PMFstackLegal
Privacy Policy
Last updated: 12 November 2026 · Wersja polska
This policy explains how personal data is handled on PMFstack (pmfstack.com): what we collect, why, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR).
1. Who we are
The data controller is:
ProductTrio
Paczkowska 50/8, 50-503 Wroclaw, Poland
VAT EU: PL6423191743
Data protection contact: contact@pmfstack.com. Use this address for any question or request about your personal data.
We have not appointed a statutory Data Protection Officer (inspektor ochrony danych). The contact above handles all data protection matters.
2. What we collect and why
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Account data: your email address, your company name, your role (owner or teammate) and the programme or cohort you joined through, if any | Creating and running your account, signing you in | Contract performance (1(b)) |
| Teammates' emails: addresses the account owner adds so colleagues can sign in | Giving the named people at your company access | Legitimate interest (1(f)) in providing the service your company bought |
| Purchase and billing data: amount, currency, payment reference, payment status and invoicing details. Our payment provider handles card details; we never see or store your card number | Taking payment, issuing invoices, handling refunds, accounting | Contract performance (1(b)); legal obligation (1(c)) for invoices |
| Deal activity: which deals you opened and when, and the reports you send on whether a deal worked | Keeping the deal list accurate, fixing broken deals, applying the refund rules, and giving vendors monthly totals. Vendors see counts, not names | Contract performance (1(b)); legitimate interest (1(f)) |
| Technical data: IP address, device and browser type, pages requested | Security and error diagnosis and, only with your consent, analytics | Legitimate interest (1(f)) for security; consent (1(a)) for analytics |
| Correspondence: emails you send us | Support and answering enquiries | Legitimate interest (1(f)) |
When a deal asks whether your company qualifies, we check your answers at that moment and do not store them.
If you add a teammate, please make sure they know you have shared their work email with us.
3. Cookies and analytics
Essential cookies keep the site working, for example by keeping you signed in. They don't require consent.
Analytics (Google Analytics) runs only if you click "Accept analytics" in the cookie banner. Until then, and if you choose "Essential only", the analytics scripts are not loaded and they store nothing on your device. Analytics helps us understand which pages are useful and where people get stuck.
Google Analytics 4, loaded through Google Tag Manager, records page views with cookies such as _ga. We keep its data for 14 months.
We remember your choice in your browser's local storage for 12 months. You can change it at any time through the link in the footer, or by clearing your browser storage for this site.
When you pay, you leave our site for a checkout page run by our payment provider, which sets its own cookies under its own policy.
4. Who we share data with
We use a small number of service providers (processors) to run PMFstack:
- Vercel: website hosting
- Supabase: database, sign-in and sign-in emails
- Stripe: payments, invoices and refunds
- Google: analytics and tag management, only with your consent
Vendors whose deals we list receive monthly totals of how many companies opened their deal. They do not receive your name, email or company name from us. If you redeem a deal, you give your details to that vendor directly, under the vendor's own privacy policy.
We do not sell personal data, and we do not share it with advertisers.
5. International transfers
We keep data in the European Economic Area where possible. Some of the providers above are US companies. Where data is transferred outside the EEA, it is protected by the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
6. How long we keep data
- Account data and deal activity: for as long as your company has an account, then deleted or anonymised within 12 months of the account closing.
- Invoices and billing records: 5 years from the end of the tax year, as Polish tax and accounting law requires.
- Support correspondence: up to 24 months after the case is closed.
- Analytics: 14 months for Google Analytics.
7. Your rights
Under the GDPR you can ask us at any time for:
- Access: a copy of the personal data we hold about you
- Rectification: correction of inaccurate data
- Erasure: deletion of your data
- Restriction: limiting how we process your data
- Portability: your data in a machine-readable format
- Objection: to processing based on legitimate interest
- Withdrawal of consent: at any time, without affecting past processing
To use any of these rights, email contact@pmfstack.com. We respond within one month. You can also complain to a supervisory authority. In Poland this is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl. You can also go to the authority in your own EU country.
You don't have to give us any data, but we can't run an account or take a payment without the account and billing data above. We make no decisions about you by automated means alone.
8. Children
PMFstack is meant for adults. It is not meant for anyone under 18, and we do not knowingly collect their data.
9. Security
All traffic is encrypted in transit (TLS). The database is reachable only from our server, and members see only their own company's account. Access to production systems is limited to authorised people.
10. Changes to this policy
If we make material changes, we will update the date at the top of this page and tell account holders by email.
11. Contact
ProductTrio · Paczkowska 50/8, 50-503 Wroclaw, Poland · contact@pmfstack.com