Privacy policy

This policy covers Pompi accounts, organization workspaces, public Pompi pages, digital business cards, QR and NFC redirects, analytics, contact forms, and support communication.

We process account and profile data, organization settings, billing records, resources you publish, security logs, and product usage events.

When a visitor submits a form, the organization that owns the page receives the submitted contact data and the consent snapshot shown with that form.

We use data to provide and secure the service, publish requested content, measure customer-owned experiences, deliver transactional email, process payments, prevent abuse, and meet legal obligations.

Pompi uses service providers for infrastructure, email delivery, error monitoring, and payments. Access is limited to the purpose of providing the service.

Retention depends on the record type. Account exports are retention-bound, analytics for customer-owned resources uses bounded identifiers without fingerprinting, and deleted resources are removed according to the product workflow and backup lifecycle.

With your consent, we use Umami on our own server to count visits to Pompi’s public marketing pages and clicks on contact links. This does not cover the account panel, sign-in, customer pages, business cards, QR redirects or surveys.

We collect the visited page path, event time, referring domain, browser language, screen size, device type, browser, operating system and approximate location derived from the IP address. We exclude URL parameters, form contents, account identifiers, session recordings and advertising profiles. The IP address is processed to handle the request but is not stored in the Umami database. A pseudonymous identifier derived from IP and browser information changes daily. Analytics data is not sent to the Umami provider’s cloud service.

The basis is consent under Article 6(1)(a) GDPR and, for access to information on your device, Article 399 of the Polish Electronic Communications Law. Refusal does not limit website access. Use “Privacy settings” in the footer of a public marketing page, then “Withdraw consent”, to stop further collection in that browser. Withdrawal does not affect the lawfulness of earlier processing.

Umami does not set analytics cookies. The local-storage key “pompi-analytics-consent-v1” remembers your consent or refusal and its expiry date for 180 days. After expiry or removal of that entry, we ask again.

We keep statistics history for as long as we use it to assess the website and compare results across months and years. There is no automatic deletion after a fixed number of days. Data that is no longer needed will be deleted or irreversibly anonymised. Each daily backup contains the full history; individual backups are kept for 7 days. Access is restricted to authorised personnel maintaining the website and infrastructure.

Account owners can update profile data, control email preferences, export account data, and request deletion from the profile area.

For access, correction, deletion, restriction, objection, or privacy questions, contact support@pompi.app.