Privacy
Policy.

1. Data controller

• The controller of your personal data is the Operator of the use2sh.com service.
• Contact the controller: kontakt@2sh.pl
• Data is processed in accordance with the GDPR and applicable law.

2. What data we collect

• Registration data: email address, password (stored in hashed form).
• Optional data: name, username, custom domain URL.
• Technical data: IP address, browser type, operating system - for security purposes.
• Analytics data: click counts, country, device type, referrer - collected anonymously.

3. Purposes of processing

• Service provision - performance of a contract (Art. 6(1)(b) GDPR).
• Payment processing and invoicing - legal obligation (Art. 6(1)(c) GDPR).
• Service security - legitimate interests of the controller (Art. 6(1)(f) GDPR).
• Own marketing - with user consent (Art. 6(1)(a) GDPR).

4. How long we retain data

• Account data: for the duration of the agreement and 3 years after termination (limitation period).
• Invoice data: 5 years from the end of the tax year (accounting obligation).
• Analytics data (clicks): 13 months from collection.
• You may request deletion of your data by writing to kontakt@2sh.pl.

5. Your rights

• Right of access - you may request a copy of your data.
• Right to rectification - you may correct inaccurate data.
• Right to erasure ("right to be forgotten") - in cases defined by GDPR.
• Right to data portability - you may request a copy of your data.
• Right to object - against processing based on legitimate interests.
• To exercise your rights, contact us: kontakt@2sh.pl

6. Cookies

• The Service uses essential cookies for operation (session, authentication).
• Analytics cookies are used only with your consent.
• You can manage cookies in your browser settings.
• We do not use third-party tracking cookies (e.g. Facebook Pixel).

7. Data sharing with third parties

• We do not sell your personal data to third parties.
• Data may be shared with service providers: hosting (EU), payment processor Paddle (data processing agreements in place).
• When you use the AI page generator, the business data you provide (name, description, phone, address) is sent to OpenRouter (a platform that provides access to AI language models), which forwards the request to the Mistral AI model (a provider based in France, EU) to generate the page content. OpenRouter itself is a US-based company, which may involve processing data outside the European Economic Area. We recommend not including sensitive data or third parties' personal data in the description.
• We may disclose data to law enforcement if legally required.

8. Security

• All connections are encrypted using SSL/TLS.
• Passwords are stored as cryptographic hashes (bcrypt).
• Data access is restricted to authorised personnel only.
• We conduct regular security audits.

9. Contact and complaints

• For personal data matters contact us: kontakt@2sh.pl
• You have the right to lodge a complaint with the competent data protection authority in your country.