Privacy Policy
How the WOVENRAG pricing calculator handles personal data — what we process, why, for how long, and what rights you have.
Effective from 9 August 2026
1. Data controller
The data controller is yknot s. r. o., Company ID 56569653, registered office Ďurgalova 2860/2, 831 01 Bratislava – mestská časť Nové Mesto, Slovak Republic (full details — see Contact). Contact for exercising your rights: email listed on the Contact page.
2. The most important point first: anonymous use
You can use the calculator entirely without an account — and in that case no data reaches us at all. All your numbers, products, and settings live exclusively in your browser (localStorage). They never leave for any server, we cannot see them, and we cannot recover them if you clear your browser data — there is deliberately no download/backup button in this mode, because there is nowhere to safely store that copy other than with you. Your work only reaches us when you voluntarily create an account — on sign-in it is transferred to your account and we inform you about the transfer. For basic traffic statistics, we process only one anonymous technical data point with no personal content (see "Anonymous traffic" in the table below) — it does not identify you in any way and is not linked to your work.
3. What we process, why, and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Anonymous use | none with us — data only in your browser | — | under your control (browser data) |
| Account | email, password hash (Argon2id) or Google link, workspace content (products, settings) | contract performance | until account deletion + 30 days (recovery window) |
| Payments and subscription | billing details, payment history (the seller and payment processor is Paddle) | contract performance + legal obligation | accounting records 10 years (accounting act) |
| Transactional emails | email, event type (verification, password reset, payments) | contract performance | delivery logs 30 days |
| Cookie consent | chosen categories, policy version, time of choice | legal obligation (demonstrability of consent) | 2 years |
| Analytics and marketing | Google Analytics / Meta Pixel — activated only after your consent | consent (revocable at any time) | per tool — see Cookies |
| Anonymous traffic | salted one-way hash of IP address and browser type — we do not store the IP address itself — and two-letter country code; no cookies and no link to your account or work | legitimate interest (basic traffic statistics without identifying individuals) | max. 13 months |
| Security logs | hashed IP address (salted), browser type on sign-in | legitimate interest (account protection) | for the duration of the session, max. 30 days |
| Operations and account security (admin overview) | email, registration date, sign-in records (count and time), language version (SK/CZ) loaded from your workspace, subscription status | legitimate interest (administration, operation and security of the service) | for the duration of the account |
We never sell personal data. For administration, operation, and security of the service, the controller maintains an internal admin overview of registered accounts (registration date, sign-ins, language version, subscription status, and email). This is an administrative overview of the controller, not automated decision-making or profiling with legal or similarly significant effects — and it applies only to registered accounts. Anonymous use does not send us any of your data; all we have from it is aggregated, anonymous traffic statistics (no cookies and no data that would identify you).
4. Processors and recipients
We use the following suppliers for operation (updated based on final infrastructure selection before launch — TBD for items where the selection is still underway):
- Websupport, s. r. o. (SK/EU) — web and database hosting.
- Paddle.com Market Ltd (United Kingdom) — subscription seller (merchant of record): processes payments, tax documents, and related data as an independent controller; transfer to the UK is covered by an EU adequacy decision. Details in Paddle's privacy policy.
- Google Ireland Ltd. — sign-in via Google (only if you use it) and Google Analytics (only after consent).
- Meta Platforms Ireland Ltd. — Meta Pixel (only after consent to the marketing category).
- Transactional email provider (EU region) — TBD based on operational preparation.
- Error tracking (EU region) — TBD; error logs do not contain personal data.
5. Your rights and how to exercise them in the app
- Access and portability: in your account, press Account → Request my data (JSON). This is a deliberate, separate step with no direct download button — after confirming you understand the request, a one-time download link for the complete content of your account in an open format will be sent to your email; the link is valid for 24 hours.
- Rectification: you can edit all data directly in the app (email in account settings).
- Erasure: Account → Delete account. The account is immediately deactivated and all its data is permanently deleted after 30 days; until then you can restore it by simply signing in. Only invoices that we are legally required to retain for 10 years will remain. An active subscription is cancelled first when deleting.
- Withdrawal of consent: you can turn off analytics and marketing cookies at any time via the "Cookies" link in the footer or on the Cookies page.
- Other rights (restriction of processing, objection): write to us at the contact listed on the Contact page. We will respond within 30 days at the latest.
- Complaint: if you believe we are processing your data incorrectly, you may contact the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk. Czech residents may also contact the Czech Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.
6. Cookies
Essential cookies (sign-in, security) are created only after you sign in. Analytics and marketing tools do not run until you consent — declining is just as easy as accepting. Basic traffic statistics are measured without cookies and without personal data, so no consent is needed for those. Details and controls: Cookie Policy.
7. Security
Passwords are stored exclusively as Argon2id hashes, sessions are bound to a random token stored only as SHA-256, connections are encrypted (HTTPS), and production access is protected by two-factor authentication. IP addresses are stored only as salted hashes to protect against account abuse.