Privacy

Effective date: 31 October 2026 · Version 2.3

This privacy policy explains which personal data Do4U (do4u.eu) processes, for what purpose, on what legal basis and for how long, who receives it and which rights you have. It covers visitors to the website, people with a Do4U account and people who contact us. Where we process the content of your tasks on behalf of a business customer, the data processing agreement applies in addition (section 3).

1. Controller and contact

LW IT Solutions Company Lukas Wójcik
al. Tadeusza Kościuszki 80/82 lok. 301
90-437 Łódź
Poland
VAT ID: PL7252266190
Email: support@do4u.eu

Please send data protection questions and requests to the same address. We have not designated a data protection officer. Article 37(1) GDPR does not require one from us: our core activity is neither the regular and systematic monitoring of people on a large scale nor the large-scale processing of special categories of data. If we designate one, the contact details will appear here.

2. In short

• The AI of Do4U runs on our own servers in Poland, in the EU. We do not send the content of your tasks to any external AI provider, and we do not use it to train AI models.
• Inputs and results are deleted automatically: after 7 days on Free and in the guest demo, after 30 days with a purchased package. With “Don't save” the input is deleted right after processing and the result after it has been shown once, at the latest after one hour.
• We only use cookies that the website needs. There is no analytics, no advertising and no tracking.
• Payments are handled by Stripe, emails are sent through OVHcloud. Stripe and Google (reCAPTCHA) may transfer data to the USA (section 17).
• On My data you can see what we store about you and for how long, delete results early, download all your data and delete your account.

3. Our two roles: controller and processor

For the website, your account, purchases, invoices, emails and support we are the controller.

The content you give the tools can contain personal data of other people, for example a customer email you want answered. If you use Do4U as a business, we process this content on your behalf and according to your instructions (Art. 28 GDPR); you are the controller for it. Business customers can conclude the data processing agreement in the dashboard. If you use Do4U as a private person for your own purposes, we process the content as controller, solely to carry out your task.

4. Visiting the website

4.1 Web server logs

For every request our web server records the IP address, the time, the requested address, the status code and the browser identification. The logs serve operation and defence against attacks and are deleted after 14 days. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is a secure and working website.

4.2 Application logs

In addition, the application records every page view: IP address, the country derived from it, time, page address and referring page (both without query parameters, so that no links with access codes end up in the log), browser identification, device type, operating system, browser, language and, if you are signed in, your account. This access log is deleted after 60 days. Technical errors are recorded in an error log, where applicable with the account concerned; it is deleted after 90 days. Legal basis: Art. 6(1)(f) GDPR (operation, troubleshooting, defence against abuse).

We determine the country of an IP address with a database on our own server. No third party is asked.

4.3 Free checks and the guest demo

Some tools can be used without an account or for free a limited number of times per day. To count this, we store a keyed hash of your IP address (or of your account number) together with the date and the number of runs. The IP address itself is not stored for this. The entries are deleted after two days. Legal basis: Art. 6(1)(f) GDPR (fair distribution of free capacity, protection against abuse).

4.4 No external resources

The website loads scripts, styles and fonts from our own server. The exceptions are the script of our form protection from formconfirmed.com, a service of the same provider (section 4.5), and, when certain forms are sent, the script of Google reCAPTCHA (section 4.6). There are no external fonts, no content delivery network, no analytics and no advertising tools. Only when you buy credits does your browser go to the payment page of Stripe (section 12).

4.5 Our own form protection (formconfirmed)

To protect against spam and automated attacks, the following forms are checked by formconfirmed: sign-in, registration, forgotten and reset password, the support window, the newsletter sign-up, the demo on the home page and, if you are not signed in, the free website check, the free mini tools and the withdrawal form (section 12.4). formconfirmed is a product of the same provider (section 1) and runs on its servers in Poland; no third parties are involved.

When you open a page with such a form (for the support window: when you open it), your browser loads a script from formconfirmed.com and fetches a signed task there. As soon as you use the form, your browser solves it in the background (a proof of work) and sends the result with the form as a single-use token. In the process, formconfirmed.com receives from your browser the address of the page, the language, your IP address and the browser identifier. The token contains the task, its solution, the points in time, whether a field invisible to humans was filled in and two browser signals: whether the browser reports that it is remote-controlled (webdriver) and whether there were real inputs (keyboard, mouse or touch). Without JavaScript these forms cannot be sent; in that case, please write to support@do4u.eu.

Our server submits the token together with your IP address and the value of the invisible field to formconfirmed for checking. If the form contains an email address, it is sent as well; formconfirmed checks only its domain (whether it belongs to a disposable email provider and whether it accepts email at all) and does not store the address – only the result of the domain lookup, for up to seven days. For the support window, the text of your message is also sent; formconfirmed checks it for signs of spam (collections of links, typical spam phrases, gibberish), where applicable also with an AI on the provider’s own servers, and does not store it. We do not send your password or any other input. To assess the submission, formconfirmed also compares your IP address with known data-centre networks, checks whether the task is sent back from the same network from which it was fetched (the task is bound to your network) and whether submissions from your network were recently blocked on other sites protected by formconfirmed (reputation across several sites). For this and to detect repeated submissions, it stores your network only as a truncated address range (IPv4 without the last byte, IPv6 only the first 48 bits) and as a hash with a key that changes daily (pseudonymised): with the check result for at most one hour, with the used token for about eleven minutes and in the counter of fetched tasks for about one hour. Check results (action, score, reasons, domain) are kept for 30 days without this hash. The text of a message is checked in memory only. As with every request, the web server log of formconfirmed.com records the full IP address and the browser identifier for 14 days. If formconfirmed rejects a submission, we note this in the error log without the IP address and without the content (section 4.2).

If the result is “block”, the submission is rejected; you can try again or write to us. If the result is “suspicious” (for example an address from a data centre or VPN, signs of an automated browser or a disposable email address), sign-in, registration and password forms additionally require a clear result from Google reCAPTCHA with a stricter threshold (section 4.6), otherwise the submission is rejected; support requests are accepted and receive a note of the reasons (without the IP address), which is stored and deleted together with the request; for the other forms we note the suspicion in the error log. If formconfirmed cannot be reached, the submission is accepted. The form protection sets no cookies, stores nothing in your browser and creates no fingerprint of your device. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is protecting your account, our services and the free capacity against spam and automated abuse. In the browser, the form protection processes only what is necessary to send the form you are using (Art. 5(3) of Directive 2002/58/EC; in Poland Art. 399(3)(2) of the Electronic Communications Law, Prawo komunikacji elektronicznej). No data are transferred to a third country.

4.6 Protection against automated requests (Google reCAPTCHA)

Sign-in, registration, forgotten and reset password, the support window and the confirmation of a withdrawal without an account (section 12.4) are also checked by Google reCAPTCHA v3 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The script is loaded only when you send one of these forms, not when a page is called up; pages without them do not load it at all. When it runs, it creates an entry in the local storage of your browser (“_grecaptcha”), and your browser sends Google information about the device and its use, including your IP address. From this, Google assesses whether the submission comes from a human and returns a score. Our server does not send Google your IP address or the content of the form, but the token generated in your browser, and receives the score in return. If there is no valid result, if Google cannot be reached or if the score is below a threshold, the submission is rejected; if formconfirmed has rated it as suspicious (section 4.5), a stricter threshold applies. You can then try again or write to us at support@do4u.eu. The score decides only on the individual submission; beyond that, no one is assessed. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is protecting your account, our services and outgoing email against spam and automated abuse. The check runs only when such a form is actually sent, and the access to your browser is then strictly necessary to protect that submission (Art. 5(3) of Directive 2002/58/EC; in Poland Art. 399(3)(2) of the Electronic Communications Law, Prawo komunikacji elektronicznej); it therefore does not require consent. Google may also process the data in the USA (section 17). Further information: Google’s privacy policy.

5. Cookies and storage in the browser

We only store information in your browser that is strictly necessary for the service you request. No consent is needed for this (Art. 5(3) of Directive 2002/58/EC; in Poland Art. 399(3)(2) of the Electronic Communications Law). The legal basis for the related processing is Art. 6(1)(b) and (f) GDPR.

• bpid – session cookie for sign-in, language and form protection. It ends when you close the browser.
• bp_remember – only if you choose to stay signed in: keeps you signed in for 30 days. In our database we only keep a hash of it.
• bp_device – a random device identifier (one year). It lets us recognise a device you have signed in with before and warn you by email about a sign-in from a new device. In our database we only keep a hash of it.
• __Host-sso-browser – only for a sign-in through the single sign-on of a team (section 10); valid for five minutes.
• In the local storage of your browser we keep settings that never leave your device: light or dark mode, reduced motion, your favourite tools and, in a team, the last selected team and project.

We do not use analytics, advertising or third-party cookies. The form protection (section 4.5) sets no cookies either and stores nothing in your browser. Google reCAPTCHA (section 4.6) creates an entry in the local storage of your browser (“_grecaptcha”) when you send a form protected by it; this too is strictly necessary to protect that submission.

6. Account and sign-in

6.1 Registration and account data

For an account we store your email address, your name, your password as a hash, your language and whether you act as a private person or as a business. Businesses also provide company name, address, country, the VAT ID if available and, optionally, a separate invoice email address. Without email address and password we cannot create an account; without company details we cannot serve a business account. You are not obliged to provide these data, but they are required for the contract. Legal basis: Art. 6(1)(b) GDPR. The data is kept until you delete your account; data needed for invoices is kept as described in section 12.

6.2 Proof of acceptance

When you register and when you buy, we record which version of the terms, of this privacy policy and, for consumers, of the withdrawal notice was shown to you, together with the time and IP address. If you confirm the data processing agreement as a business, we record the time and company. These records serve as proof of the contract (Art. 6(1)(f) GDPR). They are kept as long as the account exists and are deleted four years after acceptance once the account has been deleted. Records belonging to a purchase are kept like the purchase (section 12).

6.3 Sign-in and security

• For every sign-in we store IP address, browser identification, browser, operating system and device type, as well as the time of the last activity. In the settings you can see this list and end individual sign-ins. The list is kept as long as your account exists. We also store the time and IP address of your last sign-in with the account.
• Sign-in attempts (time, IP address, email address entered, success) are kept for seven days to detect and slow down attacks. Counters against too many attempts or registrations expire after at most two days.
• Known devices (hash of the device identifier, first and last use) are deleted 365 days after the last use.
• You can protect your sign-in with a second factor (one-time codes from an app) or with a passkey. The secret for the codes is stored encrypted, recovery codes only as check values; for a passkey we store only its public key, its name and the time of use.
• Security-relevant actions in your account (for example registration, sign-in and sign-out, change of password or email address, data export, changes in a team) and the actions of our administration are recorded with time and IP address in an activity log. It is deleted after 365 days.

Legal basis: Art. 6(1)(b) and (f) GDPR (secure provision of the account, defence against abuse).

6.4 Support view of your account

If you ask us for help, our support can view your account as you see it. Every such access is recorded and appears in your data export. Our staff see the inputs and results of your tasks only if you expressly ask for this in a support request, or where this is necessary to prevent misuse or violations of the law (Art. 6(1)(b) and (f) GDPR); never for tasks with “Don't save”.

7. Tasks for the AI tools

7.1 What we process

We process what you give a tool – texts, files, web addresses, images and the options you choose – and the result, only to carry out the task, to show you the result and to bill it (Art. 6(1)(b) GDPR). Before each run we show the expected credits.

7.2 Where and by whom

The AI runs on our own servers in Poland, in the EU. We do not pass the content of your tasks to any external AI provider. The computers that run the AI fetch the tasks themselves and are not reachable from the internet. We do not use your inputs and results to train AI models. Our overviews and logs only contain metadata (tool, time, length of the input, credits, status), not the content.

7.3 How long

• Inputs and results: deleted after 7 days on Free and in the guest demo, after 30 days with a purchased package.
• “Don't save”: the input is deleted as soon as the task is done, the result after it has been shown once, at the latest after one hour.
• Images: deleted as soon as the task is finished.
• Failed tasks: the content is deleted right away.
• Batches and language packs: deleted on the date shown for them, at the latest with your account.
• The task record without content (tool, time, status, language, credits, length of the input, and for website checks the domain and the score): deleted 400 days after the task. We need it for billing, for your history and for questions about a charge.

On My data you can delete the inputs and results of individual tasks or of all finished tasks earlier. If you start the same task again in your account while its result is still stored, we may show you that stored result instead of calculating it again; this never happens across accounts and never with “Don't save”.

7.4 Personal data of other people

Please only enter personal data of other people if you are allowed to, and only as much as the task needs. Do not enter special categories of data (for example health data) unless it is necessary and permitted.

7.5 Ratings, refunds and quotes

If you rate a result or ask for your credits back under the credits-back promise, we store the rating or the reason with the task; it is deleted together with the task record. If you allow us to publish a short quote from you, we store the text, the name form you choose, and optionally company and website, and show them on our website. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time on My data; the quote is then removed.

To apply the credits-back promise automatically, we check finished results that were paid for with credits once more by machine against the input, on our own computers (task done, facts, language, requirements). This processes the same data as the task itself; nothing is passed on to third parties, and apart from the verdict with short reasons nothing additional is stored; the verdict is deleted together with the task. There is no such check for tasks with “Don't save”, for image tools, for batches and for sequences of several tools. Legal basis: Art. 6(1)(b) GDPR (fulfilling the promise) and Art. 6(1)(f) GDPR (quality).

8. Reading web pages

Some tools read web pages: only the address you entered, or pages of the same website for tools that check a whole site (for example language packs, broken links, llms.txt, the website report), and pages you have set up for the website watch. We do not crawl the web on our own and we do not build a search index. Our requests come from our own servers in Poland, follow at most three redirects and never go to internal networks. How to recognise them is described on the page How Do4U fetches web pages.

What we read is processed only for the task and stored with it as input or result for the periods in section 7.3. If such a page contains personal data, for example names in an imprint, we process it on the basis of Art. 6(1)(f) GDPR; the legitimate interest is checking publicly accessible pages at the request of our customer. For business customers this is processing on their behalf. Website operators can reach us at support@do4u.eu.

Website watch: if you set up a watch, we store the domain, the pages, the interval and the results of the runs until you delete the watch or your account. We announce each paid run by email in advance.

Proof of ownership: for some functions you prove that a domain is yours with a meta tag, a file or a DNS entry. We store the domain and only a hash of the verification code.

9. Sharing results and reports in your own name

Share links: you can share the finished result of certain website checks as a read-only link. Anyone who has the link can see the result – that is its purpose. The page shows neither your input nor your account. A link is valid for 1, 7 or 30 days, never longer than the result is stored, and you can revoke it at any time. We store only a hash of the link, its validity, the number of views and the time of the last view – no IP address, no browser identification. Expired and revoked links are deleted after 30 days, all links with your account.

Reports in your own name: you can give reports your own name, an additional line and a logo. We store these with your account or team until you remove them or the account or team is deleted. They appear in the reports and, only if you switch it on, in share links. Anyone who receives such a report sees them.

Badge: if you add a Do4U badge to your website, it shows the score and the date of the check and links to a public report until the date shown.

AI label: results always carry a machine-readable note that they were generated with Do4U; it cannot be switched off. The visible note in the web interface is on by default; you can switch it off in the account settings.

Legal basis: Art. 6(1)(b) GDPR.

10. Teams

In a team, several accounts share credits, projects and tasks. We store the team name, the members with their role, the projects and invitations. An invitation contains the email address of the invited person; it is deleted when it expires unused. Members work with the team's tasks according to their role; the team overview shows the usage of the month per project and per member, and the owner can set a monthly limit per member. A team can set up sign-in through its own identity provider (single sign-on); we then receive from that provider the details needed for sign-in, and the team decides on that provider. As long as you own a team with other members, you cannot delete your account. Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for the members who did not conclude the contract themselves (organisation of the team).

11. API, webhooks, plugins and connections

API keys: we store the name, the visible start of the key, the time of creation and last use, the number of requests and, if applicable, the revocation – the key itself only as a hash. Requests are counted for a few minutes to enforce limits. To recognise repeated requests, we keep a receipt without content for a limited time (currently 24 hours). All this is deleted with your account or when you delete the key.

Webhooks: if you enter an address, we notify it when a task is finished or your balance is low. We store the address and a delivery log (status, attempts, last response code). The delivery log is deleted with the task record. The recipient is the address you chose.

WordPress plugin: the plugin sends data to Do4U only when you confirm a task in WordPress, and fetches the result. Depending on the tool, it sends the address and title of an image, the content or the text of a post or page, or its public address – plus your API key, the tool, the result language and the setting “Don't save”. It sends no data about the visitors of your website. Details are on the page of the plugin.

reactive.chat: if you connect your account with reactive.chat, a service of the same provider, you confirm the connection in your Do4U account; reactive.chat then receives its own key, which you can revoke on the API keys page. reactive.chat only sends questions that several visitors asked in the same way (by default at least three), without names, email addresses, telephone numbers or order numbers, together with page addresses. These tasks always run with “Don't save”.

Team channels: where this function is offered, you can have findings of the website watch and finished website checks sent to a channel you set up in Slack, Microsoft Teams or Discord. We store the channel address encrypted and show it only shortened. These services are recipients you choose; they process the message under their own terms (section 17).

Legal basis for this section: Art. 6(1)(b) GDPR.

12. Purchases, payment and invoices

12.1 Payment through Stripe

You pay for credits through Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). Stripe receives your name and email address, the purchase (package, amount, currency) and our purchase and account number as a reference. You enter your payment details directly with Stripe; we never see complete card or account details. Stripe tells us whether the payment succeeded, the type of payment method and the country in which it was issued. For the payment processing, Stripe is a separate controller and processes the payment data under its own responsibility; details: stripe.com/privacy.

Automatic top-up: where offered and switched on by you, Stripe stores your payment method for future purchases. We store your settings, the display of the payment method (for example card brand and last four digits) and, as proof, the text you agreed to with time, IP address and browser identification. The setting is deleted with your account; the proof stays like the purchases.

Bank transfer: business accounts can pay some purchases by bank transfer against a pro forma invoice. We then process the details of the transfer that our bank shows us.

12.2 Tax and legal checks

• We check a VAT ID through the VIES system of the European Commission. The country code and number are transmitted; we store the result, the time and the name registered there. If VIES is unavailable, we repeat the check later.
• To determine the correct VAT, we store with each purchase the country of your address, the country derived from your IP address and the country of your payment method.
• We do not sell to persons and businesses in countries and territories under EU sanctions; for this we check the country of the address and of the payment method.

Legal basis: Art. 6(1)(c) GDPR (tax law and sanctions law) and Art. 6(1)(b) GDPR.

12.3 Invoices and retention

We issue invoices and correction invoices ourselves and send them as a link to your invoice email address or account address. Purchases, invoices, the credit entries that belong to a purchase, your billing details (without the invoice email address) and the proof of the consents given at purchase are kept for 5 years from the end of the year in which the related tax becomes due (for us, the year after the invoice) – also after you delete your account – and are not used for anything else (Art. 6(1)(c) GDPR in conjunction with Polish tax law, in particular Art. 86 § 1 and Art. 70 § 1 of the Tax Ordinance). On My data you can see when this period ends for your invoices.

Individual offers: if you request an individual package, we store the request and the offer. Requests and open offers are deleted with your account; an offer that led to a purchase stays with the purchase.

The other credit entries (free credits, usage, reservations, expiry) are kept as long as your account exists and are deleted with it.

12.4 Withdrawal function

With our withdrawal function (link “Withdraw from contract here”) you can declare a withdrawal online. We store your name, your email address, the details of the contract you give (if you are signed in: the purchase you select), the text of your statement, the date and time of receipt, the language, your account if you are signed in, and the purchase and account to which we assign the statement. We store your IP address only in truncated form (IPv4 without the last byte, IPv6 only the first 48 bits) and as a check value with a secret key (HMAC), which we use to limit the number of statements. You immediately receive a confirmation of receipt by email with the content of your statement and the date and time of receipt; we also open a support request with the statement in order to process it. If you are not signed in, the form is protected by formconfirmed (section 4.5). Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 11a of Directive 2011/83/EU (receiving and confirming the statement), Art. 6(1)(b) GDPR (processing the withdrawal) and Art. 6(1)(f) GDPR (protection against abuse). We keep the statements for 10 years from the end of the year of receipt, also if you delete your account before then; then they are deleted automatically. The support request follows the period in section 14.

13. Emails

We send emails that belong to your account and your tasks: confirmation of your address, password reset, security notices (for example a sign-in from a new device), notices about a low balance and shortly before purchased credits expire, announcements and results of the website watch, invoices, invitations to a team and answers to support requests. Legal basis: Art. 6(1)(b) and (f) GDPR.

Tips by email (one email with first steps) and the newsletter “New at Do4U” are sent only if you have agreed to them in the email settings (Art. 6(1)(a) GDPR). You can withdraw at any time in the email settings or through the link in every email. The newsletter is not offered at present; if it is, sign-up works with confirmation by email, and we keep the proof of the consent (time, text version, language, IP address of the confirmation) for three years after you unsubscribe.

Emails are sent through the email service of OVHcloud (OVH SAS, France). Recipient address, subject and content are transmitted in the process. Sent emails stay in our outbox for 30 days and are then deleted; the data export only lists when which email was sent, without its content.

14. Support

If you write to us through the support form, we store your email address, the topic, your message, your IP address and the country derived from it, the browser identification, the page you wrote from, your language and, if you are signed in, your account. The IP address serves to protect the form against abuse (at most three requests per hour and address). To answer you, we can have your message translated or a draft reply prepared; this is done by the AI on our own servers, and email addresses and longer digit sequences are removed beforehand. A person always reads and sends the answer. Legal basis: Art. 6(1)(b) GDPR if you are a customer, otherwise Art. 6(1)(f) GDPR (answering your request). Support requests are kept for 2 years after the request is closed (counted from our last reply, or from receipt if there was no reply), also if you delete your account before then; after that they are deleted automatically.

15. Referrals, vouchers and partner programme

Where we offer them: if you redeem a voucher or recommend Do4U, we store the code, the redemption or the referral with the credits booked. To prevent abuse of referrals, we compare whether two accounts paid with the same payment method; for this we keep only a check value, never the payment details, and delete it with your account. The other account in a referral does not see your identity. In the partner programme we store your approval and the commissions, without data about the people you referred. Legal basis: Art. 6(1)(b) and (f) GDPR. Records of referral credits and voucher redemptions are kept as proof of the credits for 2 years after the redemption or referral (for a referral counted from the credit or our decision on it, otherwise from the registration with the code), also if you delete your account before then; then they are deleted automatically. Referrals in the partner programme are kept at least as long as they can still lead to a commission.

16. Recipients and processors

We do not sell or rent personal data. We run the servers for the website, the AI and the form protection (formconfirmed, section 4.5) ourselves. Data is received only by:

• OVH SAS (OVHcloud), France – sending of emails, as our processor.
• Stripe Payments Europe, Limited, Ireland – payment processing, as a separate controller (section 12.1).
• Google Ireland Limited, Ireland – protection of sign-in, registration, password, support and withdrawal forms against automated requests (reCAPTCHA, section 4.6).
• The European Commission – VIES check of a VAT ID.
• Our bank – for payments by bank transfer and refunds.
• Authorities and courts, for example tax authorities, where we are legally obliged to disclose data.
• Recipients you choose: addresses of your webhooks, team channels (Slack, Microsoft Teams, Discord), reactive.chat if you connect it, members of your team and anyone you give a share link or a report.

17. Transfers to countries outside the EU

We process your data in the EU. Stripe may transfer data to Stripe, Inc. in the USA, and Google, for reCAPTCHA (section 4.6), to Google LLC in the USA. This transfer is based on the adequacy decision of the European Commission for the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795, Art. 45 GDPR) and, alternatively, on standard contractual clauses (Art. 46(2)(c) GDPR). If you send messages to Slack, Microsoft Teams or Discord, these services may process them outside the EU; you choose this destination yourself, and the service processes the message under its own terms.

18. Security and backups

All connections to the website and the API are encrypted (HTTPS). Passwords, API keys, links of shared results and verification codes are stored only as hashes, channel addresses and two-factor secrets only encrypted. Web addresses are read with protection against access to internal networks. Access to the administration is limited to authorised persons and protected by two-factor sign-in.

We regularly back up the entire server. We keep the backups for 7 days; after that they are overwritten. Deleted data can therefore remain in the backups for up to 7 days and is only used for a restore.

19. Retention periods at a glance

• Inputs and results: 7 days (Free, guest demo), 30 days (package); “Don't save”: immediately or after one display, at the latest one hour; images: when the task is finished.
• Task records without content, ratings, refunds, webhook deliveries: 400 days.
• Web server logs: 14 days. Access log: 60 days. Error log: 90 days. Activity log: 365 days.
• Form protection (section 4.5): hash of the truncated address range with the check result at most one hour, with the used token about eleven minutes, in the task counter about one hour; check results without the hash 30 days; result of the email domain check at most seven days; web server log of formconfirmed.com 14 days.
• Sign-in attempts: 7 days. Counters for free checks and the demo: 2 days. Known devices: 365 days after last use. Stay-signed-in cookie: 30 days.
• Sent emails in the outbox: 30 days.
• Share links: until expiry or revocation plus 30 days.
• Account, settings, glossary, brand voice, watches, API keys, branding: until you delete them or your account.
• Sign-ins (the list in the settings, including ended sign-ins): until you delete your account.
• Proof of acceptance of the terms: as long as the account exists, then four years after acceptance.
• Purchases, invoices, billing details and related proof: 5 years from the end of the year in which the related tax becomes due (the year after the invoice).
• Withdrawal statements made with the withdrawal function: 10 years from the end of the year of receipt, also after you delete your account (section 12.4).
• Support requests: 2 years after the request is closed (section 14).
• Referral credits and voucher redemptions: 2 years after the redemption or referral, also after you delete your account (section 15).

20. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw a consent at any time with effect for the future (Art. 7(3)); this does not affect the lawfulness of the processing until then. We answer within one month (Art. 12(3) GDPR).

Right to object (Art. 21 GDPR): where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), for example logs, abuse prevention or support requests from people without an account, you can object at any time on grounds relating to your particular situation. We then stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

How this works in Do4U

• See your data: My data shows what we store about you, how many entries there are, how long they are kept and what happens to them when you delete your account.
• Download your data: on My data you can download, after entering your password, one file in JSON format with everything we store about your account (Art. 15(3) and Art. 20 GDPR). It does not contain passwords, API keys, secrets or hashes. Inputs and results are included as long as they are still stored.
• Correct your data: you can change your name, email address, language and billing details in the settings.
• Delete results: on My data you can delete the inputs and results of individual tasks, of all finished tasks or of tasks older than a number of days.
• Delete your account: in the settings, after entering your password. Running tasks are cancelled first. Everything marked “Deleted” on My data is deleted at once. Purchases, invoices and the related billing records stay for the legal retention period (section 12.3) and are not used for anything else (Art. 17(3)(b) GDPR). Support requests stay until their period ends (section 14), as do records of referral credits and voucher redemptions (section 15) and withdrawal statements made with the withdrawal function (section 12.4). As long as you own a team in which other people work, deletion is not possible; remove the other members first or write to us.

For all other requests write to support@do4u.eu. If your request concerns content that a business customer had processed with Do4U, that customer is the controller; please contact them first. We support them in answering.

Complaint: you can lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the Member State where you live or work or where the alleged infringement took place. The authority responsible for us is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.

21. No automated decisions

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22(1) GDPR). The AI produces texts and checks that you review yourself. Automatic limits (for example on free runs or requests) only protect the service. The VAT on a purchase follows from the result of the VIES check and the statutory rules; if you think it is wrong, write to us and we will check it by hand.

22. Changes to this policy

We update this privacy policy when the processing changes. The version that was shown to you at registration or at a purchase is recorded (section 6.2). In case of differences between language versions, the Polish version prevails.