2. If you have an account

When you register and use ThisOrThat.cloud we process:

• your name and email address, and a hashed form of your password (we never store the password itself)
• the polls you create, including titles, descriptions and uploaded images
• your plan, billing interval, renewal date and Stripe customer reference - we do not store card numbers
• technical data: IP address, browser and operating system, and server logs
• messages you send us

3. If you vote in a poll

You can vote without an account. When you do, we record your choice together with your IP address, your browser’s user agent, the country your request came from, whether you are on a mobile device, and how long you took to decide. We use these to count votes once per person and to detect automated voting; without them the results would be trivially forgeable.

If the poll owner set it to require an email address, we also store the address you enter and make it available to that poll owner.

Who is responsible. For voting data used to run the service and keep results honest, we are the controller. For an email-gated poll, the person who created the poll decides what to do with the addresses collected and is the controller for that use; we act on their instructions. If you want an address removed, contact the poll owner or write to us and we will pass it on.

4. Why we process it, and on what legal basis

Article 6(1) GDPR:

• Providing the service - performance of a contract, Art. 6(1)(b). Accounts, polls, voting, results.
• Payments and invoicing - contract and legal obligation, Art. 6(1)(b) and (c). Polish accounting and tax law.
• Keeping results honest and the service secure - legitimate interest, Art. 6(1)(f). Rate limiting, duplicate detection, abuse prevention. Our interest is a product whose numbers mean something.
• Analytics and advertising - consent, Art. 6(1)(a). Nothing is set before you choose in the consent banner, and you can change your mind at any time.
• Marketing email - consent, Art. 6(1)(a). Every message has an unsubscribe link.

5. Automated decisions

We do not carry out automated decision-making with legal or similarly significant effects on you, and we do not profile you for that purpose. Advertising partners may profile visitors for ad selection where you have consented; you can withdraw that consent at any time.

6. Cookies and similar technologies

We set a small number of strictly necessary cookies without asking: your session when signed in, your language choice, a record that you already voted in a given poll, and the unlock token for a password-protected poll. These are needed for the service to work and cannot be switched off.

Everything else - analytics and advertising - is set only after you agree in the consent banner, which is provided by Usercentrics. You can reopen it at any time to change or withdraw your choices, and you can also clear cookies in your browser.

7. Who we share data with

We do not sell your personal data. We share it only with the providers we need to run the service, each under a data processing agreement:

• Vercel (USA/EU) - hosting and content delivery.
• Neon (EU region, AWS) - the PostgreSQL database holding accounts, polls and votes.
• Amazon Web Services S3 (us-east-1, USA) - storage of uploaded poll images.
• Stripe (USA/Ireland) - payment processing and subscription billing. Stripe is a controller in its own right for fraud prevention; see its privacy policy.
• Resend (USA) - transactional email, such as address verification.
• Google (USA) - Google Analytics for usage statistics and Google AdSense for advertising, both only after you consent.
• Adsterra (Cyprus) - advertising shown on free-plan polls, only after you consent.
• Usercentrics (Germany) - the consent banner and the record of your choices.

8. Transfers outside the EEA

Some of these providers are in the United States. Those transfers rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and otherwise on Standard Contractual Clauses together with additional safeguards. You can ask us for a copy of the safeguards in place.

9. How long we keep it

We keep personal data only as long as we need it:

• Account data - for as long as the account exists, then deleted within 30 days of closure.
• Poll content and images - deleted together with the poll or the account, allowing up to 30 days for backups to roll over.
• Votes, including IP address and user agent - 12 months from the vote, then deleted. Aggregate counts, which identify nobody, are kept for as long as the poll exists.
• Voter email addresses on email-gated polls - deleted with the poll, or on the poll owner’s instruction.
• Invoices and payment records - 5 years from the end of the tax year, as Polish tax law requires.
• Server and security logs - 90 days.
• Support correspondence - 24 months from the last message.

10. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or hand it over in a portable format. You can object to processing based on our legitimate interest. Where we rely on consent you can withdraw it at any time, which does not affect what we did before.

Direct marketing: you can object at any time, with no reason needed, and we will stop immediately.

Write to support@thisorthat.cloud. You can also delete your account yourself from your settings, which removes your polls and their votes.

If you think we have handled your data wrongly you can complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warszawa, or to the authority in the EU country where you live.

11. Children

ThisOrThat.cloud is not intended for children under 16 and accounts may not be created by them. If you believe a child has given us personal data, tell us and we will delete it.

12. Security

Passwords are stored hashed with bcrypt and never in readable form. Traffic is encrypted in transit. Uploaded images are private and served through short-lived signed links rather than public URLs. Access to production data is limited to those who need it.

No system is perfectly secure. If a breach is likely to put your rights at risk we will notify the supervisory authority within 72 hours and tell you without undue delay.

13. Changes to this policy

We may update this policy. The date at the top always shows the current version. For changes that materially affect how we use your data we will notify registered users by email before they take effect.