing information about Fishki, promotions, special offers and new features. Legal basis: consent. You may withdraw consent at any time.

3.5. Analytics and website improvement We may analyse website use to improve its operation, measure content effectiveness and develop the product. Legal basis: the Controller's legitimate interest or consent where required for cookies or similar technologies.

3.6. Establishing, pursuing or defending claims We may process data to establish, pursue or defend claims. Legal basis: the Controller's legitimate interest.

3.7. Accounting and tax obligations For preorder purchases, we may process data required for accounting and tax settlements. Legal basis: a legal obligation incumbent on the Controller.

3.8. Support and user submissions We process data to receive and store questions, bug reports and feature suggestions, notify the Controller about new submissions and respond to users. Legal basis: performance of a contract, steps taken at the user's request or the Controller's legitimate interest in providing support and developing the product.

We may use external providers for the website, forms, payments, hosting, analytics and email communication.

These may include:

• website hosting providers,
• form providers,
• payment operators,
• email tool providers,
• analytics providers,
• application infrastructure providers.

We currently use the following providers in particular:

• Vercel - website hosting,
• Tally - waitlist forms,
• Railway - application API hosting and preorder form processing,
• Supabase - database, user accounts and application data storage,
• Resend - email delivery and notifications concerning accounts, purchases, support and user submissions,
• PayByLink - payments for the Polish version,
• Stripe - payments for the international version.

Providers process data only to the extent necessary to provide services to the Controller.

Some service providers may process data outside the European Economic Area.

Where data is transferred outside the EEA, the Controller uses appropriate legal safeguards under data protection law, including standard contractual clauses where required.

We retain data for the following periods:

• waitlist data - until the user unsubscribes or the purpose of collection ends,
• marketing data - until consent is withdrawn,
• preorder data - for the period required to perform the contract and handle complaints, refunds and potential claims,
• accounting and tax data - for the period required by law,
• technical and analytics data - for the period set in the relevant analytics tool or cookie settings,
• support requests, bug reports and feature suggestions - for the period required to handle the submission, develop the product and establish, pursue or defend claims,
• user account data - while the account exists and afterwards for the period required for claims or legal obligations.

You have the right to:

• access your data,
• rectify your data,
• erase your data,
• restrict processing,
• data portability,
• object to processing,
• withdraw consent at any time,
• lodge a complaint with the President of the Polish Personal Data Protection Office.

Withdrawal of consent does not affect the lawfulness of processing carried out before it was withdrawn.

To exercise your rights, contact:

support@fishki-med.com

Providing data is voluntary but may be necessary to:

• join the waitlist,
• purchase the preorder,
• receive application access,
• contact the Controller,
• handle a complaint or refund.

Failure to provide required data may prevent use of a given feature.

The website may use cookies and similar technologies to:

• ensure proper website operation,
• remember user preferences,
• compile statistics,
• measure marketing effectiveness,
• improve the website.

Users can manage cookies in their browser settings.

If analytics or marketing tools require consent, the cookie notice should allow users to give or refuse it.

Fishki is intended primarily for medical students and adults.

A minor wishing to use the application should do so with the consent of a parent or legal guardian where required by law.

The Controller uses appropriate organisational and technical measures to protect personal data against unauthorised access, loss, alteration or disclosure.

No method of Internet transmission or data storage can provide a complete guarantee of security.

The Controller may change this Privacy Policy, in particular because of:

• changes to website or application features,
• changes of service providers,
• changes in law,
• changes in how data is processed.

The new version of the Privacy Policy will be published on the website.

For privacy and personal data matters, contact:

support@fishki-med.com