What personal data we process, why, and for how long.

1Controller

The controller of the personal data is ARLing s. r. o., Company ID 56583486, VAT ID SK2122352100, registered office at Ivanská cesta 19112/32E, 821 04 Bratislava, Slovak Republic. Contact for data protection matters: support@arling.sk. We have not appointed a data protection officer (DPO); for the scope of our processing the law does not require one.

2What we process and what we do not

We process only the data described in this document: your e-mail address when you sign up for news, technical data when a licence key is issued, the data from an order for the paid SEPA file check and the content of the file you send us for it (section 5), and ordinary e-mail correspondence. We do not sell data, we do no profiling and no automated decision-making, we use no advertising networks and we set no cookies.

3News e-mail list

If you sign up for news, we store your e-mail address, the page you signed up from, the language and the time of sign-up. The data is on our own server in Slovakia. We use it only to send news about the tools. Legal basis: your consent (GDPR art. 6(1)(a)). You can withdraw consent at any time by replying to any of our e-mails or by writing to support@arling.sk, and we then delete the address within 30 days.

4Issuing licence keys

When you buy a Pro licence we store the Stripe Checkout payment session identifier, the plan type, the expiry date and the time the key was issued. We do not store your e-mail address; the licence key contains only a shortened hash of the e-mail. Legal basis: performance of a contract (GDPR art. 6(1)(b)). We keep the data for the term of the licence and for a further 3 years in case of a complaint.

5SEPA file check

For the paid SEPA file check you first send us an order with the form on the service page; you pay nothing in advance and upload nothing on the page. From the order we store on our own server the e-mail address and the text you write into the form, a label of the page and language the order came from, and the time it was sent. We store no IP address, no browser data and no cookies. A notification about a new order is sent by our own server through ntfy and contains the page label, the e-mail address with the part before the @ hidden, and the beginning of your text. We also record the e-mail address, page label, language and date in our CRM (Twenty, running on our own server). Legal basis: steps taken at your request before entering into a contract and performance of the contract (GDPR art. 6(1)(b)). We have not yet set an automatic deletion period for the order data; we delete it on request. We keep the invoice data as described in section 7.

You send us the pain.001 file, a bulk payment order, only after ordering, following the instructions we send you by e-mail. It contains the names of the payer and the payees, their IBANs and the amounts, so as a rule also personal data of third parties (for example your suppliers) who are not a party to the contract and with whom we do not communicate directly. You, the customer, are the controller of that data; ARLing s. r. o. processes it solely to perform the check you ordered and for nothing else. We do not use the file to train any model. We delete it at the latest 30 days after delivering the result, earlier on request. Legal basis: performance of the contract with you (GDPR art. 6(1)(b)).

Where the file will be stored, with which tools it will be checked and which processors will have access to it, we tell you in the e-mail with the instructions before you send the file, and we will add it to this document as well. We handle the correspondence about the order through Zoho Mail (section 7). Stripe is not used for this service: ARLing s. r. o. issues the invoice only after delivering the result and it is paid by bank transfer. Send deletion requests to support@arling.sk.

6Payments and invoicing

The seller (merchant of record) is Link (Sold through Link, LLC) through the Stripe Managed Payments service; ARLing s. r. o. supplies the product. Link sends you the proof of purchase and Stripe calculates and pays the VAT; Stripe and Link are separate controllers for the payment data, and card details are seen only by Stripe. The order data needed to deliver the service and for our accounting we process on the basis of performance of a contract and a legal obligation (GDPR art. 6(1)(b) and (c)). Stripe's privacy policy: stripe.com/privacy.

7E-mail correspondence

If you send us an e-mail, we handle the correspondence through Zoho Mail (Zoho Corporation B.V., the Netherlands), in data centres in the EU. We keep it for as long as it is needed to deal with your question; we keep accounting records for 10 years under Slovak law.

8Website hosting

The arling.sk website is hosted on GitHub Pages (GitHub, Inc., USA). GitHub keeps server logs with IP addresses according to its own privacy statement. The transfer to the USA takes place under the EU-US Data Privacy Framework and standard contractual clauses.

9Visit analytics

We measure visits with our own Umami tool on our server. It uses no cookies and no fingerprinting. The IP address is hashed with a salt that changes daily and is not stored; only aggregate counts of page views and events (for example "generate", "buy_click") are stored. Legal basis: our legitimate interest (GDPR art. 6(1)(f)). Because we store no cookies and no identifiers on your device, a cookie banner is not needed.

10Connecting to hosted tools

News sign-ups, form submissions (for example an order for the SEPA file check) and licence checks go through an encrypted TLS connection (Tailscale Funnel, Tailscale Inc.), which sees only the metadata of the encrypted traffic, not its content.

11Data in your browser

Tool settings and the licence key are stored only in your browser (localStorage), on your device. This storage is necessary for the tools to work and is not tracking.

12Your rights

You have the right to access your data, to have it corrected or erased, to restriction of processing, to data portability, to object and to withdraw consent. Send your request to support@arling.sk, we reply within one month.

13Complaint

If you believe we process your data contrary to the GDPR, you can lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk.

14Changes to this document

We may amend this document. A change that extends the processing of your data is announced on this page in advance, at least 30 days before it takes effect. A change that only describes the actual process more precisely or narrows the processing (like version 1.2) applies from the day it is published.

15Contact and related pages

Send questions to support@arling.sk. Related pages: Privacy and Terms of use.