Privacy Notice
Last updated: 13 June 2026
This Privacy Notice explains how Magdalena BÄ…k (data controller) collects and processes your personal data when you use Red Flag Advisor.
1. Data controller
Magdalena BÄ…k is the data controller. Contact for privacy: redalertapp@proton.me.
2. Data we collect
Account data (email, encrypted password, optional display name). Content data (conversations, screenshots and situation descriptions you submit). Usage data (analysis counts, language preference, error logs, basic device/browser metadata, IP address). Communications you send to support.
3. Why we use it
To provide the analysis service (legal basis: performance of contract). To maintain security, prevent fraud and abuse (legitimate interests). To improve the product (legitimate interests; anonymised wherever possible). To comply with legal obligations (legal obligation). For marketing only with your prior consent (consent).
4. AI processing
Conversations and screenshots you submit are processed by AI model providers used to generate the analysis. We minimise data sent and do not include account identifiers in prompts. Screenshots are processed for OCR and discarded after the analysis completes.
5. Who we share data with
Hosting and database infrastructure (Supabase / Cloudflare). AI model providers used to generate analyses. Paddle.com Market Limited — Merchant of Record for all sales, processing subscriptions, payments, tax and invoicing. Email-delivery providers for transactional emails. Legal/accounting advisers. Authorities when required by law.
6. International transfers
Some recipients (e.g. AI providers and hosting) are located outside the EEA/UK. Transfers rely on EU Standard Contractual Clauses and adequacy decisions where applicable.
7. Retention
Account data: kept until you delete your account. Analyses: kept while your account is active so you can revisit them. Logs: up to 90 days. Billing data is retained by Paddle for the period required by tax law. After deletion, data is removed within 30 days except where retention is required.
8. Your rights (GDPR)
Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. You may complain to your local Data Protection Authority (in Poland: UODO). To exercise rights: redalertapp@proton.me. We respond within one month.
9. Security
We use encryption in transit and at rest, access controls and least-privilege roles. Authentication is provided through a managed auth service with rate limiting.
10. Cookies
We use only essential cookies and local-storage entries needed to keep you signed in and remember your language preference. We do not use third-party advertising or tracking cookies.
11. Children
The Service is not intended for users under 16. We do not knowingly collect data from children.
12. Changes
Material changes will be announced in-app at least 14 days before they take effect.