Privacy policy

The controller of your personal data is Kamil Tomaszuk, trading as Let’s Project.

Controller details:

• NIP: 9151703230
• REGON: 542859530
• Company register (KRS): not applicable
• address: ul. Stanisława Piaskowskiego 39, 55-100 Trzebnica, Poland
• email: kontakt@letsproject.pl

For matters relating to personal data protection, you can contact the controller at: kontakt@letsproject.pl.

We collect personal data when you:

• submit a contact form
• send your process mini-assessment result for analysis
• contact us by email or telephone
• sign in to Pomodoro through Google or Smartsheet, configure the timer and sheets, or save tasks or focus sessions
• voluntarily subscribe to our newsletter
• use the website and our technical systems record basic operational information such as server logs

We do not collect data through analytics, marketing or advertising cookies. See section 11 for details.

Contact form

When you use a contact form, we may process:

• full name
• company name
• email address
• a description of the process you wish to discuss
• the number of people or departments involved in the process, if provided
• the date the form was submitted
• the address of the page from which the form was submitted
• technical information needed to handle the form and prevent abuse

Process mini-assessment

If you send your process mini-assessment result for analysis, we may process:

• first name
• email address
• telephone number, if provided
• company or department name, if provided
• answers provided in the mini-assessment
• mini-assessment score
• process category scores and identified weakest areas
• the date the form was submitted
• the address of the page from which the form was submitted
• technical information needed to handle the form and prevent abuse

Pomodoro — account and integrations

You sign in through Google or Smartsheet. We receive your email address, profile name and account identifier from your chosen provider. The application database stores these details, your sign-in provider, internal account identifier, creation date, timer settings and sheet connections. Google and Smartsheet accounts are separate Pomodoro accounts, even if they share the same email address.

These details identify your account, restore your settings and support your chosen integration. The database also stores encrypted integration access tokens, including refresh tokens, and permission information.

• Google: the application requests account identification, email address and basic profile information, plus access to files created by the application or explicitly shared with it. This permission includes creating, reading, editing and deleting those files; it does not grant general access to your entire Google Drive. Pomodoro uses it to work with your connected Google Sheets spreadsheet.
• Smartsheet: the application requests permission to read and modify sheet data and create sheets. Permissions cover sheets available to your account within your access rights, rather than only sheets selected in Pomodoro. Access also includes attachments and discussions, although Pomodoro features use task and session cell data.

You create or connect sheets using the relevant application feature. Signing in alone does not create a sheet. You can revoke application access in your provider’s account settings.

Pomodoro — tasks and focus sessions

The application handles task content, completion and session data: task name, outcome notes, category, focus rating, start and end times, and planned and actual session length. Data passes through the Pomodoro server and is saved in the user’s connected Google Sheets or Smartsheet sheets. The application reads saved sessions to display them in the interface. Data does not remain solely on your device.

Pomodoro — planned account statistics

We are preparing an account statistics feature. It was not active on the date this policy was updated. The following describes the planned extension.

Once launched, the application database is intended to store the last sign-in date, sign-in count and saved session data: start, end, length and save date. A private administrative Smartsheet sheet is intended to receive:

• internal account identifier, email address and sign-in provider
• account creation date, last sign-in and sign-in count
• number of saved sessions, total focus minutes and date of the last saved session
• whether a session sheet connection is configured — without checking whether the sheet remains accessible
• newsletter subscription request status, consent submission date and consent version

Statistics will be linked to the account and email address, so they will not be anonymous. They will not include task names, notes or focus ratings. The administrator’s sheet will be separate from user sheets and will not be a mailing list.

Pomodoro — planned newsletter subscription

Signing in to or using Pomodoro does not imply newsletter consent. The planned subscription feature, not yet active, will require separate, voluntary consent and confirmation through an email link in the existing Let’s Project newsletter system.

An invitation may appear after sign-in, no more than once every 30 days per account. This interval concerns displaying the invitation, not sending newsletters. Dismissing it does not subscribe you. After a subscription request is successfully submitted, the application will not repeat the invitation.

The newsletter system is intended to receive the signed-in account’s email address, confirmation of consent, consent text and version, and the date and source of the request. Pomodoro is intended to record the consent text, version and submission date, request status and information about displaying or dismissing the invitation.

A record of submitting a request will not confirm a subscription. Confirmations and cancellations will be handled outside Pomodoro in the newsletter system; the planned integration does not send these updates back to Pomodoro. Newsletter consent does not automatically cover the other operations described in this policy.

Pomodoro — planned service enquiries

We are also preparing a voluntary option to express interest in Let’s Project services. Email contact with a service offer will require separate consent, independent of newsletter subscription or timer use. For this purpose, we will use the email address supplied in the service enquiry form.

Creating an account, signing in or saving a session will not imply consent to sales contact. Refusing or withdrawing consent will not limit Pomodoro use. You will be able to withdraw consent by contacting the controller at kontakt@letsproject.pl.

Email or telephone contact

If you contact us directly, we may process information contained in your message or provided during the conversation, particularly:

• full name
• email address
• telephone number
• company name
• job title or department
• correspondence content
• information about the process, project or business needs you describe

Technical data

When you use the website or submit forms, basic technical information may be recorded, particularly:

• IP address
• event date and time
• address of the visited page
• browser and device type
• error or security event information

Technical data supports website maintenance, error diagnosis, security and abuse prevention.

The following covers forms, contact, business relationships, the existing newsletter and the Let’s Project information website. These periods do not determine retention of Pomodoro accounts or statistics.

We send the Smartsheet newsletter only to people who subscribe themselves and confirm through an email link (double opt-in). The “Sending the Smartsheet newsletter” row above describes this processing. We do not use information from other forms for mass newsletter distribution or advertising profiling.

Pomodoro — planned backups

Our policy is to back up Pomodoro data daily and retain each backup for a maximum of 30 days after creation. Implementation of this schedule and retention limit was not complete on the date this policy was updated.

This period applies to backups managed by the controller. It does not determine retention of active accounts, data in user sheets or copies retained by Google Sheets and Smartsheet providers.

Providing data is voluntary, but some information is needed to respond to an enquiry or analyse a mini-assessment result.

The contact form requires information needed to contact you and understand the issue: full name, company name, email address and process description.

The mini-assessment requires a first name and email address so we can return an interpretation of the result. Telephone number and company or department are optional.

If you do not provide required information, submitting the form or receiving a response may not be possible.

A Pomodoro account requires signing in through one of the providers. Sheet access is necessary to save and read tasks and sessions. Newsletter subscription is voluntary; refusing or withdrawing consent does not limit Pomodoro use.

Personal data may be shared with organisations that help us operate the website, handle forms, communicate and conduct business. These may include:

• website hosting providers
• email service providers
• providers of form handling, automation and request delivery tools, including infrastructure at n8n.letsproject.pl
• providers of IT tools used to organise work and communication
• accounting, legal, administrative or technical service providers
• public authorities or authorised bodies where disclosure is required by law

Organisations processing data on our behalf do so under appropriate agreements and only to the extent necessary to provide their services.

In Pomodoro, data is also shared with your chosen sign-in and integration provider: Google for Google Sheets or Smartsheet for Smartsheet sheets. Information in your sheets is accessible according to their sharing settings, including to people granted sheet access.

Pomodoro uses Amazon Web Services to manage keys for encrypting integration tokens. Once the described extensions are launched, Smartsheet is also intended to receive account summaries in the administrator’s sheet, and the existing newsletter system will receive voluntary subscription requests from Pomodoro.

As a general rule, we aim to use solutions that process data within the European Economic Area.

Where using a technical tool involves transferring data outside the European Economic Area, the transfer uses GDPR safeguards, particularly a European Commission adequacy decision or standard contractual clauses.

In connection with personal data processing, you have the following rights:

• the right of access
• the right to rectification
• the right to erasure
• the right to restriction of processing
• the right to data portability, where applicable
• the right to object to processing based on the controller’s legitimate interests
• the right to withdraw consent at any time without affecting the lawfulness of earlier processing (including newsletter subscription)
• the right to lodge a complaint with the President of the Polish Personal Data Protection Office

Where processing is based on the controller’s legitimate interests, you may object on grounds relating to your particular situation. No reasons are required when objecting to marketing activities.

To exercise your rights, email us at: kontakt@letsproject.pl.

You may also lodge a complaint with the President of the Polish Personal Data Protection Office. The supervisory authority’s contact details are available at: uodo.gov.pl/pl/p/kontakt.

For Pomodoro data, contact the controller at the address above. Signing out and revoking provider access do not delete your Pomodoro account or information saved in sheets.

In the planned statistics feature, deleting an account from the database will not automatically delete its copy in the administrator’s sheet. Erasure requests will need to address this copy separately. Deleting a goal from the browser also does not delete a task previously saved in your sheet.

You can unsubscribe from the newsletter using the link in an email. In the planned integration, a record of submitting a subscription request will remain separate from the current subscription status in the newsletter system.

We do not make fully automated decisions about you that produce legal effects or similarly significantly affect you.

The process mini-assessment calculates a score automatically from your answers. The score is informational and advisory. It supports an initial assessment and possible interpretation; it is not a legal, financial or employment decision or a binding assessment of a business.

We do not use form data for advertising profiling.

We use organisational and technical measures to protect personal data against unauthorised access, loss, alteration or unlawful disclosure.

Only people and organisations that need access to handle enquiries, maintain the website, provide services or meet legal obligations can access the data.

Pomodoro integration tokens are stored encrypted in the database. Token encryption does not mean that all account data, statistics or sheet content is encrypted by the application in the same way.

On the date this Privacy Policy was last updated, the website did not use analytics, marketing or advertising cookies.

We do not currently use Google Analytics, Google Tag Manager, Meta Pixel, Hotjar, Microsoft Clarity, Matomo, PostHog, Plausible or similar tracking tools.

The website may generate technical server logs needed for security and correct operation. Server logs are not cookies.

Pomodoro sign-in session

Pomodoro uses a technical cookie to support sign-in and maintain your session. It expires 30 days after being set or renewed by the application. Signing out removes the session cookie. You can delete or block it in your browser settings; blocking prevents normal sign-in. The cookie’s expiry does not determine retention of accounts, statistics or sheet data.

Pomodoro browser storage

Pomodoro stores sound settings (mute and volume), automatic next-session settings, goals and tasks in browser localStorage: content, planned session count, completion status and sheet-row links. The application does not set an automatic expiry or daily reset. Information remains until changed or deleted in the application, or until you or the browser clear site data.

This information is associated with the browser and application address, not an individual Pomodoro account. Signing out does not clear it; it may remain visible to the next person using the same browser profile. Clearing browser storage does not delete information previously sent to the server or sheets.

If we add other cookies, analytics tools, advertising pixels, chat, maps, embedded iframes or other external technologies, we will update this Privacy Policy and implement an appropriate consent mechanism where required.

The website may contain links to external websites or services. We are not responsible for their owners’ privacy practices. Read the relevant privacy policy before providing data on an external website.

This Privacy Policy may be updated, particularly if website operation, the scope of data processing, technical providers or legal requirements change.

The current Privacy Policy will be available on the Let’s Project website.