KIS List Privacy Policy

1. Summary

We collect the data you give us (e.g. your e-mail address, company details and messages) and technical data about how you use the platform. We use it to run your account and payments, reply to messages, keep the platform secure and, with your consent, analyse how the platform is used. We switch on analytics and advertising based on cookies and similar technologies only after you consent. The data is passed to providers, e.g. the payment operator, analytics tools and e-mail delivery services. You can withdraw your consent at any time, and you can also opt out of e-mails with tips or exercise your rights by writing to info@kislist.com.

2. Who the controller is

The controller of your data is KIS List sp. z o.o., with its registered office in Warsaw (ul. Zielone Zacisze 1/254, 03-294 Warszawa), KRS 0001208890, NIP 5243057557, REGON 543410134.

For all matters concerning personal data, write to info@kislist.com.

3. Whose data we process and in what role

As the controller, we process the data of website visitors, users of the KIS List application (designers and design studios), people who write to us, job applicants and team members.

Team members. If the plan owner adds you to a team in KIS List, we receive from them the data needed to create your access, e.g. your first name, surname and e-mail address. The source of this data is therefore the plan owner, and we use it only to manage access to the team.

Job applicants. By sending an application to rekrutacja@kislist.com, you provide us with the data in your CV and message. We use it to carry out the recruitment process. Consent is not required for the recruitment itself.

Data of studios' clients. You enter the data of your studio's clients (their questionnaire answers, files, photos and comments) into KIS List. For this data, the studio is the controller and KIS List acts as a processor, on the studio's instructions. The rules are set out in § 9 of the Terms. If you are a studio's client and wish to exercise your rights, write to the studio first; we will help it deal with your request.

4. Why, what data, on what basis and for how long

Account and service. We use your first name, surname, e-mail address, company details, password (encrypted) and the content of your account. This lets us run your account, the trial period, plans and AI features. We also send messages about the service. Legal basis: the agreement. We keep the data for the term of the agreement and then in the blocked account until it is deleted (rules in the Terms, § 10). We keep data that we are required to retain by law for longer.

Payments and invoices. We use invoicing details and payment history. Legal basis: the agreement and a legal obligation. We keep the data for as long as tax and accounting laws require.

Revenue analysis (ChartMogul). We use the customer number, plan and payments. This is how we plan and control the company's finances. Legal basis: our legitimate interest. We keep the data for as long as we maintain the account and billing.

Contact. We use the data from your message (e-mail, form, website chat), e.g. your e-mail address and first name. This lets us answer your questions. Legal basis: our legitimate interest. We keep the data until the matter is closed. We keep correspondence about the agreement for as long as the agreement data.

Security (logs). We record the IP address, date and time, browser and device type, and errors. Errors on the website are reported to us by the Sentry tool, and Google reCAPTCHA protects forms against bots. This is how we protect the platform against abuse and keep it working. Legal basis: our legitimate interest. We delete logs and backups in line with their cycle.

Claims. We may use data from the agreement, payments and correspondence to pursue or defend against claims. Legal basis: our legitimate interest. We keep the data until the claims become time-barred.

Team members. We use your first name, surname and e-mail address. This lets us give you access to the team. Legal basis: our legitimate interest. We keep the data for as long as you have access.

Analytics (GA4, Amplitude, Clarity). We collect data about how you use the platform: pages visited, clicks, approximate location, device and identifiers from cookies. Legal basis: your consent. We keep the data until you withdraw your consent or the identifiers expire (section 8).

Advertising (Meta). We use identifiers from cookies, data about actions on the website and your e-mail address (one-way encrypted). Legal basis: your consent (cookies) and our legitimate interest (e-mail). We keep the data until you withdraw your consent or object.

Advertising (Google Ads). We use identifiers from cookies and data about actions on the website to measure how effective our ads are, for example whether someone created an account after clicking an ad. Legal basis: your consent. We keep the data until you withdraw your consent or the identifiers expire.

Tips and training (MailerLite). We use your e-mail address, first name and data about opens and clicks. Legal basis: our legitimate interest. We keep the data until you opt out of the e-mails or until the end of the agreement.

Recruitment. We use data from your CV and message. Legal basis: steps taken before entering into an agreement. We keep the data until the end of the recruitment process. We keep it longer only with your consent.

Do you have to provide data? Providing data is voluntary, but some of it is necessary to conclude and perform the agreement (e.g. your e-mail address and invoicing details). Without it, we cannot create an account or issue an invoice. Consents (analytics and marketing cookies) are entirely voluntary, and not giving them does not limit your use of the service.

5. Who we share data with

Depending on the purpose, data may be passed to the following categories of recipients:

• hosting and cloud providers,
• payment operators (Stripe and Przelewy24),
• MailerLite, which sends e-mails with tips,
• providers of analytics and advertising tools (Google, Meta, Microsoft, Amplitude),
• ChartMogul, a tool for analysing revenue and subscriptions,
• external AI service providers (section 7),
• an accounting firm and the provider of the invoicing system,
• Smartsupp, the provider of the website chat through which we answer questions,
• Sentry, a tool for detecting errors on the platform,
• legal advisers and public authorities, where required by law.

Depending on the tool, providers act on our instructions or as separate controllers, that is, deciding on the purposes of processing themselves (e.g. Google and Meta for their own purposes). We make the list of providers processing studios' clients' data available to the studio on request.

If you connect your Google account to the schedule in the application, we use data received from Google APIs in accordance with the Google API Services User Data Policy, including the Limited Use requirements.

6. Transfers of data outside the EEA

Some of the providers listed in section 5 may process data outside the European Economic Area. In that case, the data is protected by the Data Privacy Framework (a European Commission decision) or by standard contractual clauses approved by the Commission. The clauses form part of the agreements that providers publish on their websites.

7. Artificial intelligence (KISjusz and KISaya)

Two AI assistants operate within KISjum. KISjusz conducts a conversation with a studio's client on the studio's behalf, in the form of a questionnaire. KISaya, on the designer's instructions, turns uploaded visualisations into more realistic images.

To operate these features, we pass the following to external AI service providers (language and image models): questionnaire answers and questions, the content of the conversation, uploaded images and text prompts. The images may show private interiors and sometimes also people. We do not use data entered into KISjusz and KISaya to train AI models. The AI providers do not use it for this purpose either.

We process studios' clients' data on the studio's instructions (section 3). A studio's client sees information in the questionnaire that they are talking to an AI assistant.

8. Cookies and tools

Without your consent, we store on your device only the cookies necessary for the platform to work. We switch on analytics and marketing cookies (e.g. Google Analytics, Meta Pixel) only after you consent in the banner. Refusing does not limit your use of the platform. For Meta Pixel, we are jointly responsible for the data with Meta. You can change or withdraw your consent using the “Cookie settings” link in the footer.

The tools we use:

• Necessary (without consent): saving your choice in the banner and KIS List technical cookies, needed for the website to work and to protect it against abuse.
• Analytics (with consent): Google Analytics 4 (Google), Amplitude and Microsoft Clarity (Microsoft) - traffic statistics and analysis of how the website is used.
• Marketing (with consent): Meta Pixel (Meta) - measuring the effectiveness of ads and building audiences; Google Ads (Google) - measuring the effectiveness of ads.
• Chat: Smartsupp - talking to us on the website.
• Form protection (without consent): Google reCAPTCHA - on pages with a form, it checks whether the form is being filled in by a human and not a bot. In doing so, Google receives technical data (e.g. IP address, browser, mouse movements). Legal basis: our legitimate interest, that is, protection against spam and abuse.
• Error detection (without consent): Sentry - when an error occurs on the website, we record technical data (e.g. IP address, browser, device and page) in order to fix it. Legal basis: our legitimate interest.

You can also delete cookies in your browser settings; we will then ask for your consent again.

9. E-mails, advertising and objection

Tips and training. After registration, we send e-mails on how to use KIS List and invitations to free training sessions and webinars on using the application. We do this on the basis of our legitimate interest. You can opt out of them in any e-mail. We always send messages about the service (invoices, outages, changes to the Terms).

Advertising. If you consent to marketing cookies, we may show you our ads on Facebook and Instagram. We may also use your e-mail address to match ads on Meta's services. Before it is passed on, the address is one-way encrypted. If you do not want this, write to us. We also show ads in Google Search, and we measure their effectiveness only if you consent to marketing cookies.

Objection. You can object at any time to the use of your data for marketing or on the basis of our legitimate interest. Write to info@kislist.com.

10. Your rights and complaints

You have the right to access your data and receive a copy of it, and the rights to rectification, erasure, restriction of processing, data portability and objection. If we process data on the basis of consent, you can withdraw it at any time; this does not affect the lawfulness of processing before the withdrawal.

To exercise your rights, write to info@kislist.com. We will respond without undue delay and within one month at the latest. If you believe that we are processing data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

11. Security

The connection to the platform is secured with the HTTPS protocol. We store passwords in one-way encrypted form, so we do not know your password. Please also remember that links shared without logging in (e.g. to the client panel) are accessible to anyone who knows them; details are set out in the Terms.

12. Changes to the policy

We publish the current version on this page together with the date from which it applies. We will notify registered users of material changes by e-mail.