WebsButler Panel privacy policy
PolskiEffective 31.10.2026. Covers the client panel at panel.websbutler.com and the WebsButler app (including the Microsoft Store version).
1. Who is responsible for your data
The data controller is Graphics Butler | Daniel Xhemalçe, ul. Skrzetuskiego 5A/1, 64-100 Leszno, Poland, NIP (tax ID) 6972405302, REGON 540826957 ("we"). Privacy contact: [email protected], phone +48 792 047 576.
The websbutler.com website has its own policy: websbutler.com/polityka-prywatnosci.
2. What we collect
- Account: name, e-mail address, phone, company details (name, tax ID, address), your password (stored only as a hash), and with Google sign-in: the e-mail address and name from your Google account.
- Services: your domains, websites, hosting and mailboxes, DNS settings, backups, files you upload to the panel.
- Payments: order, subscription and invoice history. Card details are handled by Stripe; we never see your full card number.
- Invoicing: invoices you issue in the panel with your customers' details (name, tax ID, address, e-mail) and, if you connect KSeF, your KSeF token or certificate.
- Connected mailbox: if you connect your own mailbox to send invoices or newsletters, its server address, login and password (encrypted).
- Newsletters and reviews: recipient lists you add and the campaigns you send.
- Google Business Profile: if you connect it, access to your business profile so the panel can show and update it.
- Technical data: IP address, browser and device type, sign-in times, error logs, and how you use the panel (see section 7).
- Contact: support chat messages and e-mails.
3. Why, and on what legal basis
| Purpose | Basis (GDPR) |
|---|---|
| Running your account and providing the panel's services (websites, hosting, mail, tools, invoicing) | Art. 6(1)(b) — contract |
| Payments, invoices and accounting | Art. 6(1)(b) and (c) — contract and legal obligation |
| Account and service notices (invoices, hosting, security) and the weekly website report | Art. 6(1)(b) and (f) — contract and legitimate interest |
| News about the panel (you can turn it off in My account → Notifications) | Art. 6(1)(f) — legitimate interest (direct marketing of our own services) |
| Security, abuse prevention, statistics and improving the panel | Art. 6(1)(f) — legitimate interest |
| Support, and establishing or defending legal claims | Art. 6(1)(f) — legitimate interest |
4. Your customers' and recipients' data
Data you enter about other people — buyers on invoices, newsletter recipients, people asked for a review — we process on your behalf and only to do what you ask the panel to do. For that data you are the controller and we are your processor (Art. 28 GDPR). You are responsible for having a legal basis to use it (for example newsletter recipients' consent). We will sign a data processing agreement with you on request.
5. Who we share data with
Only providers the panel cannot work without, and only what each needs for its task:
- VH.pl (Poland) — servers for the panel, websites and mail;
- Cloudflare (USA) — DNS, protection and speed for websites;
- Stripe (Ireland / USA) — payments and subscriptions;
- Google (USA) — Google sign-in, Google Business Profile, fonts;
- Lark / Larksuite — sending the panel's e-mails (notices, WebsButler invoices);
- Microsoft Clarity (USA) — usage statistics (section 7);
- Infomaniak (Switzerland), Titan, Hostinger — mailboxes and hosting, when your service runs on them;
- Polish Ministry of Finance — the national e-invoicing system (KSeF) when you send an invoice to it, and the VAT taxpayer list when a tax ID is checked;
- inFakt — only when you import your own invoices from it;
- DataForSEO and OpenStreetMap (Nominatim) — domain, keyword and business-address data for the SEO tools; no data about you as a person is sent to them;
- our accountants, and public authorities where the law requires it.
We do not sell data or share it for advertising.
6. Transfers outside the EEA
Some providers (e.g. Cloudflare, Stripe, Google, Microsoft, Lark) may process data outside the European Economic Area. This happens under a European Commission adequacy decision (e.g. the EU-US Data Privacy Framework, Switzerland) or the Commission's standard contractual clauses. Write to us for a copy of the safeguards.
7. Cookies and statistics
- Essential: your sign-in session, "remember me", form protection, chosen language and appearance. The panel does not work without them.
- Statistics: Microsoft Clarity records anonymously how the panel is used (clicks, scrolling) so we can improve it.
- The app keeps a copy of the panel's files on your device (a service worker) so it opens faster and can show an "offline" page. It holds none of your data.
8. How long we keep data
- Account and service data — while you use the panel; after the account is closed we delete or anonymise it, except what we must keep.
- Invoices and billing records — 5 years from the end of the tax year (Polish tax law).
- Technical logs — usually up to 90 days.
- Data needed for legal claims — until the limitation period ends.
9. Your rights
You have the right to access your data and get a copy, to rectify, erase, restrict or port it, to object to processing based on legitimate interest (including marketing), and to complain to the Polish data protection authority (UODO, uodo.gov.pl) or your local one. You can change most data yourself in the panel (My account). To delete your account or use any other right, write to [email protected]; we reply within 30 days.
10. Security
Connections are encrypted (HTTPS). Passwords are stored as hashes, and passwords and tokens for outside services (e.g. mailboxes, KSeF) are encrypted. Only people who need it to look after your account can access your data.
11. Children
The panel is meant for businesses and adults. We do not knowingly collect data from anyone under 16.
12. Changes
When we change this policy we update the date at the top, and we announce important changes in the panel or by e-mail.