🇵🇱
CKZ Pro

CKZ Pro

Privacy Policy

Last Updated: July 10, 2026

This Privacy Policy (pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 — "GDPR" — and the Polish Act of 10 May 2018 on the Protection of Personal Data) describes how personal data is processed in the CKZ Promobile application (the "App" or "Service").

The protection of your personal data is a priority for us. We process data lawfully, fairly, and transparently.

1. Data Controller

The data controller within the meaning of Art. 4(7) GDPR is:

MAtechnologies sp. z o. o.
ul. Walowa 14c, 51-523 Wrocław, Poland
Email: support@matechnologies.eu

No Data Protection Officer (DPO) has been appointed, as the conditions of Art. 37 GDPR are not met. For privacy-related matters, please contact us at the email address above.

2. Legal Bases for Processing

We process personal data only to the extent necessary to provide a functional App and related services. The legal bases are:

  • Art. 6(1)(a) GDPR (Consent): where we require your consent for specific processing (e.g. camera access).
  • Art. 6(1)(b) GDPR (Performance of Contract): where processing is necessary for the performance of a contract or pre-contractual steps (e.g. App features, account management, purchase verification and entitlement restoration).
  • Art. 6(1)(c) GDPR (Legal Obligation): where processing is required by law (e.g. tax or accounting obligations).
  • Art. 6(1)(f) GDPR (Legitimate Interest): where processing is necessary for our legitimate interests, unless overridden by your interests, rights, and freedoms (e.g. App stability, security, and improvement).

You are not legally or contractually required to provide personal data, except for data technically necessary to operate the App and process purchases via distribution platforms.

3. Data Processing when Using the App

a) Camera and Question Analysis

To provide the core functionality of CKZ Pro, the App requires access to your device's camera to scan exam questions.

  • Processed Data: images/photos of questions captured by the camera.
  • Third-Party Processing (DeepSeek V4 via OpenRouter): Questions and related data are transmitted securely to the DeepSeek V4 API via OpenRouter for analysis and answering. This data is used solely to fulfill the request and is not used by us for marketing purposes or for training AI models.
  • Storage: We do not record or permanently store video streams. Data sent to the API is processed for the immediate query only.
  • Purpose: identifying exam questions and providing answers and explanations.
  • Legal Basis: performance of contract (Art. 6(1)(b) GDPR) and — for camera access — consent (Art. 6(1)(a) GDPR).

b) Account Data (Supabase)

If you create an account to save your history or preferences, we use Supabase to securely store authentication credentials and account data.

  • Processed Data: user ID, login data (e.g. Apple ID or other linked third-party account), saved logs and preferences in the App.
  • Purpose: authentication, account management, and user data synchronization.
  • Legal Basis: performance of contract (Art. 6(1)(b) GDPR).
  • Retention: until account deletion by the user or termination of the contract, subject to legal obligations.

c) Usage Data and Diagnostics

When using the App, technical data necessary for operation and security may be collected automatically, including:

  • device information (model, OS version, unique identifiers);
  • App information (version, performance data);
  • IP address (if collected, in anonymized or pseudonymized form);
  • crash reports (if transmitted by the operating system).
  • Purpose: ensuring stability, troubleshooting, and abuse prevention.
  • Legal Basis: legitimate interest (Art. 6(1)(f) GDPR).

4. In-App Purchases, Entitlements, and Payment Management

In-app purchases and subscriptions are processed via Apple (App Store) and Google (Google Play). We do not collect or store payment information (such as credit card or bank account details).

To verify Premium status, manage anonymous entitlements, and handle subscriptions, we use RevenueCat (RevenueCat, Inc., 1250 45th St. Suite 270, Emeryville, CA 94608, USA).

  • Processed Data: transaction ID, purchase date, subscription status, and an anonymous/pseudonymous user identifier used to assign entitlements to the store account.
  • Purpose: verifying Premium purchases, managing entitlements, and restoring access across the user's devices.
  • Legal Basis: performance of contract (Art. 6(1)(b) GDPR).
  • Third-Country Transfer: RevenueCat processes data in the USA. Transfers are based on EU Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework to ensure an adequate level of data protection.

5. Disclosure of Data to Third Parties

We do not sell your personal data. We may share personal data only in the following cases:

  • Supabase, Inc.: backend database hosting and user authentication.
  • OpenRouter / DeepSeek V4 API: question analysis and answer generation.
  • Apple Inc.: payment processing and App distribution via the App Store.
  • Google LLC: payment processing and App distribution via Google Play.
  • RevenueCat, Inc.: subscription management, purchase verification, and anonymous entitlements.
  • Public authorities: when required by law or a valid court order (Legal Basis: Art. 6(1)(c) GDPR).
  • With your consent: for any other purpose with your specific consent.

The listed providers act — depending on the case — as processors under Art. 28 GDPR or as independent controllers for the services they provide.

6. Transfers to Third Countries

Some of our providers (including RevenueCat, OpenRouter/DeepSeek, and — depending on configuration — Supabase) may process data outside the European Economic Area, in particular in the USA. In such cases, we ensure an adequate level of protection through EU Standard Contractual Clauses and other mechanisms under GDPR Chapter V.

7. Data Retention Period

We retain personal data only for as long as necessary to achieve the purposes for which it was collected, unless longer retention is required by law (e.g. tax or accounting obligations — typically up to 5 years from the end of the tax year in which the obligation arose). After that period, data is deleted or irreversibly anonymized.

Account data is retained until the account is deleted in the App. Images sent to the DeepSeek V4 API are not permanently stored by us.

8. Your Rights as a Data Subject

You have the following rights under the GDPR. To exercise them, contact us at the address in Section 1:

  • Right of Access (Art. 15 GDPR): obtain information about and a copy of your processed data.
  • Right to Rectification (Art. 16 GDPR): request correction of inaccurate or completion of incomplete data.
  • Right to Erasure (Art. 17 GDPR): request deletion of data, unless legal retention obligations apply.
  • Right to Restriction (Art. 18 GDPR): request restriction of processing in cases provided by law.
  • Right to Data Portability (Art. 20 GDPR): receive data in a structured, commonly used format, where applicable.
  • Right to Object (Art. 21 GDPR): object to processing based on legitimate interest.
  • Right to Withdraw Consent (Art. 7(3) GDPR): withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
  • Right to Lodge a Complaint (Art. 77 GDPR): file a complaint with a supervisory authority.

If you reside in Poland, you may lodge a complaint with the President of the Personal Data Protection Office (UODO) — ul. Stawki 2, 00-193 Warsaw, website: uodo.gov.pl.

We will respond to requests without undue delay and within one month of receipt, extendable by two further months in complex cases, pursuant to Art. 12 GDPR.

9. No Automated Decision-Making

We do not make decisions about you based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR.

10. Children's Privacy

The Service is not directed at persons under 16 years of age. Under Art. 8 GDPR and Polish law, consent for processing data in connection with the direct offer of information society services may be given by a person who has reached the age of 16.

We do not knowingly collect personal data from anyone under 16. If you are a parent or legal guardian and believe your child has provided us with personal data, please contact us and we will take steps to delete it.

11. Links to Other Websites

The Service may contain links to third-party websites not operated by us. We encourage you to review the privacy policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies, or practices of third-party sites or services.

12. Changes to this Privacy Policy

We may update this Policy to reflect legal or service changes. For material changes, we will inform you via the App or other appropriate means before they take effect. The "Last Updated" date at the top indicates the current version.

13. Contact Us

For questions about this Policy or to exercise your rights, email us at: support@matechnologies.eu