Updated 13 November 2026
Privacy policy
We collect as little as we can, and only to answer you and do the work you ask us for.
Who is responsible
Undersite is the controller of your personal data. Contact: hello@undersite.app.
What we collect and why
| What | Why | Legal basis (GDPR) | How long |
|---|---|---|---|
| What you send through the form: name, work email, company, role, what you write about your campus | To reply, prepare a quote and agree the work | Steps you ask for before a contract, Art. 6(1)(b); our legitimate interest in answering business enquiries, Art. 6(1)(f) | 24 months after our last contact, or longer if we work together and the law requires us to keep records |
| Your work email and team membership, when you sign in to a team project | To let you into your team's projects and show who changed what | The contract, Art. 6(1)(b) | While your team's licence runs; deleted within 30 days after it ends or when your team's owner removes you |
| Emails you send us | To reply and keep a record of what was agreed | Art. 6(1)(b) and (f) | As above |
| Models and documents you send for a review | To do the review | The contract, Art. 6(1)(b) | Deleted within seven days of the report; for ongoing coordination, within 30 days after the contract ends |
| Visits to undersite.app: pages seen, country, browser type, counted without cookies and without identifying you | To know which pages are useful | Legitimate interest, Art. 6(1)(f) | Aggregated by our hosting provider |
The app
The app keeps your models, conflicts and settings in your own browser. We do not receive them. If you share a project to read, it is locked with your passcode before it leaves your browser, and we cannot open it. See where your data lives.
Cookies
The site sets no cookies and uses no advertising or tracking tools. The site and the app keep a few settings in your browser's own storage, such as light or dark look and your projects; they never leave your browser.
Who else processes the data
Our hosting provider (site, app, storage, email forwarding, statistics), our database provider, our email sending provider and our mailbox provider process data for us under data processing agreements. We name them on request. Some of them are in the United States; transfers rely on the EU-US Data Privacy Framework where the provider is certified, and on the European Commission's standard contractual clauses otherwise. We do not sell personal data and do not share it with anyone else unless the law requires us to.
Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict how we use it, to move it to someone else, and you can object to how we use it on the basis of legitimate interest. Write to hello@undersite.app; we answer within one month. You can also complain to the Polish data protection authority, Prezes Urzędu Ochrony Danych Osobowych (uodo.gov.pl), or to the authority where you live or work.
Changes
If we change this policy, we change the date at the top. If a change matters for you, we tell you by email.