Privacy Policy

How we process personal data on mentara.company and in Mentara services.

Effective from: 14 October 2026

1. Data controller

1. The controller of personal data is Alpha Q spółka z ograniczoną odpowiedzialnością (a Polish limited liability company), registered office at ul. Marcina Kasprzaka 31/119, 01-234 Warsaw, Poland, entered in the National Court Register under KRS 0001114008, tax ID (NIP) 5273118915, REGON 529054489 (the “Controller”). Mentara is a brand of the Controller.
2. For data protection matters, contact us by email at [email protected] or by post at the registered office address.

2. What data we process

• Audit form – website address, work email address and selected language.
• Order form – company name, tax ID, name, email address, phone, website, selected plan and notes.
• Account and contract – name, job title, email address and phone number of the Client's contact persons, company details and invoicing details.
• Payments – transaction information. Card data is processed only by payment providers; the Controller never receives it.
• Correspondence – message content and sender details.
• Technical data – IP address, browser type, time of visit and pages visited, stored in server logs for security purposes.
• Statistics – aggregated traffic data collected without cookies and without identifying individuals.

3. Purposes and legal bases

• Performing the Audit at the request of the person submitting the form and contacting them about the results – Article 6(1)(b) GDPR (steps prior to a contract) and Article 6(1)(f) GDPR (legitimate interest: responding to a request).
• Concluding and performing the contract with the Client, including contact with persons designated by the Client – Article 6(1)(b) and (f) GDPR.
• Issuing invoices and keeping accounts – Article 6(1)(c) GDPR.
• Securing the Website and establishing, exercising or defending legal claims – Article 6(1)(f) GDPR.
• Website traffic statistics – Article 6(1)(f) GDPR.
• Sending marketing emails – only with your separate consent, which you can withdraw at any time.

4. Recipients

Data may be shared with providers that process it on the Controller's behalf:

• Cloudflare – website hosting, content delivery network and attack protection;
• Supabase – database and authentication (servers in Frankfurt);
• Hetzner – computing servers in the European Union;
• Resend – sending reports, order confirmations and other emails;
• Stripe and Paddle – payment processing (Paddle acts as the seller for transactions outside Poland);
• AI Engine providers (OpenAI, Google, Anthropic) and a Google search results data provider – they receive questions about the Client's business (e.g. company name, industry, city). We do not send them the contact details of people who submit the form;
• accountants, legal advisers and entities authorised by law.

5. Transfers outside the EEA

Some providers are based in or use infrastructure in the United States. Transfers rely on the European Commission's adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses approved by the European Commission. You can obtain a copy of the safeguards by contacting the Controller.

6. Retention

• Audit form data – up to 12 months after the report is sent, unless a contract is concluded.
• Contract data – for the term of the contract and then until claims become time-barred.
• Accounting records – for the period required by tax law (5 years from the end of the tax year).
• Data processed on the basis of consent – until consent is withdrawn.
• Technical logs – as long as needed for security, no longer than 12 months.

7. Your rights

1. You have the right to access, rectify and erase your data, to restrict processing, to data portability and to object to processing based on legitimate interest.
2. Where processing is based on consent, you may withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.
3. You may lodge a complaint with the President of the Polish Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw) or with the supervisory authority in your country.

8. Voluntary provision and automated decisions

1. Providing data is voluntary but necessary to perform the Audit or conclude a contract.
2. We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you.

9. Cookies and browser storage

1. The Website does not use tracking or advertising cookies.
2. The Website stores only your chosen colour theme in your browser (localStorage). This information is not sent to the Controller.
3. Fonts and video are served from our own server, without embedding content from third-party services.

10. Changes

We announce material changes to this Privacy Policy on the Website. This Policy applies from 14 October 2026. If the Polish and English versions differ, the Polish version prevails.