Privacy policy
CzynszOK reads your bank data once, computes three checks and deletes the raw data. What remains, we describe here in full.
Who is responsible for your data
The data controller is Tomasz Żyłka, sole proprietor trading as Tomasz Żyłka Veinito.com, Bierzycka 8, 51-179 Wrocław, Poland. NIP: PL6452337008, REGON: 521704806. Contact for data matters: pomoc@czynszok.pl.
Legal bases
The bank read: your consent (Art. 6(1)(a) GDPR), which you can withdraw. The account, the check, the certificate and the payment: the contract you ask for (Art. 6(1)(b)). Accounting and invoices: a legal obligation (Art. 6(1)(c)). Account security, the event log and the defence of claims: our legitimate interest (Art. 6(1)(f)). Giving data is voluntary, but without an email address and a bank read we cannot issue a certificate.
What we read from your bank
With your consent, once and read-only (PSD2 AIS), from at most 2 banks with 2 accounts each: the account holder, inflows and transfers from the last 12 months and, if you enable the deposit check, booked balances from the last 90 days. Accounts in another currency are converted at the NBP mid rate of the read date. The read is performed by Enable Banking Oy, a licensed account information service provider acting as our processor. On a joint certificate we read the other person’s data separately, with their own consent, and never show it to you. When the bank lists several holders on an account (a shared account), we store their names, encrypted, only so that you can mark which one is yours; once you pick, only yours is kept, and the rest is deleted together with the bank access, at the latest after 48 hours. A co-holder’s name never goes on a certificate without their own consent. We never see your bank login or password and cannot order any operation.
What we compute from it
Three checks: whether the accounts are yours, whether the inflows across all connected accounts are regular, and whether the rent from the listing fits the CzynszOK safe-rent rule. Optionally, if you enable them: whether the 12 months hold no enforcement or debt-collection transfers, and whether on most of the last 90 days the combined balance covered the deposit you typed. The result is yes or no. No amount from the bank reaches the landlord: they see only the rent and, if chosen, the deposit you typed yourself, and the answer yes.
Automated check
The checks are computed by an algorithm with published parameters (their identifier and hash are stored with every certificate). The result only decides whether we can issue a certificate for the rent you typed; we do not assess creditworthiness and nobody but you sees the reasons for a refusal. If you disagree with the result, write to pomoc@czynszok.pl and we will explain what the algorithm computed.
What we delete and when
We delete the raw bank data (transactions, balances, amounts, account numbers) in the same operation that writes the result, before you see the result screen. For a joint certificate, each person's bank is read when that person taps "Done", and until the joint result is computed we keep, encrypted, only the data needed for the calculation (dates, amounts and titles of transfers, names of payers and payees, balances when the deposit is checked, account numbers only as irreversible hashes), until the end of the question's 72 hours at the latest; it is deleted the moment the result is computed, or earlier when the question expires, is cancelled or that person deletes their account. We close the access to every bank at the provider right after the read, at the latest within 48 hours; after that the bank consent expires anyway. For at most 24 hours we keep, encrypted and for you only: your name as the bank has it and the maximum rent and maximum deposit we can certify. After 24 hours they are gone. If you issue the certificate, the name from the bank stays on it and the maximum amounts are gone. Database backups keep deleted rows (the result, the name, the encrypted amounts) for up to 48 hours after deletion; for a joint certificate also the encrypted data needed for the calculation. They never contain the bank's response in raw form or full account numbers.
What remains
Your email address, the result of the checks (yes or no), dates, the bank's name, the certificate code and its status, and a technical event log with no bank data. If you issue a certificate: the name from your bank and the rent from the listing (on the certificate), for as long as it is valid and for 6 months after; a revoked certificate is deleted 30 days after revocation. When connecting to your bank we pass your IP address and a browser identifier to the provider, because the bank requires it.
Where the data is
We store and process bank data and the check results in the European Union (Frankfurt); the edge CDN network does not store data. We do not query BIK, KRD, BIG or any other register, so no query trace is left behind you. Payments are handled by Stripe: card details or the BLIK code go only to Stripe, and we do not see them. Emails are sent by Resend, a US company: it receives your email address and the message (the sign-in code, a link to the certificate or the purchase confirmation with the Terms, no bank data) and keeps them for up to 30 days. Stripe and Resend may transfer data to the US under the European Commission's standard contractual clauses and the EU-US Data Privacy Framework. On a joint certificate the other person sees your e-mail address (and you see theirs), the joint result and the joint maximum amount, never your income or balances. Anyone holding a live invitation link sees your e-mail address and the rent and deposit of the question before joining; the link works once and you can cancel it at any time.
Payment and proof of purchase
The 49 zł payment is handled by Stripe Payments Europe (Ireland) as a separate controller of payment data: card details and the BLIK code go only to Stripe. Stripe receives your email address from us (for the payment receipt), and if you tick that you are buying for a business, you also give it the company name, address and NIP for the invoice. We keep for 6 years (accounting law and the defence of claims): the amount, the payment date, the version of the Terms, the version and time of your consent to issuing the certificate before the withdrawal period ends, whether an invoice was requested and whether the payment was used for a certificate. After you delete your account these records are no longer linked to you. After the purchase we send a confirmation email with the Terms as a PDF.
Your rights
You have the right to access your data, to have it rectified, ported and erased, and to lodge a complaint with the President of the Personal Data Protection Office (UODO). You also have the right to restrict processing and to object to processing based on our legitimate interest. You can withdraw your consent to the read at any time. Revoking a certificate: in the app, on the certificate screen. Deleting your account and all data: the button in Account (/app/account) deletes them at once; if you cannot sign in, write to pomoc@czynszok.pl and, once you confirm with a code from your email, we do the same within 72 hours. Database backups are gone within 48 hours. If you joined a joint certificate, you withdraw your consent before it is issued by deleting your account; after it is issued also by revoking the certificate or by writing to pomoc@czynszok.pl.