Privacy Policy
Version 1.0, effective from June 2026
1. Who We Are
The administrator of your personal data is Jakub Matjanowski, doing business as Isidore Software Jakub Matjanowski, ul. Pawia 19, 87-100 Toruń, Poland, NIP: 9562286058, REGON: 364620516 (hereinafter: "Administrator", "we", "us").
Contact email: support@lekk.io Correspondence address: ul. Pawia 19, 87-100 Toruń, Poland
2. What Data We Collect and Why
2.1. When You Purchase a PRO License
When you purchase a PRO License via Stripe, we receive the following information from Stripe:
- Email address
- Name (if provided during checkout)
- License type purchased (Individual or Company)
Purpose: To generate and deliver your License Key, send purchase confirmation, and provide customer support. Legal basis: Performance of contract (Article 6(1)(b) GDPR). Retention period: For the duration of the license validity plus 3 years for tax and accounting purposes.
2.2. When You Visit the Website (lekk.io)
The website is hosted on Cloudflare Pages. Cloudflare may collect standard web server logs:
- IP address (anonymized)
- Browser type and version
- Pages visited
- Date and time of visit
Purpose: Website analytics, security, and performance optimization. Legal basis: Legitimate interest (Article 6(1)(f) GDPR) in ensuring website security and performance.
We use PostHog — an open-source product analytics platform — to understand how visitors use our website. PostHog is hosted in the EU and is configured for privacy:
- No cross-site tracking or advertising cookies
- IP addresses are anonymized
- Person profiles are only created for identified users (e.g., after signing up)
- Session recordings are disabled by default
PostHog processes data on our behalf as a data processor. For details, see PostHog's privacy policy.
2.3. When You Contact Support
If you contact us via email, we collect:
- Your email address
- Any information you provide in your message
Purpose: To respond to your inquiry and provide support. Legal basis: Legitimate interest (Article 6(1)(f) GDPR) in communicating with users. Retention period: Up to 1 year after the inquiry is resolved.
3. The Application (Lekkio Desktop App)
The Lekkio desktop application:
- Does not collect or transmit any personal data without your consent.
- Does not require an internet connection for basic screenshot capture and annotation.
- Does not send usage statistics, telemetry, or analytics.
- License verification is performed locally on your device — no server communication is required to verify a license key.
- The application only communicates with external services when you explicitly choose to save images (no external services are used for saving).
4. Who We Share Your Data With
We share your data only with essential service providers:
| Service Provider | Purpose | Data Shared | Location |
|---|---|---|---|
| Stripe Payments Europe, Ltd. | Payment processing | Payment data (not stored by us), email | EU/USA (Privacy Shield) |
| Cloudflare, Inc. | Website hosting, CDN, security | IP address, website visit data | Global (DPF certified) |
| Resend, Inc. | License key email delivery | Email address, name | US (DPF certified, EU data residency available) |
| PostHog, Inc. | Website analytics | Anonymized page view data, browser metadata (EU-hosted) | EU (Frankfurt) |
We do not sell, rent, or share your personal data with third parties for their own marketing purposes.
5. Your Rights
Under applicable data protection law (including GDPR), you have the right to:
- Access your personal data — request a copy of the data we hold about you.
- Rectification — request correction of inaccurate data.
- Erasure — request deletion of your data ("right to be forgotten").
- Restriction of processing — request limited use of your data.
- Data portability — receive your data in a structured, machine-readable format.
- Object — object to processing based on legitimate interests.
- Withdraw consent — where processing is based on consent, you may withdraw it at any time.
To exercise any of these rights, contact us at support@lekk.io. We will respond within 30 days.
You also have the right to lodge a complaint with the Polish data protection authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa).
6. Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include:
- Encryption of data in transit (HTTPS/TLS)
- Use of cryptographic signing for license keys (Ed25519)
- Restricted access to production systems
- Cloudflare's security infrastructure
7. International Transfers
Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States, where some of our service providers (Stripe, Cloudflare, Resend) are based. Such transfers are safeguarded by:
- Standard Contractual Clauses (SCCs) adopted by the European Commission
- Stripe's, Cloudflare's, and Resend's DPF (Data Privacy Framework) certifications
- PostHog analytics data is hosted and processed exclusively within the EU (Frankfurt)
8. Cookies
The website (lekk.io) uses no cookies for analytics or tracking. PostHog operates without cookies for anonymous visitors. Cloudflare may set essential cookies required for the functioning of the CDN and security features. These are strictly necessary technical cookies.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email (if we have your email address) or via a notice on the website.
10. Contact
For any questions regarding this Privacy Policy or the processing of your personal data, please contact us:
Email: support@lekk.io Mail: ul. Pawia 19, 87-100 Toruń, Poland
This Privacy Policy has been created using the OpenTerms framework (https://go.creativa.legal/openterms).