Privacy policy

Version 2026-10, in force from 30 October 2026.

This policy explains what personal data the jednoducho trackuj service processes, why, for how long, who we disclose it to and what rights you have. It follows Regulation (EU) 2016/679 (GDPR) and Act No. 18/2018 Coll. on the Protection of Personal Data.

1. Who is responsible for your data

1.1. Monadial s. r. o., with its registered office at Majerníkova 3043/54, 841 05 Bratislava – mestská časť Karlova Ves, company ID (IČO) 47 647 876, tax ID (DIČ) 2024008811, VAT ID (IČ DPH) SK2024008811, registered in the Commercial Register of the Municipal Court Bratislava III, Section Sro, Insert No. 144751/B, operates the service. It looks after the data, its security and support.

1.2. Jednoducho píš s. r. o., with its registered office at Majerníkova 3043/54, 841 05 Bratislava – mestská časť Karlova Ves, company ID (IČO) 57 785 635, tax ID (DIČ) 2123112354, VAT ID (IČ DPH) SK2123112354, registered in the Commercial Register of the Municipal Court Bratislava III, Section Sro, Insert No. 202212/B, sells the service and issues the invoices.

1.3. Who is responsible for which data:

Data	Who is responsible
Account, sign-in, security, support, the service’s emails and the website	Monadial and Jednoducho píš together, as joint controllers (Art. 26 GDPR)
Billing details, payments and invoices	Jednoducho píš
Records that an Organisation enters into the service, for example its clients and the work of its people	the Organisation; we process them on its behalf (section 5)

1.4. The essence of the arrangement between the joint controllers:

• Monadial decides the technical means and the security, keeps the records of processing, deals with your requests and is the contact point for them. It reports a personal data breach to the data protection office and to you.
• Jednoducho píš decides to whom and on what terms the service is sold, and concludes the contracts with customers. It passes the requests it receives on to Monadial.
• Both companies together provide the information under Art. 13 and 14 GDPR, that is, this policy.

You can exercise your rights against either of them.

1.5. Contact for personal data: privacy@jednoduchotrackuj.sk, or by post to the address of Monadial s. r. o. We have not appointed a data protection officer, because the GDPR does not require us to.

2. What data we process, why and for how long

2.1. Account

• Data: your name, email, language, your password stored only as a fingerprint (hash), the Organisations you belong to, and your settings in the service.
• Why: so that you have an account and can work in the service.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• How long: as long as the account exists. When you delete it, we delete your email, password, Passkeys, Sessions and Trusted devices. In the Organisations you have left, only your name stays with your work, so that their records are complete. The Organisation is responsible for these records (section 5).

2.2. Sign-in and security

• Data: the Two-factor code, which is valid for 10 minutes; the Trusted device, which is valid for 30 days from its last use; the Passkey, of which we hold only the public key and the name you give it (your fingerprint or face never leaves your device); the Session, which ends when you close the browser or after 24 minutes of inactivity; the password reset link, which is valid for one hour; your IP address, to limit the number of attempts.
• Leaked password check: when you enter a password, we send the Have I Been Pwned service only the first five characters of the password’s fingerprint (SHA-1). Neither your password nor any other data about you is sent.
• Why: secure sign-in and protecting accounts from misuse.
• Legal basis: performance of a contract and the legitimate interest in the security of the service (Art. 6(1)(b) and (f) GDPR).
• How long: as stated for each item. The IP address for limiting attempts only briefly, while the limit applies.

2.3. Invites

An Invite to an Organisation is sent by its Owner, and the Organisation is responsible for it (section 5). We process the Invite at sign-up, when you set up your own Organisation:

• Data: your name and email, the name of the Organisation you are setting up, and the Subscription, if you chose one on the website.
• Why: so that you can choose a password and set up the Organisation.
• Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
• How long: an Invite is valid for 48 hours and then stops working. Your data stays stored until you ask us to delete it at privacy@jednoduchotrackuj.sk.

2.4. The service’s emails

• Data: your email and the content of the message: Invites, codes, Summary emails and notices about the Trial, the Subscription and deletion.
• Why: running the service and informing you about the contract. We do not send advertising emails.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• How long: we do not keep emails longer than it takes to send them; they stay in your mailbox.

2.5. Subscription and invoices

Jednoducho píš is responsible for this data. Monadial stores it in the service for Jednoducho píš, as a processor.

• Data: billing details (name or business name, address, country, company ID (IČO), tax ID (DIČ), VAT ID (IČ DPH) and the email for invoices), the result of the VAT ID check in the VIES system with its consultation number, the period, the price, payments and invoices.
• Why: to conclude and perform the Subscription contract, issue the invoice and keep the accounts.
• Legal basis: performance of a contract and a legal obligation under Act No. 431/2002 Coll. on Accounting and Act No. 222/2004 Coll. on Value Added Tax (Art. 6(1)(b) and (c) GDPR).
• How long: billing details as long as the Organisation exists. Invoices for ten years following the year they relate to, as the Accounting Act requires, even after the Organisation ceases to exist.

2.6. Card payments

You enter your card number directly into the form of the Stripe payment gateway. We do not see or store it. Stripe tells us only the result of the payment and the identifiers of the customer and the Subscription. Stripe Payments Europe, Limited (Dublin, Ireland) processes payment data as an independent controller, under its own policy at https://stripe.com/privacy.

2.7. Support, warranty claims and complaints

• Data: what you write to us at support@jednoduchotrackuj.sk or privacy@jednoduchotrackuj.sk, and our replies.
• Why: to deal with a question, a warranty claim, a complaint or a request about personal data.
• Legal basis: performance of a contract, a legal obligation for warranty claims and for requests under the GDPR, and legitimate interest (Art. 6(1)(b), (c) and (f) GDPR).
• How long: three years from when it was dealt with, or four years if you are a business, during the limitation period.

2.8. Technical logs

• Data: IP address, time, the address of the request and browser details, in the server logs and in the Cloudflare network.
• Why: security and fixing errors.
• Legal basis: legitimate interest in a secure and working service (Art. 6(1)(f) GDPR).
• How long: one month. Deleted data disappears from the backups within three months.

2.9. The jednoduchotrackuj.sk website

The website uses no cookies or analytics and tracks nothing. It remembers the theme you chose in your browser’s storage; it does not leave the browser. It reads the prices from the service; while it does, the service sees your IP address, to limit the number of requests. Cloudflare delivers the website, and it also sees your IP address (2.8).

3. Cookies and browser storage

3.1. The app uses only three cookies, which are strictly necessary for it to work:

Cookie	What it is for	How long
Session	keeps you signed in	until you close the browser or after 24 minutes of inactivity
Trusted device	on this device you do not need a Two-factor code	30 days from its last use
Live updates	delivers changes to Timers as soon as they happen	1 hour

3.2. Strictly necessary cookies need no consent (§ 109(8) of Act No. 452/2021 Coll. on Electronic Communications). Both the app and the website remember the language and the theme in the browser’s storage. We do not use advertising or analytics cookies.

4. Who we disclose data to

4.1. These processors help us run the service:

Supplier	What it does	Where the data is
Scaleway SAS, Paris, France	servers, database, backups, sending emails, invoice storage	EU, Amsterdam (the Netherlands)
Cloudflare, Inc., San Francisco, USA	domains, protecting and delivering the connection to the app, hosting the website	worldwide network (section 6)

Jednoducho píš gives the invoices to its external accountant, who keeps its accounts for it as a processor.

4.2. Independent controllers also receive data:

• Stripe Payments Europe, Limited: card payments (2.6),
• the European Commission (the VIES system) and the Ministry of Finance of the Slovak Republic (the Register of Financial Statements): checking the VAT ID and company ID (IČO) of the business that buys the Subscription,
• public authorities, where the law requires it.

4.3. The members of your Organisation see your name and, depending on their role, your work too. The Owner sees the work of the whole team, an Assistant only their own.

4.4. We do not sell data and do not use it for advertising.

5. Data that the Organisation enters

5.1. The Organisation is responsible, as the controller, for the records it enters into the service, for example about its clients and the work of its people. Jednoducho píš and Monadial process them on its behalf as processors, under Annex 2 to the terms and conditions.

5.2. If you want to exercise your rights over this data, contact the Organisation. If you send the request to us, we will pass it on to the Organisation and help it deal with it.

6. Transfers outside the European Union

Cloudflare and Stripe may also process data in the USA. The transfer relies on the European Commission’s adequacy decision for the EU-US Data Privacy Framework and on standard contractual clauses. We will send you a copy of these safeguards on request; write to privacy@jednoduchotrackuj.sk. All other data stays in the European Union.

7. Automated decision-making

We do not make decisions with legal effects solely by automated means, and we do not do profiling. The automatic VAT ID check in the VIES system only verifies the number.

8. How we protect data

• The app, the API and the website work only over an encrypted HTTPS connection.
• We store passwords only as a fingerprint (hash), and we reject a leaked password.
• Sign-in is protected by a Two-factor code or a Passkey.
• The Organisations’ data is kept separate, and everyone sees only what their role allows.
• The number of attempts to sign in, sign up and reset a password is limited.
• Only persons authorised by Monadial have access to the production systems.
• We back up data regularly, and every change to the service passes automated tests.

9. Your rights

9.1. You have the right to:

• know what data we process about you, and get a copy of it (Art. 15 GDPR),
• have it corrected (Art. 16),
• have it erased (Art. 17),
• restrict its processing (Art. 18),
• receive it in a machine-readable form and transfer it (Art. 20).

Right to object. You can object at any time to processing based on legitimate interest (2.2, 2.7, 2.8), on grounds relating to your situation (Art. 21 GDPR). We will then stop processing the data, unless we show compelling legitimate grounds that override your interests, or we need the data for legal claims.

9.2. You can do a lot yourself in the app: change your name, download your records as CSV and delete your account.

9.3. Send other requests to privacy@jednoduchotrackuj.sk. We will deal with them free of charge within one month. For a complex request we may extend this period by two more months; we will tell you if we do. If we are not sure the request comes from you, we will verify your identity.

9.4. If you think we handle data in breach of the law, you can submit a motion to start proceedings to the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Galvaniho 7/B, 821 04 Bratislava, https://dataprotection.gov.sk.

10. Do you have to give us data?

We need your name and email for the account. We need the billing details for the Subscription, because without them we cannot issue the invoice the law requires. Without this data we cannot provide you with an account or a Subscription.

11. Changes to this policy

We may change this policy when the service or the law changes. We will announce a significant change by email before it takes effect. The version in force is always on this page, with its version number and the date it takes effect.