Privacy Policy

Scope

This Policy shall govern any interaction between Zusia and users related to personal data when you:

• use our website – zusia.pl and www.zusia.pl.
• use of our services.
• reach us with your questions and enquiries or interact with us in any other form.

This Policy neither governs nor determines the rights and obligations of third parties. It also does not apply to third-party applications or software available to users for integration with the Services. Thus, if you integrate any third-party applications with our Services, we will not be able to control how such applications and tools process your personal data.

Please do not use the Services if you do not agree with the provisions and scope hereof.

Who determines the purposes and means of personal data collection?

The purposes and means of how your personal data is collected in these Services are determined by the following person:

Uladzimir Treihis, a natural person
ul. Rzemieślnicza 4c, 15-773 Białystok, Poland
No NIP, REGON or KRS.
email: info@zusia.pl

We have not appointed a Data Protection Officer. Any matter concerning your personal data may be addressed to the email address above.

Personal Data We Collect

Personal data is any information that could enable direct or indirect identification of a person (e.g., their name, passport details, online identifier, etc.).

In accordance herewith, personal data may be collected both directly and indirectly.

(1) Personal data are collected directly when you provide them voluntarily (e.g. when registering in the Services).

(2) Indirect collection of personal data may occur automatically when accessing the Services, for example through cookies and through the technical logs of our hosting providers.

The personal information we collect varies based on your interactions with our website and other services. The categories of data we may gather include:

• Authorization Data – email address, password hash (we do not store passwords in plain text), the date on which your email address was confirmed, and the hashes of your refresh tokens.
• Account Data – your plan tier, your role in the Services, the dates on which your account was created and deleted, the content of your conversations together with message metadata (citations, answer mode, retrieval query), and your interface language.
• Guest Session Data – the identifier of an anonymous session (a UUID stored in the zus_session cookie), the counter of the messages you have sent within that session, and the content of your conversations. You may use the chat without an account, with a limit of 3 user messages per session.
• Payment Data – when you pay for our services: the transaction identifier, amount, currency, date and status, the type of payment method together with the last four digits and the brand of the card, and the details needed to issue an invoice. Card numbers and other payment credentials are collected by the payment provider and do not reach our servers. Payments are not in operation as of the date of this Policy; the payment provider will be named in “Transfer and Disclosure” before the first payment is accepted.
• Log Data – the IP address, user agent, timestamps, requested addresses and errors recorded in the technical logs of our hosting providers. The content of your messages is not written to these logs.
• Customer Support Data – your contact information as well as details shared when you reach out with your enquiry, such as your messages and any relevant information needed to address your inquiries.
• Community Story Data – the description of your ZUS or tax problem and of how you resolved it that you submit through the “Share your case” form, together with the name or nickname you may optionally provide. These are free-text fields, so they may contain any information you choose to include.
• Product Feedback Data – the text you submit through the feedback form about what you liked, what you disliked and what we should change or add, together with your rating of how helpful you find the Services, the language of the interface, and a hash of the IP address from which the form was submitted. The form is available only to a signed-in user, and the submission is linked to your account. These are free-text fields, so they may contain any information you choose to include. The content of the form is not transmitted to our language model provider.
• Marketing Data – if you subscribe to our newsletter or blog updates: your contact details and your other marketing preferences. We do not run any newsletter or marketing communication as of the date of this Policy.
• Analytics Data – if we introduce analytics tools: IP-address, traffic data, location data, internet connection details, device details, browser details, operating system details, your search queries on our website. We use no analytics or advertising tools as of the date of this Policy; this Policy and our Cookie Policy will be updated before any such tool is deployed. Until then, technical data of this kind is processed only as Log Data described above.

Sensitive Personal Information. We do not request, and the Services contain no field for, special categories of personal data within the meaning of Article 9 GDPR (such as health data, religious or political beliefs, or trade union membership), data relating to criminal convictions within the meaning of Article 10 GDPR, or national identification numbers such as PESEL or NIP.

Please do not enter such information into the chat, into the “Share your case” form or into the feedback form. If you do so in the chat or in the “Share your case” form, it will be stored as part of the content of your message and, in the case of the chat, transmitted to our language model provider in order to generate a reply, in the same way as any other part of your message. A feedback submission that contains such information, or an email address or a telephone number, is refused and is not stored. We will not use it for any purpose other than replying to you and operating the Services, and we will delete it at your request or when you delete the relevant conversation or your account.

Please also refrain from entering personal data concerning other individuals.

Data Processing, Storage and Protection

“Processing” is understood as at least one of the following: storage, modification, retrieval, disclosure, structuring, use, destruction as well as any other action with respect to your personal data.

When it comes to application processing purposes as well as respective legal bases, we process your personal data as follows.

We also might process your personal data to comply with applicable legal, regulatory, or contractual obligations, including responding to lawful requests and enforcing our Terms of Service.

We do not carry out profiling. The automated processing that takes place in the Services does not result in decisions that produce legal effects concerning users or similarly significantly affect them within the meaning of applicable data protection regulations: the answers generated by the chat are informational and are not a decision taken by us in your individual case.

Your personal data will be stored on the servers of our counterparties that we are using for operating our Services. We do not maintain a separate archive or backup of our own; restoration is performed by our hosting provider in accordance with its own policy.

Zusia shall take all necessary organisational, legal and technical measures available to us for protection of your personal data, including encryption in transit (TLS), password hashing with Argon2, short-lived access tokens, and httpOnly, Secure and SameSite=Lax cookies. Users of the Services shall also be responsible to the maximum possible extent for the provision of accurate account details, keeping passwords and any other information required for authorisation confidential and its protection from unauthorised access by third parties.

Any personal data collected and processed hereunder shall be properly protected unless:

(1) you consent to their disclosure;

(2) such personal data are anonymised;

(3) such personal data are subject to disclosure under the applicable law.

We will do our best to keep your personal data protected. However, despite any possible measures taken on our part, we cannot guarantee full protection of the Services against information security risks. Should a personal data breach occur, we will notify the President of the Personal Data Protection Office within 72 hours of becoming aware of it where the breach is likely to result in a risk to the rights and freedoms of individuals, and we will inform the individuals concerned where that risk is high.

Artificial Intelligence and the Chat

The chat is an artificial intelligence system. Answers are generated automatically: the system searches a corpus based mainly on Polish official sources and then produces a reply using a language model. A human does not review each answer before it is shown to you. The answers are informational and do not constitute tax, legal or accounting advice; this is set out in our Terms of Service.

What you type into the chat. The chat accepts free text, so you decide what it contains. We do not ask for, and do not need, your PESEL, NIP, identity document or bank account numbers in order to answer a question, and the Services contain no field for them.

Before a message is sent to our language model provider, we automatically check it for PESEL numbers, NIP numbers, bank account numbers and identity document numbers (passport and residence card), and we warn you when we detect one so that you can remove it before sending. This check is a safeguard, not a guarantee: it cannot recognise every form of personal data, and it does not replace your own judgment about what you type.

Whatever you type is stored as the content of your message and is transmitted to our language model provider in order to generate a reply. It is kept for the periods set out in the table above: 30 days from your last activity for a guest session, and until you delete your account for a registered user. Deleting a conversation or your account removes it from our systems; it does not recall what has already been sent to the model provider during that session.

If you realise you have entered something you did not intend to share, you can delete that individual conversation in the Services, delete your whole account, or write to us at info@zusia.pl and we will delete it.

In order to generate an answer, the content of your message, a shortened history of the conversation and fragments of the corpus are transmitted to OpenAI. Data submitted through the OpenAI API is not used to train OpenAI models, and we have not enabled any sharing for that purpose. We have not purchased Zero Data Retention, so OpenAI may retain requests for abuse monitoring, ordinarily for up to 30 days.

We review conversations in order to check whether the answers given were adequate and to identify the questions that are asked most often. Conversations are reviewed without any link to your account or to your session, so the person reviewing them cannot trace a conversation back to you. We do not use conversations to train or fine-tune any model; we may use them to test the performance of the model we operate.

Transfer and Disclosure

A number of third parties may have access to your personal data - processors, services of which we use in order to constantly improve our Services, as well as provide you with the opportunity to use all its functionality.

The following entities might be having access to the personal data you provide us with:

(1) Railway Corporation (USA), 548 Market St PMB 68956, San Francisco, California 94104 – to host our API, our PostgreSQL database and our search index, in the Europe West (Amsterdam) region;

(2) Vercel Inc. (USA) – to host our front end, with function compute in the Frankfurt (fra1) region and a global content delivery network;

(3) OpenAI Ireland Ltd. – to provide the language model and the embeddings used to generate the answers;

(4) Plus Five Five, Inc. (“Resend”) (USA) – to send the transactional email confirming your registration, from noreply@zusia.pl;

(5) Namecheap, Inc. (USA) – to operate the mailbox info@zusia.pl through which we receive your enquiries and requests.

(6) Google LLC (USA) – Google sign-in. We send you to Google’s consent screen and receive your email address, Google account identifier (sub), and whether Google has verified the email. Your Google password does not reach Zusia. We do not use Google Analytics.

Our infrastructure is located in the European Union at the hosting and database layer, but not at every layer: the content delivery network of Vercel is global, and Resend and Namecheap operate from the United States. We therefore do not claim that our servers are located solely in the European Union.

Where your personal data is transferred outside the European Economic Area, the transfer takes place on the basis of the Standard Contractual Clauses adopted by the European Commission, incorporated into the data processing agreements we have entered into with each of these providers:

• with OpenAI, under the OpenAI Data Processing Addendum executed on 22 September 2026. As we are established in the European Economic Area, our processor under that addendum is OpenAI Ireland Ltd.;
• with Railway Corporation, under the Railway Data Processing Addendum, which incorporates the Standard Contractual Clauses (Module Two) and takes effect together with the service agreement;
• with Vercel, Resend and Namecheap, under the data processing addenda published by those providers and incorporated into their terms of service.
• with Google, under the Google Cloud Data Processing Addendum incorporated into the Google Cloud terms, when Google sign-in is enabled.

To ensure the provision of our services, your personal data may also be transferred to a legal entity created after reorganisation of Zusia should it be necessary.

Please note that disclosure of your personal data may be required in accordance with the law and judicial procedures or at the request of public bodies of the country of your stay or other countries.

Your personal data will be disclosed if it is necessary for the purposes of national security, law enforcement, protection of the rights and legitimate interests of Zusia and third parties or for other substantial public interest purposes.

We do not sell personal data.

Children’s Personal Data

The Services are intended for adults. A user of the Services must be at least 18 years of age, as the Services concern the public-law obligations of persons who run, or plan to run, a sole proprietorship in Poland. We do not direct the Services to children and we do not collect or process their personal data (at least knowingly).

Special Provisions Applicable to the Residents of the European Economic Area

The following provisions apply specifically to individuals residing in the European Economic Area (EEA) and are intended to comply with the General Data Protection Regulation (GDPR) and other applicable data protection laws. These provisions describe your rights regarding the collection, processing, and use of your personal information, as well as the choices available to you for managing your privacy.

Depending on your place of residence, you may have the following rights:

• Right of Access: You may request confirmation as to whether we process your personal data and, if so, obtain a copy of that data along with information about how it is used.
• Right to Rectification: You may request that we correct inaccuracies or complete incomplete personal data concerning you.
• Right to Erasure (“Right to be Forgotten”): You may request that we delete your personal data, subject to certain legal exceptions.
• Right to Restrict Processing: You may request that we limit the processing of your personal data under certain circumstances.
• Right to Data Portability: You may request to receive your personal data in a structured, commonly used, and machine-readable format, and to have that data transmitted to another controller where technically feasible.
• Right to Object: You may object to the processing of your personal data carried out on the basis of our legitimate interest on grounds relating to your particular situation, including the right to object to processing for direct marketing purposes.
• Right to Withdraw Consent: Where we process your personal data on the basis of your consent, you may withdraw that consent at any time. The withdrawal does not affect the lawfulness of the processing carried out before it.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal data violates applicable data protection laws. In Poland, the supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

Providing your email address is necessary in order to create an account; without it an account cannot be created. The guest chat is available without an email address, subject to the message limit. Refusing the cookies that are strictly necessary for the Services makes logging in and the guest session impossible. Submitting a story through the “Share your case” form is entirely voluntary and has no effect on your access to the Services. Submitting feedback through the feedback form is entirely voluntary, is available only after you log in, and has no effect on your access to the Services.

Exercising User Rights

To exercise any of your rights under applicable laws or if you have any questions related to your personal information, please contact us at info@zusia.pl. You can also act directly in the Services: you may delete an individual conversation, or delete your whole account together with all the conversations and the feedback linked to it.

Please note that Zusia may need to verify your identity before fulfilling your request. If we are unable to fulfill your request, we will explain the reasons why. If we deny your request, you may appeal our decision by contacting us at the same email and stating “Privacy Request Appeal” in the subject line.

We will respond to your request within one month of receiving it. Where necessary, taking into account the complexity and the number of requests, that period may be extended by a further two months; we will inform you of any such extension, and of the reasons for it, within one month of receiving your request.

Final Provisions

This Policy may be amended and (or) modified at any time of the Services operation. In this case, a notice with information about the changes accompanied by the new version of the Policy and date of its adoption will be published in the Services and, where the changes concern account holders, sent by email where possible.

The rules on which the Services are provided, including the informational character of the answers, are set out in our Terms of Service. The use of cookies is described in our Cookie Policy.

If any provision hereof is invalid or unenforceable, other provisions shall remain valid and enforceable to the fullest extent permitted by applicable law.

Failure to enforce your strict compliance herewith cannot be construed as our waiver of any provision hereof or any right hereunder.