Privacy Policy

Last updated: 2026-09-11

This service processes files that may contain personal data. This page explains exactly what happens to them, in the order that matters most.

1. Who is responsible

The controller of the data described below is Aleksander Wąsowski, ul. Broniewskiego 24A.28, 07-300 Ostrów Mazowiecka, Poland - the same person who provides the service under the Terms of Service.

Questions about this policy and requests concerning your data: kontakt@awwebdesign.pl. We answer within one month, as the GDPR requires.

We have not appointed a data protection officer; the address above is the right one for every question.

2. The files you upload

Your file is processed automatically and deleted within 24 hours. Nothing else is done with it. Specifically:

• the contents are read only to produce the cleaned file you download;
• they are not used to train any model, ours or anyone else's;
• they are not shared with third parties;
• no person reads them as a matter of routine. Access to the server exists for technical maintenance, as it must for any hosted service.

The uploaded file, the intermediate working file and the cleaned result are stored on the server for at most 24 hours from the upload, then removed by an automatic job. After that they cannot be recovered - including by us.

If your file contains other people's personal data

Then you decide why and how those data are processed, and we process them only on your instruction - by running the cleaning you asked for. In the language of the GDPR you are the controller and we are the processor. You are responsible for having a lawful basis to upload those data in the first place.

The terms on which we process them are in Annex A of the Terms of Service, which is our data processing agreement under Article 28 GDPR. Accepting the terms concludes it, so there is nothing separate to sign.

3. What we keep after the file is gone

A record of the run survives the file, because it is what daily limits and abuse protection are counted from. It contains:

• the file name, its size, the number of rows and columns;
• when it was uploaded and processed, and whether processing succeeded;
• which account or browser it belonged to.

It does not contain any content of the file - no values, no column names, no sample rows. Note that a file name can itself be revealing; it is stored as you named it.

4. Account data

You can use the service without an account. If you choose to sign in, we use Google as the only sign-in method and receive from Google:

• your email address,
• your name and given/family name,
• the URL of your profile picture,
• the identifier Google uses for your account.

We never receive your Google password. The access token issued during sign-in is used once, to complete the sign-in, and is not stored.

You can delete your account at any time from your account page. Deletion removes the account, its Google connection, every run recorded against it, and any files still stored for those runs. Copies in database backups are overwritten within 14 days.

5. Technical data

• IP address - used to count daily runs and to limit automated abuse. Counters are keyed by address and by calendar day, and expire at midnight; we do not build profiles or histories from them.
• Session cookie - necessary for the service to work. It is what identifies your browser as the owner of an upload you made without signing in, so that nobody else can reach your file. It is marked HttpOnly and, in production, Secure.
• Server logs - ordinary technical records of requests and errors, kept for diagnosing failures.
• Page view counter - we count how many times each page was opened, per day. A record consists of the page, the date and a number, and nothing else: no address, no account, no cookie, no identifier of any kind. Nothing in it can be traced back to a person, not even by us, and a single visit cannot be separated out of it.

We use no third-party analytics, no advertising and no tracking cookies, and we do not build profiles of visitors. The only cookies we set are the ones the service cannot work without, so we do not ask for cookie consent - none is required for those. All page assets are served from this domain, so opening a page does not disclose your address to any third party.

6. Legal basis

• Performing the service you asked for - art. 6(1)(b) GDPR. This covers processing your file and keeping an account if you create one.
• Our legitimate interest - art. 6(1)(f) GDPR - in keeping the service available and preventing abuse. This covers daily limits, rate limits and server logs. You may object to processing based on this ground; write to the address in section 1.

Providing any of these data is voluntary, but the service cannot run without the file you upload, and daily limits cannot be applied without the counters described above.

7. Who else sees the data

• Our hosting provider, which operates the server the service runs on: OVH Sp. z o.o. (Wrocław, Poland), with the server located in Warsaw, Poland. It acts on our instruction under a data processing agreement, and it does not use the data for anything of its own.
• Google Ireland Ltd., if and only if you choose to sign in - and then only to the extent of that sign-in. Google may process the sign-in outside the European Economic Area; such transfers are covered by the safeguards Google applies, including the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.

Files you upload are never sent to Google or to anyone else. They stay on our server until they are deleted.

We do not sell data, and we do not share it for anyone's marketing.

8. How long we keep things

9. Your rights

You have the right to access your data, to have them corrected or erased, to restrict processing, to object to processing based on our legitimate interest, and to receive your data in a portable form. To exercise any of these, write to the address in section 1.

You also have the right to complain to the supervisory authority - in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa).

Note that for a file already deleted there is nothing left to access, correct or erase - which is the point of deleting it after 24 hours.

10. Children

The service is not intended for people under 16 and we do not knowingly process their data. If you believe a child has used it, write to the address in section 1 and we will delete what remains.

11. Automated decision-making

The service fills in missing values automatically, which is the point of it. It does not make decisions about you, and it produces no legal effects concerning you.

12. Changes

If this policy changes, the updated version appears here with a new date. For changes that affect you materially we will say so on the site rather than relying on you to notice.

Terms of Service