PRIVACY POLICY - COUNTIN

Effective Date: February 7, 2026
Version: 1.0

1. GENERAL INFORMATION

1.1 Data Controller

The data controller for personal data collected through the CountIn Service is:

Optimum Paweł Kowalski
Address: ul. Pozytywistów 4/4, 20-639 Lublin, Poland
Tax ID (NIP): 712-031-17-46
REGON: 430325730
Contact Email: [email protected]

1.2 Purpose of This Document

This Privacy Policy explains: - What personal data we collect - For what purposes we process it - How long we store it - What rights you have

1.3 Legal Basis

Personal data processing is carried out in accordance with: - GDPR Regulation (EU 2016/679) - Data Protection Act - Telecommunications Law

2. WHAT DATA WE COLLECT

2.1 Automatically Collected Data

The Service DOES NOT REQUIRE registration. We automatically collect minimal technical data:

1. IP Address
   • Purpose: security, statistics
   • Legal basis: legitimate interest (Art. 6(1)(f) GDPR)
   • Retention: 30 days in server logs
2. Browser Information
   • Operating system, browser type, version
   • Purpose: Service optimization
   • Legal basis: legitimate interest
3. Cookies and localStorage
   • See section 4 "Cookies"

2.2 Voluntarily Provided Data

When purchasing Export credits:

1. Email address
   • Purpose: sending purchase confirmation, communication
   • Legal basis: contract performance (Art. 6(1)(b) GDPR)
   • Retention: 5 years (tax requirement)
2. Payment data
   • Processed by Stripe (payment operator)
   • Controller DOES NOT store payment card data
   • Stripe operates in compliance with PCI DSS
3. Country of residence
   • Purpose: proper VAT calculation
   • Legal basis: legal obligation (Art. 6(1)(c) GDPR)

When contacting us:

• Email, message content
• Purpose: providing response, technical support
• Legal basis: consent or legitimate interest

2.3 Audio Files

Important: Your audio files are processed locally in your browser.

1. Preview generation – entirely local, no server upload
2. Audio analysis (BPM, waveform) – entirely local
3. Export – file is uploaded temporarily for processing and deleted immediately after

2.4 Data We DO NOT Store

1. Your original audio files – processed locally, not stored on server
2. Generated count-in audio – created locally in your browser
3. Listening history – no registration = no history
4. Payment card data – processed by Stripe, does not reach us

3. PURPOSE AND LEGAL BASIS FOR PROCESSING

3.1 Service Delivery

Purpose: Enabling use of count-in generation tool
Legal basis: Contract performance (Art. 6(1)(b) GDPR)
Data: localStorage settings, IP

3.2 Payment Processing

Purpose: Processing export credit purchases
Legal basis: Contract performance (Art. 6(1)(b) GDPR)
Data: Email, payment data (Stripe), country

3.3 Tax Obligations

Purpose: Invoice issuance, VAT settlement
Legal basis: Legal obligation (Art. 6(1)(c) GDPR)
Data: Email, country, transaction data
Period: 5 years

3.4 Security

Purpose: Protection against abuse, attacks, spam
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)
Data: IP, activity logs
Period: 30 days

4. COOKIES

For detailed information about cookies, please see our Cookies Policy.

4.1 Summary

We use minimal cookies:

• Essential cookies – required for Service operation
• localStorage – storing your preferences (BPM, sound settings)

We do NOT use tracking or advertising cookies.

5. DATA SHARING

5.1 Data Recipients

Your data may be shared with the following entities:

1. Stripe (USA) - Purpose: Payment processing - Scope: Payment data, email - Safeguards: Standard Contractual Clauses (SCC), PCI DSS certification - Policy: stripe.com/privacy

2. Cloudflare (USA) - Purpose: CDN, security, hosting - Scope: IP address, technical data - Safeguards: Standard Contractual Clauses - Policy: cloudflare.com/privacypolicy

5.2 Transfers Outside EEA

Some providers are located outside the European Economic Area. We apply appropriate safeguards: - Standard Contractual Clauses approved by the European Commission - Security certifications (PCI DSS, SOC 2)

5.3 No Sale of Data

We DO NOT sell or DO NOT share your personal data with third parties for marketing purposes.

6. YOUR RIGHTS

6.1 Right of Access (Art. 15 GDPR)

You have the right to obtain information about: - What data we process about you - For what purpose - To whom we share it - How long we store it

How to exercise: Send an email to [email protected]

6.2 Right to Rectification (Art. 16 GDPR)

You can request correction of incorrect data.

6.3 Right to Erasure – "Right to be Forgotten" (Art. 17 GDPR)

You can request deletion of your data if: - They are no longer needed for the purposes for which they were collected - You have withdrawn consent - Data was processed unlawfully

Exceptions: We will not delete data if we must retain it for legal reasons (e.g., invoices for 5 years).

6.4 Right to Restriction of Processing (Art. 18 GDPR)

You can request suspension of data processing in certain situations.

6.5 Right to Data Portability (Art. 20 GDPR)

You can receive your data in CSV or JSON format and transfer it to another service.

6.6 Right to Object (Art. 21 GDPR)

You can object to data processing based on legitimate interest.

6.7 Right to Withdraw Consent (Art. 7 GDPR)

If we process data based on consent (e.g., cookies), you can withdraw it at any time.

6.8 Right to Lodge a Complaint

If you believe we process data unlawfully, you can file a complaint with the supervisory authority in your country.

7. DATA SECURITY

7.1 Technical Measures

We apply appropriate security measures:

1. SSL/TLS Encryption – HTTPS connection
2. Local Processing – audio processed in your browser
3. Minimal Data Collection – we don't store what we don't need
4. Secure Payments – handled by PCI DSS certified Stripe

7.2 Security Incidents

In case of data security breach: 1. We will notify the supervisory authority within 72 hours (if required) 2. We will notify you if the breach may result in high risk to your rights

8. DATA RETENTION PERIOD

9. CHILDREN'S DATA

The Service is not intended for persons under 16 years of age.

If you are a parent and suspect your child has provided us with data, please contact us – we will delete it immediately.

10. CHANGES TO PRIVACY POLICY

10.1 Updates

We may update the Privacy Policy in case of: - Changes in legislation - Introduction of new features - Change of service providers

10.2 Notification of Changes

We will inform about significant changes through: 1. Announcement on Service – banner on homepage 2. 14 days advance notice – before taking effect

11. CONTACT

Email: [email protected]
Address: ul. Pozytywistów 4/4, 20-639 Lublin, Poland

Response Time

• For access/deletion requests: up to 30 days
• For general questions: up to 3 business days

SUMMARY

Key points in brief:

✅ We collect minimal data – email only when purchasing
✅ Audio is processed locally in your browser
✅ We DO NOT store your audio files
✅ We DO NOT sell personal data
✅ You can delete your data at any time
✅ We use encryption and secure providers

Last Updated: February 7, 2026
Version: 1.0

Questions? Write to: [email protected]