Privacy Policy | SleepComplainer

§1 Data Controller

The data controller is SilentArc sp. z o.o. (registration details as in the Terms of Service), operating the Complainer platform at complainer.pl.

Data protection contact: kontakt@complainer.pl

§2 Categories of Data Processed

Identity and contact data: first name, email address — for account creation and service delivery.
Child health data (special category — GDPR Art. 9): age, weight, health history, sleep patterns, feeding habits and other information provided in the consultation form. This data is necessary to prepare a personalised analysis.
Technical data: IP address, User-Agent header, session cookies.
Payment data: we do not store card details — payments are handled by Stripe (PCI DSS Level 1 certified).

§3 Legal Bases for Processing

Purpose	Legal basis
Delivery of the consultation report	GDPR Art. 6(1)(b) — performance of a contract
Processing child health data	GDPR Art. 9(2)(a) — explicit consent of the parent/legal guardian
Issuing accounting documents	GDPR Art. 6(1)(c) — legal obligation
Archiving consumer consents	GDPR Art. 6(1)(f) — legitimate interest (defence of legal claims)

§4 Retention Periods

Consultation form data and report: 3 years from the date of service delivery (consumer claims limitation period).
Accounting data: 5 years from the end of the tax year, per Polish Accounting Act.
Consent logs: for the duration of the account + 3 years after deletion.

§5 Your Rights

Under GDPR you have the right to:

access your data (Art. 15),
rectification (Art. 16),
erasure ("right to be forgotten", Art. 17) — subject to mandatory retention under tax law,
restriction of processing (Art. 18),
data portability (Art. 20),
lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl,
withdraw consent for processing child health data — withdrawal does not affect the lawfulness of processing before withdrawal. Contact: kontakt@complainer.pl.

§6 Data Recipients

Your data may be transferred only to trusted processors:

Stripe, Inc. — payment processing (data processing agreement, Standard Contractual Clauses for US transfers).
Microsoft Azure — hosting and data storage (EU data centres).
Google Ireland Limited — tag management and statistical measurement in Consent Mode; analytics and advertising storage remain disabled without separate consent.
OpenAI, L.L.C. — report generation; only pseudonymised form data is transmitted (no names, emails or directly identifying information); OpenAI DPA applies.

We do not sell data or share it with advertising networks.

§7 Cookies

We use strictly necessary cookies (session, CSRF token). Google Tag Manager and Google Analytics operate with analytics and advertising storage disabled by default, so they do not write or read such cookies without separate consent. Enabling them requires the user's prior, separate consent.