Privacy Policy
How the WOVENRAG pricing calculator handles personal data — what we process, why, for how long, and what rights you have.
Effective from 12 August 2026
1. Data controller
The data controller is yknot s. r. o., Company ID 56569653, registered office Ďurgalova 2860/2, 831 01 Bratislava – mestská časť Nové Mesto, Slovak Republic (full details — see Contact). Contact for exercising your rights: email listed on the Contact page.
2. The most important point first: anonymous use
You can use the calculator entirely without an account — and in that case no data reaches us at all. All your numbers, products, and settings live exclusively in your browser (localStorage). They never leave for any server, we cannot see them, and we cannot recover them if you clear your browser data — there is deliberately no download/backup button in this mode, because there is nowhere to safely store that copy other than with you. Your work only reaches us when you voluntarily create an account — on sign-in it is transferred to your account and we inform you about the transfer. For basic traffic statistics, we process one pseudonymous technical data point — a monthly-rotating salted hash of your IP address and browser type, which is not designed to identify you (details in the table below) — and it is not linked to your work.
3. What we process, why, and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Anonymous use | none with us — data only in your browser | — | under your control (browser data) |
| Account | email, one-time sign-in link sent to your email (valid 10 minutes, single use — no password is ever stored), workspace content (products, settings) | contract performance | until account deletion + 30 days (recovery window) |
| Payments and subscription | billing details, payment history (the seller and payment processor is Paddle) | contract performance + legal obligation | accounting records 10 years (accounting act) |
| Transactional emails | email, event type (verification, password reset, payments) | contract performance | delivery logs 30 days |
| Cookie consent | chosen categories, policy version, time of choice | legal obligation (demonstrability of consent) | 2 years |
| Analytics and marketing | Google Analytics / Meta Pixel — activated only after your consent | consent (revocable at any time) | per tool — see Cookies |
| Anonymous traffic | salted one-way hash of IP address and browser type — we do not store the IP address itself — and two-letter country code; no cookies and no link to your account or work | legitimate interest (basic traffic statistics without identifying individuals) | max. 13 months |
| Security logs | hashed IP address (salted), browser type on sign-in | legitimate interest (account protection) | for the duration of the session, max. 30 days |
| Operations and account security (admin overview) | email, registration date, sign-in records (count and time), language version (SK/CZ) loaded from your workspace, subscription status | legitimate interest (administration, operation and security of the service) | for the duration of the account |
We never sell personal data. For administration, operation, and security of the service, the controller maintains an internal admin overview of registered accounts (registration date, sign-ins, language version, subscription status, and email). This is an administrative overview of the controller, not automated decision-making or profiling with legal or similarly significant effects — and it applies only to registered accounts. Anonymous use does not send us any of your data; all we have from it is aggregated, anonymous traffic statistics (no cookies and no data that would identify you).
4. Processors and recipients
We use the following suppliers for operation (this list may still change before launch based on final infrastructure choices):
- Websupport, s. r. o. (SK/EU) — web, database, and server error-log hosting. We do not use a separate error-tracking service; the logs contain no personal data — emails in them are masked and sign-in tokens are never written to them.
- Paddle.com Market Ltd (United Kingdom) — subscription seller (merchant of record): processes payments, tax documents, and related data as an independent controller; transfer to the UK is covered by an EU adequacy decision. Details in Paddle's privacy policy.
- Google Ireland Ltd. — Google Analytics (only after consent); any onward transfer to its US parent is covered by the EU-US Data Privacy Framework adequacy decision, or standard contractual clauses as a fallback.
- Meta Platforms Ireland Ltd. — Meta Pixel (only after consent to the marketing category); any onward transfer to its US parent is covered by the EU-US Data Privacy Framework adequacy decision, or standard contractual clauses as a fallback.
- Transactional email provider (EU) — either Scaleway TEM (France) or the Websupport hosting's own SMTP, depending on which sending method is currently configured; only sign-in links and confirmations are sent through it, never a password (none exists).
5. Your rights and how to exercise them in the app
- Access and portability: in your account, press Account → Request my data (JSON). This is a deliberate, separate step with no direct download button — after confirming you understand the request, a one-time download link for the complete content of your account in an open format will be sent to your email; the link is valid for 24 hours.
- Rectification: you can edit all data directly in the app (email in account settings).
- Erasure: Account → Delete account. The account is immediately deactivated and all its data is permanently deleted after 30 days; until then you can restore it by simply signing in. Only invoices that we are legally required to retain for 10 years will remain. An active subscription is cancelled first when deleting.
- Withdrawal of consent: you can turn off analytics and marketing cookies at any time via the "Cookies" link in the footer or on the Cookies page.
- Other rights (restriction of processing, objection): write to us at the contact listed on the Contact page. We will respond within 30 days at the latest.
- Complaint: if you believe we are processing your data incorrectly, you may contact the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk. Czech residents may also contact the Czech Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.
6. Cookies
Essential cookies (sign-in, security) are created only after you sign in. Analytics and marketing tools do not run until you consent — declining is just as easy as accepting. Basic traffic statistics are measured without cookies and without accessing storage on your device, so no consent is needed under the cookie rules; the legal basis is legitimate interest (see the table above). Details and controls: Cookie Policy.
7. Security
There is no password — sign-in works through a one-time link sent to your email, so there is nothing to hash. Your session is held by a cookie carrying a random 256-bit token; the server stores only its SHA-256 fingerprint, never the token itself. Workspace content (products, settings) is encrypted at rest with AES-256-GCM. The connection is encrypted (HTTPS) and production access is protected by two-factor authentication. IP addresses are stored only as salted hashes to protect against account abuse.