Privacy Policy
1. Controller
For any privacy matter, write to [email protected].
This policy covers the website thelion.app and the web applications (SaaS) and mobile apps published under the brand The Lion App Studio. We follow the General Data Protection Regulation (EU) 2016/679 (“GDPR”).
2. Our approach in short
- Content you enter in our mobile apps is stored on your device. Our web applications keep your account and content on our servers so the service can work, as described below.
- We do not sell your data and do not use advertising trackers.
- We process only what is needed to sell subscriptions, answer messages and keep accounting records.
3. What data we process, why and for how long
| Situation | Data | Purpose and legal basis | Retention |
|---|---|---|---|
| Using a mobile app | Content you enter (entries, settings): stored locally on your device | Not processed by us. You can delete it at any time by deleting the data in the app or uninstalling it. | On your device, until you delete it |
| In-app subscription (App Store / Google Play) | Random app user ID, subscription status, product, country, transaction ID and dates. We do not receive your name or card details. | Providing Premium and handling the subscription: performance of the contract (Art. 6(1)(b) GDPR); accounting: legal obligation (Art. 6(1)(c)). | For the duration of the subscription, then as required by tax law (5 years from the end of the tax year) |
| Purchase on our website (Stripe) | Name, e-mail, billing country/address, payment method type, last 4 digits of the card, order details. Full card details are handled by Stripe only. | Concluding and performing the contract (Art. 6(1)(b)); invoices and accounting (Art. 6(1)(c)); fraud prevention and handling claims: legitimate interest (Art. 6(1)(f)). | Contract duration, then 5 years from the end of the tax year; claims: until they become time-barred |
| Contacting us by e-mail | E-mail address, name (if given), content of the message | Answering your message and support: legitimate interest (Art. 6(1)(f)) or steps related to a contract (Art. 6(1)(b)). | Up to 3 years after the conversation ends |
| Using a web application (SaaS) | E-mail, name (if given), login data, content you create in the service, technical usage logs | Providing the service under the contract (Art. 6(1)(b)); security and abuse prevention: legitimate interest (Art. 6(1)(f)). | While your account exists, then up to 30 days in backups; billing records as required by tax law |
| Visiting the website | IP address, browser type, time of request (technical logs of our hosting provider) | Security and delivery of the website: legitimate interest (Art. 6(1)(f)). | Short-term, according to the hosting provider's log settings |
| Crash reports | Anonymous technical crash data shared by Apple or Google only if you allowed it in your device settings | Fixing errors: legitimate interest (Art. 6(1)(f)). | As set by Apple / Google |
Providing data is voluntary, but without data needed for a purchase we cannot sell you a subscription. We do not make decisions based solely on automated processing that produce legal effects for you.
4. Who receives the data
We share data only with providers that help us run the Services, under data processing agreements or as independent controllers:
- Stripe (Stripe Payments Europe, Ltd., Ireland): payment processing for website purchases;
- Apple and Google: app distribution and in-app payments (as independent controllers, under their own privacy policies);
- RevenueCat, Inc. (USA): management of in-app subscription status;
- Cloudflare, Inc.: website hosting and security;
- cloud hosting and database providers for our web applications;
- our e-mail hosting provider and accounting office;
- public authorities, when required by law.
5. Transfers outside the EEA
Some providers (e.g. RevenueCat, Cloudflare, Apple, Google, Stripe group companies) may process data in the USA or other countries outside the European Economic Area. In such cases transfers are based on the European Commission's adequacy decision (EU-U.S. Data Privacy Framework) for certified companies or on Standard Contractual Clauses. You can request a copy of the safeguards by writing to us.
6. Your rights
You have the right to access your data, rectify it, erase it, restrict processing, data portability, and to object to processing based on our legitimate interest. Where processing is based on consent, you may withdraw it at any time without affecting earlier processing. To exercise your rights, write to [email protected]. We reply within one month.
You also have the right to lodge a complaint with the supervisory authority: President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.
7. Cookies
Our website does not use analytics, marketing or advertising cookies. Our hosting provider may use strictly necessary technical cookies for security (e.g. bot protection), which do not require consent. Stripe's checkout pages use their own cookies, described in Stripe's privacy policy.
8. Children
Our apps are not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with data, contact us and we will delete it.
9. Security
We use appropriate technical and organisational measures, including encrypted connections (HTTPS), access control and selection of trusted providers.
10. Changes
We may update this policy when our Services or the law change. The current version is always available on this page with its effective date.