Privacy policy
Last updated: November 2, 2026 · Wersja polska
1. Data controller
The controller of personal data is Grantbot.pl Sp. z o.o., ul. Złota 75A/7, 00-819 Warszawa, Poland, KRS 0001244303, NIP (tax ID) 5273221240. SaaS Health is a brand of this company. This policy covers the saashealth.ai website and the app.saashealth.ai dashboard. For data protection matters, write to [email protected].
2. What we collect and why
Contact form
Your first name, email address, company name (optional) and message. We use them to reply and to prepare an offer. The message is delivered to our mailbox; the form does not store it in a database. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering correspondence (Art. 6(1)(f) GDPR).
Dashboard account
A dashboard account is created only on invitation from a company we have a contract with. We process your email address, your name (if provided), your organization and role, sign-in data and technical session information. We receive your email address, organization and role from the company that invites you; you provide the rest yourself. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) or, where the contract is with the company you represent, our legitimate interest in performing it (Art. 6(1)(f) GDPR).
Billing
Data needed for an invoice: company name, address, tax ID and a contact person. Legal basis: tax and accounting obligations (Art. 6(1)(c) GDPR).
Visit statistics
Google Analytics runs on saashealth.ai and in the app.saashealth.ai dashboard, and only with your consent (Art. 6(1)(a) GDPR). Until you agree, the Google script is not loaded at all. It collects the pages you visit, your device and approximate location. You can withdraw consent at any time with the “Cookie settings” button at the bottom of the page.
Ad measurement
If you agree (Art. 6(1)(a) GDPR), we run the Meta pixel and the Google Ads tag on saashealth.ai. They show whether a visit and a sent form came from our ad. Until you agree, their scripts are not loaded at all. They send, among other things, the page address and title, the fact that a form was sent (not its content), button clicks and their labels, the ad click identifier, browser information and the IP address. We do not pass on anything you type into the form, including your email address (we use neither Meta’s automatic advanced matching nor Google’s enhanced conversions), we do not send events from our server, and we do not use this data to show ads to people who visited the site (remarketing). These tools do not run in the app.saashealth.ai dashboard. You can withdraw consent with the “Cookie settings” button.
Technical logs
Our servers record IP addresses, browser type and request times. We use them to keep the service secure and to fix errors (Art. 6(1)(f) GDPR).
Legal claims
We may keep and use data from any of the categories above to establish, exercise or defend legal claims related to our work together. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
3. Data from our clients’ systems
The dashboard connects to a client’s tools, such as Stripe, Google Analytics, Google Ads, Meta Ads or their database, to calculate the company’s metrics. Where this includes personal data, for example our client’s own customers, the client is the controller and we process it on their behalf under a data processing agreement (template). That processing is not covered by this policy. Please direct questions about it to the company that works with us.
4. Who processes data for us
We do not sell data or share it with other companies for their marketing. We use the following providers, who process data on our behalf:
| Provider | Purpose | Location |
|---|---|---|
| Railway | hosting of the site and the dashboard | EU, Netherlands |
| Supabase | database and dashboard sign-in | EU, Germany (Frankfurt) |
| Cloudflare | DNS and network protection | global |
| Resend | sending emails: invitations, reports and contact form messages | USA |
| Zoho Mail | the mailbox that receives correspondence | EU |
| Anthropic | the repair plan in the dashboard, if you use it: the AI model receives the audit results and the company’s metrics; Anthropic does not use them to train models | USA |
| Google Analytics, only with your consent | EU and USA | |
| wFirma | invoicing | Poland |
The Meta pixel and the Google Ads tag run only with your consent. For collecting data on our site and passing it to Meta Platforms Ireland Ltd. and Google Ireland Ltd., we are joint controllers with those companies. We are responsible for asking for your consent and for informing you; Meta and Google are responsible for their further processing once they receive the data, under their own privacy policies (facebook.com/privacy/policy and policies.google.com/privacy). You can exercise your rights with us as well as with Meta or Google.
Some providers are US companies, including those that store data in the EU (Railway, Supabase, Cloudflare), so data may be made available outside the European Economic Area, for example through those companies’ remote access. Every such transfer relies on the mechanisms in Chapter V of the GDPR: standard contractual clauses adopted by the European Commission or an adequacy decision (the EU-U.S. Data Privacy Framework), depending on the provider. We will send a copy of the safeguards on request to [email protected].
5. How long we keep data
- Contact form messages and email: up to 12 months after our last contact, unless we enter into a contract.
- Dashboard account: for as long as the contract with the company that invited you lasts, then until any claims become time-barred, usually 3 years for business claims (Art. 118 of the Polish Civil Code).
- Billing records: 5 years from the end of the year in which the tax payment deadline passed.
- Technical logs: up to 12 months.
- Google Analytics data: according to the Google Analytics retention setting, no longer than 14 months.
- Advertising cookies set on saashealth.ai: up to 3 months or until you withdraw consent. Cookies that Meta and Google set on their own domains may be kept longer, under their policies (see section 6).
6. Cookies
We use cookies and similar technologies, such as browser local storage. Without your consent we use only those the site and dashboard need to work (Art. 399 of the Polish Electronic Communications Law). Analytics and advertising cookies are set only after you agree, separately for each category. You can change your choice at any time with the “Cookie settings” button at the bottom of the site and the dashboard; when you withdraw consent, we delete that category’s cookies.
| Name | Purpose | Lifetime |
|---|---|---|
lang | Remembers the language you chose. | 1 year |
saashealth_consent | Remembers your choices about statistics and ad measurement. | 6 months |
sb-…-auth-token | Keeps you signed in to the dashboard (app.saashealth.ai). | up to 400 days |
sidebar_state | Remembers whether the dashboard sidebar is open. | 7 days |
__cf_bm | Cloudflare: tells human traffic from bots; set only when bot protection checks a request. | 30 minutes |
sidebar-open, saas-health:business:… | Browser local storage in the dashboard: the sidebar state and a copy of the latest report, so the dashboard keeps working during a brief connection loss. | report copy until you sign out, sidebar state until you clear the browser |
| Name | Purpose | Lifetime |
|---|---|---|
_ga | Google Analytics: tells visitors apart to count visits. | 2 years |
_ga_<ID> | Google Analytics: keeps the session state. | 2 years |
| Name | Purpose | Lifetime |
|---|---|---|
_fbp | Meta: recognizes the browser to attribute a visit and an inquiry to an ad. | 3 months |
_fbc | Meta: stores the ad click identifier. | 3 months |
_gcl_au | Google Ads: measures ad conversions. | 3 months |
_gcl_aw | Google Ads: stores the ad click identifier. | 3 months |
With ad measurement consent, Meta and Google may also read and set their own cookies on their domains, such as fr on facebook.com and IDE on doubleclick.net, usually for 3 to 13 months. We cannot access or delete them; they are described in those companies’ cookie policies, and you can delete them in your browser settings.
7. Your rights
You have the right to access, rectify and erase your data, to restrict its processing and to data portability, and to object to processing based on legitimate interest. You can withdraw consent at any time; this does not affect processing carried out before. To exercise these rights, write to [email protected]. You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (uodo.gov.pl), or with the data protection authority in the country where you live or work.
8. Voluntary data and automated decisions
Providing data is voluntary, but without an email address we cannot reply or create an account. Invoice data is the exception: tax law requires it, and without it we cannot provide a paid service. We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects. The assessments in the dashboard concern a company’s metrics, not people.
9. Changes to this policy
When we change how we process data, we will update this page and the date at the top. We will email dashboard users about significant changes that affect their accounts.