Privacy Policy

Last updated: 19 May 2026

ImpliedData ("we", "us", "our") is operated by Michał Majkowski, based in Poland. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights under the General Data Protection Regulation (GDPR) and other applicable law.

Our website is implieddata.com. The legal basis for processing your data is (a) performance of a contract (providing the Service you registered for, free of charge), (b) our legitimate interests (security, abuse prevention, service improvement), and (c) your consent where explicitly given.

1. Data We Collect

Account data — when you sign up we collect your email address and any profile information you provide. This is processed by Clerk (our authentication provider).

Payment data — none. ImpliedData is free and does not sell anything. We operate no checkout and no payment processor, and we never collect, receive or store card details, bank details or any other financial information.

Usage data — we log API requests (endpoint, timestamp, response code, approximate IP) for security, debugging, and abuse prevention. Logs are retained for 90 days.

Cookies and analytics — we use a strictly necessary session cookie (set by Clerk) for authentication. We use Vercel Analytics, which collects anonymised page-view data (no cross-site tracking, no fingerprinting, no cookies set by Vercel Analytics itself). We do not use Google Analytics or any advertising cookies.

2. How We Use Your Data

• To create and manage your account and authenticate you.
• To send transactional emails (sign-in and account notifications) via Resend.
• To detect and prevent fraud, abuse, and security incidents.
• To improve the Service based on aggregated, anonymised usage patterns.

We do not sell your personal data to third parties. We do not use your data for advertising.

3. Sub-processors and Third Parties

We share your data only with the following processors, all bound by data-processing agreements:

• Clerk (clerk.com) — authentication and user management. Servers in the US; Standard Contractual Clauses (SCCs) in place.
• Vercel (vercel.com) — frontend hosting. Servers in the US; SCCs in place.
• Resend (resend.com) — transactional email delivery. Servers in the US; SCCs in place.
• Upstash (upstash.com) — rate-limiting and abuse prevention; stores IP addresses transiently. SCCs in place.
• Hetzner (hetzner.com) — database and backend hosting. Servers in Germany (EU). Subject to German/EU data protection law.

4. Data Retention

• Account data is retained for the lifetime of your account, plus 30 days after deletion to allow for recovery.
• Server logs are retained for 90 days.

5. International Transfers

Some of our processors (Clerk, Vercel, Resend, Upstash) are based in or operate from the United States. Transfers are covered by Standard Contractual Clauses (SCCs) approved by the European Commission and, where the processor is certified, the EU-US Data Privacy Framework — providing equivalent protection to data held in the EEA.

6. Your Rights (GDPR)

If you are in the European Economic Area you have the following rights:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion of your data ("right to be forgotten"), subject to legal retention obligations.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interests.
• Restriction — request that we limit processing of your data.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Polish data protection authority (UODO): uodo.gov.pl.

7. Security

We use TLS encryption in transit and encrypt sensitive fields at rest. Access to production systems is restricted to authorised personnel. Despite these measures, no system is 100% secure; we will notify you and the relevant authority within 72 hours of becoming aware of a personal-data breach that affects your rights.

8. Children

The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it promptly.

9. Changes to This Policy

We may update this policy from time to time. We will notify you by email or by posting a notice on the Service before material changes take effect. The "Last updated" date at the top of this page reflects the current version.

10. Contact

Data controller: Michał Majkowski, Poland.
Email: [email protected]