Woala privacy policy

In force from: 14 October 2026. This English text is a translation; the Polish version is binding.

1. Who is responsible for your data

The controller is BRAIN BRICKS Prosta Spółka Akcyjna, ul. Hoża 29, 00-521 Warszawa, Poland, KRS 0001144292, NIP 7011239062, REGON 540420132 ("we").

Contact for everything, including personal data: kontakt@woala.pl

We have not appointed a data protection officer (DPO).

2. What this policy covers

It covers three services:

• the website woala.pl with product information (the "website"),
• the Woala app for showroom staff, at woala.pl/app (the "app"),
• pages that showrooms share with their customers, at woala.pl/s/ followed by the link code, opened without signing in (the "share page").

Woala is a tool for curtain showrooms. A salesperson photographs a customer's window, picks a fabric from the showroom's catalogue and a sewing style, and the app prepares an illustrative picture (visualisation). The showroom can show it to the customer through a link.

For some data we are the controller. For other data we are a processor acting for the showroom. The split is explained below.

3. Website visitors

When you open the website or a share page, technical data is recorded: IP address, browser user agent, time and requested address. It is recorded by our hosting provider's logging system.

• Purpose: security of the service and diagnosing faults.
• Legal basis: our legitimate interest, Article 6(1)(f) GDPR.
• Retention: 30 days.

We use no analytics and no advertising or tracking cookies. We embed no third-party content. Fonts are served from our own server.

4. Contact by e-mail

The website has no contact form. The "Book a demo" button opens the visitor's own e-mail program with a message to kontakt@woala.pl. The website does not store anything from that message.

When someone writes to us, we process what the message contains and the sender's e-mail address. Messages are kept in our mailbox, which is hosted by OVH.

• Purpose: answering the message and arranging a demo.
• Legal basis: steps taken at the person's request before entering into a contract, Article 6(1)(b) GDPR, and our legitimate interest in handling correspondence, Article 6(1)(f) GDPR.
• Retention: until the matter is closed, at most 12 months. If a contract follows, we keep the data as described in section 6.
• Writing to us is voluntary. Without an e-mail address we cannot reply.

5. Cookies

We use two cookies only.

• locale remembers the language. We set it only if the visitor switches the language. It is a functional cookie.
• The app sign-in cookie. It is a session cookie, strictly necessary for the app, HttpOnly, valid for 12 hours. We set it only when you sign in.

We use no other cookies. You can delete cookies in your browser settings. After deleting the sign-in cookie you must sign in again.

6. App users (showroom staff)

We are the controller of the data of people who have accounts in the app. The account data is given by the user or by the person who creates the account in their showroom.

We process:

• name, e-mail address, role and showroom, and a password stored only as a one-way hash (it cannot be read back),
• security and audit logs,
• usage records used for billing (the number of pictures delivered).

Purposes and legal bases:

• providing the app to the showroom and billing: the contract with the showroom, Article 6(1)(b) GDPR,
• security and product improvement: our legitimate interest, Article 6(1)(f) GDPR,
• accounting: legal obligation, Article 6(1)(c) GDPR.

Retention: account data and logs for as long as the account is used and for up to 90 days after the contract ends. Accounting documents for as long as the law requires (usually 5 years from the end of the year in which the tax obligation arose). Security and audit logs: for the term of the contract and up to 3 years after it ends, for possible claims.

Without this data an account cannot be created and the app cannot be used.

7. Feedback in the app

A user can send us a note from the app. A note contains the text written. It can optionally carry a screenshot (on by default, can be switched off) and a description of the screen shown: the screen, the order's settings, the ids on screen, and the related room photo.

A screenshot and description may therefore contain what was on screen, including a showroom customer's room photo and the customer's name or label. If you do not want to send such data, switch the screenshot off and do not describe customers in the note.

Notes are stored in our database. Every day an automated assistant running on Anthropic's platform reviews them. A summary is e-mailed to the company's founder.

• Purpose: handling notes and improving the product.
• Legal basis: our legitimate interest, Article 6(1)(f) GDPR.
• Retention: up to 24 months from when the note was sent.

8. Showroom customers

When a showroom photographs a customer's window in the app, the showroom is the controller of the room photo and of the customer's name or label as entered by the showroom. We act as processor for it, under a data-processing agreement.

People concerned should contact the showroom, including about their rights. We will pass on to the showroom any request that reaches us.

Rules we apply in the app:

• room photos should not show people,
• share links are valid for 7, 30 or 90 days, as the showroom chooses, and we delete them 30 days after they expire or are switched off,
• a deleted customer session is removed together with its pictures after a short grace period (by default 24 hours),
• uploads not used within a day are deleted.

The logs of opening a share page (section 3) are processed by us as controller.

9. Recipients

We use providers who help us run the service. They process data only to provide their service to us, under their terms for business customers.

Data may also reach bodies entitled by law and our advisers, such as accountants and lawyers, to the extent necessary.

10. Transfers outside the European Economic Area

OpenAI and Anthropic are based in the USA, so data sent to them leaves the EEA. We transfer it on the basis of the European Commission's standard contractual clauses and, where the provider is certified, the EU–US Data Privacy Framework. You can ask for a copy of the safeguards at kontakt@woala.pl.

11. Automated decisions

We make no decisions based solely on automated processing that have legal or similarly significant effects on anyone. The automated quality check judges pictures, not people.

12. Your rights

Where we are the controller, you have the right to:

• access your data,
• have it rectified,
• have it erased,
• restrict processing,
• data portability,
• object to processing based on our legitimate interest. We will consider it and stop processing unless we show compelling legitimate grounds.

We do not base any processing on consent.

To use your rights, write to kontakt@woala.pl. You can also complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa.

13. Changes to this policy

If we change how we process data, we will update this policy and its date.