The controller of personal data is STGR Spółka z ograniczoną odpowiedzialnością, based in Poznań, Poland (60-480 Poznań, ul. Marynarska 3), entered in the Polish business register (KRS) under number 0001122852, NIP: 7812075138, REGON: 529469405 (“Slimaco”, “Controller”), operating under the Slimaco AI brand.
Contact for data protection matters: legal@slimaco.com. We have appointed a data protection officer, who can be contacted at dpa@slimaco.com.
1A. When we are the controller and when we are the processor
We are the controller of the data of visitors to slimaco.com, people who contact us, and representatives and users of our Customers with respect to platform accounts, billing and security logs. This Policy describes that processing.
Data that the Customer or its Users enter into the Slimaco AI platform (conversation content, documents, content retrieved from connected accounts, generated files) is processed by us as a processor on behalf of the Customer, under a data processing agreement (DPA). The Customer is the controller of that data. This Policy does not govern it. If your data appears in content entered by a Customer (for example, you are the Customer’s business partner), please contact the Customer; we will help them handle your request.
1. What data we collect and for what purposes
Visitors to slimaco.com: technical data (IP address, cookie identifiers, device data) — to operate the website and analyse traffic.
People contacting us / sales leads: first and last name, e-mail, phone number, company name, content of the enquiry — to handle the enquiry and conduct sales conversations.
Representatives of business customers (Main Agreement): contact details of the people representing the Customer — to conclude and perform the agreement, for billing and operational contact.
Users of Slimaco AI platform accounts: e-mail address, first and last name, role and permissions, account identifier, settings and preferences, notifications — to create, authenticate and manage the account, including sending account-related e-mails (e.g. invitation, password reset).
Users signing in with Google or Microsoft: the e-mail address and name made available by these platforms during sign-in (company/organisational accounts only) — to authenticate the user and manage the account. Sign-in uses only basic identity scopes (e-mail, name); access to the mailbox, drive or calendar, if the Customer enables it, requires a separate, explicit consent and is described in the data processing agreement (DPA).
Billing data: data of the Customer and contact persons on invoices, and information on service usage (company, model, number of tokens, cost, time) — for billing and accounting.
Technical and security data: metadata of platform events (account identifier, time, event, result), sign-in events, IP address — to ensure security, detect abuse and resolve failures.
Correspondence with support: the content of the request and the contact details of the person submitting it.
2. Legal bases for processing
- Art. 6(1)(b) GDPR — performance of a contract or steps taken before entering into it (handling enquiries, agreements with Customers, platform accounts)
- Art. 6(1)(c) GDPR — legal obligation (accounting, taxes)
- Art. 6(1)(f) GDPR — the Controller’s legitimate interest (website analytics, direct marketing, security, establishing and defending claims)
- Art. 6(1)(a) GDPR — consent (e.g. for specific cookies, newsletter) — where required
3. Data recipients and sub-processors
Data may be shared with entities supporting Slimaco’s activities under data processing agreements, including providers of hosting and cloud infrastructure, providers of artificial intelligence models, providers of transactional e-mail, CRM and marketing tools, and analytics tools.
The current list of platform sub-processors, with the purpose of processing, country and transfer basis, is published on the Sub-processors page.
The platform runs on Google Cloud infrastructure in the European Union (production database in Warsaw; backups and selected computing in other EU regions). Language models are provided by Microsoft (Azure OpenAI / Azure AI Foundry), including Claude models provided by Anthropic through Microsoft Azure. Account-related e-mails (invitation, password reset) are sent via Google Workspace (in the typical configuration), and platform notifications via Postmark. The contact form on the website is handled by Web3Forms, which forwards the content of the request to our e-mail address. Website analytics uses Google Analytics 4 (Google Ireland Ltd.) only after consent is given in the cookie banner.
Slimaco does not sell personal data to third parties.
Separately, in the sign-in process, Google and Microsoft act as identity providers — the e-mail address and name are provided by these platforms on the basis of consent given by the user directly to Google/Microsoft in the sign-in window; Slimaco does not pass this data on beyond the scope described in this Policy.
3A. Transfers of data outside the European Economic Area
We store data in the EU. Some services may involve processing outside the EEA. Depending on the type of provider:
| Type of provider | Possible transfer outside the EEA | Basis |
|---|---|---|
| Hosting (Google Cloud) | Platform data stored in the EU (Poland, Belgium, the Netherlands). Ancillary access by the provider from outside the EU is possible under its terms. | The provider’s data processing agreement (Google Cloud Data Processing Addendum) |
| Language models — EU data zone | Processing in the EU (Poland, Sweden, France). The provider may store prompts for up to 30 days in the EU solely to detect abuse. | The provider’s data processing agreement (Microsoft Customer Agreement, DPA via the Product Terms) |
| Language models — “global” deployments (some selectable models, including Claude) | Processing possible outside the EU, including in the USA. The Customer chooses such models deliberately; they are disabled by default and enabled by the company’s administrator. Claude models are provided by Anthropic through Microsoft and are available only in this variant. Before sending to the model we mask identifiers (e.g. national ID number, IBAN, e-mail address, phone number); names of people and organisations are not masked by default. | Standard contractual clauses or a European Commission decision (EU-US Data Privacy Framework), as provided in the agreement with the provider |
| Integrations with the Customer’s accounts (Composio, USA) | Yes, USA | Standard contractual clauses |
| Transactional e-mail (Postmark, USA) | Yes, USA (recipient’s e-mail address, content of the account-related message) | Standard contractual clauses or a European Commission decision (EU-US Data Privacy Framework), as provided in the agreement with the provider |
| Web search (Brave Search, USA) | Yes, USA. Only the query goes to the search engine, without the Customer’s documents. A query containing a recognised personal identifier (e.g. an identification number, e-mail address, account number) is not sent; a query may contain first names, surnames and company names. | Standard contractual clauses |
| Website analytics and marketing (Google, LinkedIn, Meta) | Possible, including the USA, only after consent in the cookie banner | European Commission decision (EU-US Data Privacy Framework) or standard contractual clauses |
A copy of the safeguards applied (e.g. standard contractual clauses) can be obtained at legal@slimaco.com.
4. Data retention periods
The table covers data for which Slimaco is the controller. Retention periods for content entered by the Customer into the platform are set by the Customer (see section 1A).
| Data | Retention period |
|---|---|
| Leads and contact data from enquiries | For the duration of sales conversations and 48 months after they end |
| Customer and contact person data related to the agreement | For the duration of the agreement and, after it ends, until the limitation period for claims expires. Accounting and tax documents are kept for 5 years from the end of the calendar year in which the tax payment deadline expired. |
| User account in the platform (e-mail, first and last name, role, settings) | Until the account is deleted and, after the agreement with the Customer ends, within the period set in the agreement |
| Billing data and service usage | Usage (company, model, tokens, cost, time): 13 months in the analytics archive. Invoices: the period required by accounting law |
| Security and technical logs (metadata) | 30 days; sign-in events (including IP address) 90 days |
| Backups | Up to about 60 days for database dumps (30 days plus bucket versioning), 14 days for disk snapshots; deleted data is not deliberately restored after a recovery from backup |
| Cookies on slimaco.com | According to the Cookie Policy: the choice made in the banner (slimaco_consent) 12 months; Google Analytics cookies (_ga, _ga_*) up to 2 years |
After the retention period ends, we delete or anonymise the data, unless the law requires longer retention or the data is needed to establish, pursue or defend claims.
5. Rights of data subjects
Everyone has the right to: access their data, rectify it, erase it, restrict its processing, data portability, object to processing based on legitimate interest, withdraw consent at any time (without affecting the lawfulness of processing before withdrawal), and lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes UODO).
Requests can be sent to legal@slimaco.com or to our data protection officer at dpa@slimaco.com. We respond without undue delay and no later than one month after receiving the request; if necessary, we may ask you to confirm your identity. A request concerning data in content entered into the platform by a Customer is forwarded to the Customer as the controller, and we help them handle it.
Providing data is voluntary, but necessary to handle an enquiry, conclude an agreement or create an account.
6. Cookies
The use of cookies is described in a separate Cookie Policy. You can change your consents at any time in the cookie settings.
7. Changes to this Privacy Policy
This Policy may be updated; the current version is always available at this address together with the date of the last update.
8. Contact
legal@slimaco.com · data protection officer: dpa@slimaco.com
This English version is a translation of the Polish original. In case of any discrepancy, the Polish version governs.