Privacy Policy
How the WOVENRAG pricing calculator handles personal data — what we process, why, for how long, and what rights you have.
Effective from 6 October 2026
1. Data controller
The data controller is yknot s. r. o., Company ID 56569653, registered office Ďurgalova 2860/2, 831 01 Bratislava – mestská časť Nové Mesto, Slovak Republic (full details — see Contact). Contact for exercising your rights: email listed on the Contact page.
2. Accounts and saved calculations
You need an account to use the calculator. Sign in with a single-use email link. Products and settings are saved to your account on the server; your browser also keeps a local copy. Visitors who do not sign in send no workspace content. Basic traffic statistics use a monthly-rotating salted hash of the IP address and browser type, separate from calculation content.
3. What we process, why, and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Local copy of calculations | products and settings in the browser | contract performance | until browser data is cleared or you sign out |
| Account | email, one-time sign-in link sent to your email (valid 10 minutes, single use — no password is ever stored), workspace content (products, settings) | contract performance | until account deletion + 30 days (recovery window) |
| Account settings | calculation model country and workspace settings | contract performance | until account deletion + 30 days |
| Transactional emails | email, event type (sign-in, data copy, account deletion) | contract performance | delivery logs 30 days |
| Cookie consent | chosen categories, policy version, time of choice | legal obligation (demonstrability of consent) | 2 years |
| Analytics and marketing | Google Analytics / Meta Pixel — activated only after your consent | consent (revocable at any time) | per tool — see Cookies |
| Anonymous traffic | salted one-way hash of IP address and browser type — we do not store the IP address itself — and two-letter country code; no cookies and no link to your account or work | legitimate interest (basic traffic statistics without identifying individuals) | max. 13 months |
| Security logs | hashed IP address (salted), browser type on sign-in | legitimate interest (account protection) | for the duration of the session, max. 30 days |
| Operations and account security (admin overview) | email, registration date, sign-in records (count and time), language version (SK/CZ) loaded from your workspace, account access status | legitimate interest (administration, operation and security of the service) | for the duration of the account |
We never sell personal data. For administration, operation, and security of the service, the controller maintains an internal admin overview of registered accounts (registration date, sign-ins, language version, account access status, and email). This is an administrative overview of the controller, not automated decision-making or profiling with legal or similarly significant effects — and it applies only to registered accounts. Visitors who do not sign in send no calculation content. Website visits contribute to the aggregate traffic statistics described above.
4. Processors and recipients
We use the following suppliers for operation (this list may still change before launch based on final infrastructure choices):
- Websupport, s. r. o. (SK/EU) — web, database, and server error-log hosting. We do not use a separate error-tracking service; the logs contain no personal data — emails in them are masked and sign-in tokens are never written to them.
- Google Ireland Ltd. — Google Analytics (only after consent); any onward transfer to its US parent is covered by the EU-US Data Privacy Framework adequacy decision, or standard contractual clauses as a fallback.
- Meta Platforms Ireland Ltd. — Meta Pixel (only after consent to the marketing category); any onward transfer to its US parent is covered by the EU-US Data Privacy Framework adequacy decision, or standard contractual clauses as a fallback.
- Transactional email provider (EU) — either Scaleway TEM (France) or the Websupport hosting's own SMTP, depending on which sending method is currently configured; only sign-in links and confirmations are sent through it, never a password (none exists).
5. Your rights and how to exercise them in the app
- Access and portability: in your account, press Account → Request my data (JSON). This is a deliberate, separate step with no direct download button — after confirming you understand the request, a one-time download link for the complete content of your account in an open format will be sent to your email; the link is valid for 24 hours.
- Rectification: you can edit all data directly in the app (email in account settings).
- Erasure: Account → Delete account. The account is immediately deactivated and all its data is permanently deleted after 30 days; until then you can restore it by simply signing in.
- Withdrawal of consent: you can turn off analytics and marketing cookies at any time via the "Cookies" link in the footer or on the Cookies page.
- Other rights (restriction of processing, objection): write to us at the contact listed on the Contact page. We will respond within 30 days at the latest.
- Complaint: if you believe we are processing your data incorrectly, you may contact the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk. Czech residents may also contact the Czech Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.
6. Cookies
Essential cookies (sign-in, security) are created only after you sign in. Analytics and marketing tools do not run until you consent — declining is just as easy as accepting. Basic traffic statistics are measured without cookies and without accessing storage on your device, so no consent is needed under the cookie rules; the legal basis is legitimate interest (see the table above). Details and controls: Cookie Policy.
7. Security
There is no password — sign-in works through a one-time link sent to your email, so there is nothing to hash. Your session is held by a cookie carrying a random 256-bit token; the server stores only its SHA-256 fingerprint, never the token itself. Workspace content (products, settings) is encrypted at rest with AES-256-GCM. The connection is encrypted (HTTPS) and production access is protected by two-factor authentication. IP addresses are stored only as salted hashes to protect against account abuse.