Privacy Policy

The data controller is SIMPLY EXPLAINED LTD (company number 17428320, 167-169 Great Portland Street, London, W1W 5PF), trading as Hello Polska. For data protection questions, contact us at contact@hellopolska.pl.

We are registered on the ICO register (Information Commissioner's Office, the UK's data protection authority) as a data controller, registration number ZC234966.

Because Hello Polska is addressed to people living in Poland and across the EU, we apply not only UK law but also RODO (the EU-wide GDPR) to the relevant part of our data processing.

In accordance with Article 27 GDPR, SIMPLY EXPLAINED LTD has appointed a representative in the European Union:

Maria Noga
Representative of SIMPLY EXPLAINED LTD in the EU under Article 27 GDPR
Email: simplyexplain@gmail.com

The representative can be contacted regarding matters related to SIMPLY EXPLAINED LTD's processing of personal data and the exercise of rights under the GDPR.

Hello Polska is not a document archive. We collect and keep only the data needed to run a specific feature — and only for as long as that requires.

Reading articles and using search require no personal data at all. At this stage we do not maintain user accounts.

When you use this feature, we process:

• The photo or PDF of the document you upload — it goes into a secure, temporary, access-restricted file store (not reachable via any public web address).
• The content of the document is sent to Anthropic (the AI provider we use for the analysis). Under Anthropic's standard commercial terms, your data is not used to train their AI models and is not added to any shared knowledge base; on their side, Anthropic automatically deletes it within 30 days.
• The original photo or PDF is automatically deleted from our servers immediately after the analysis finishes (typically within minutes). As a backstop, an automatic cleanup also runs: if deletion doesn't happen right away for any reason (e.g. a technical fault), the file is still deleted within 1 hour at the latest. We never keep copies of your documents.
• We do keep the result of the analysis (the information extracted from the document — e.g. document type, required actions) — this lets you come back to your result and ask one follow-up question. This record contains no original photo/PDF and is automatically deleted 30 days after it's created.
• Payment details (card number etc.) never reach our servers — they are handled directly by Stripe, under the international payment security standard (PCI DSS).
• If you choose to email yourself a copy of your analysis result, you optionally provide an email address for that purpose. That address is stored alongside the analysis result and is subject to the same 30-day automatic deletion described above for that record.

We use vetted providers who process data on our behalf, only to the extent the service actually requires:

• Stripe — payment processing,
• Anthropic — document content analysis (our AI technology provider),
• Vercel — site hosting and temporary file storage,
• Sanity — storage of the portal's articles (unrelated to your documents).
• Resend — to send emails (e.g. your document analysis result on request, article update notifications).

We do not sell or share your data with third parties for marketing purposes.

With your consent (the banner at the bottom of the page) we use Google Analytics to anonymously measure site traffic — e.g. how many people read articles, from which devices and regions, and whether the "Understand a Letter" feature is useful. IP addresses are anonymised and the data is not used to identify specific individuals. You can decline analytics in the cookie banner — the site will work normally, we simply won't collect any statistics about your visit.

All communication with the site is encrypted (HTTPS). Documents are stored in access-restricted, non-public storage. Access keys to our systems are kept securely and never published in the site's code.

Because we process data belonging to residents of Poland/the EU, RODO (the EU-wide GDPR) applies, alongside UK GDPR (since the controller is a UK-registered company). You have the right to: access your data, correct it, have it deleted, restrict its processing, port it, and object to its processing. You can also lodge a complaint with the data protection authority where you live — UODO (Urząd Ochrony Danych Osobowych, Poland's data protection authority) — or the Information Commissioner's Office (ICO) in the UK, where the data controller is registered.

We may update this policy from time to time, e.g. when we add new features. The date at the top of this page always shows the last update.