Privacy Policy

This Privacy Policy describes how Spotling Sp. z o.o. processes personal data in connection with the use of the MarketLyft service available at marketlyft.app. We are committed to processing your data in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Polish law.

1. Data Controller

The controller of your personal data is:

For all matters relating to personal data protection, please contact us at the e-mail address above.

2. Purposes and Legal Bases for Processing

We process your personal data for the following purposes and on the following legal bases:

3. Categories of Personal Data

Depending on how you use the service, we process the following categories of data:

• Identity data: first and last name, company name, VAT ID.
• Contact data: e-mail address, phone number, postal address.
• Billing data: payment card data (stored solely by Stripe), invoice address.
• Technical data: IP address, browser type, operating system, usage logs.
• Entrusted data (your customers' contacts): as an email marketing platform, you may upload your contacts (e-mail addresses, purchase data). In this scope we act solely as a data processor — see section 9.

4. Recipients and Sub-Processors

Your data may be shared with the following categories of recipients, only to the extent necessary:

• Stripe, Inc. (USA) — payment processor; handles card and billing data.
• Resend, Inc. (USA) — transactional e-mail provider (account verification, password reset).
• Server hosting provider — cloud infrastructure on which MarketLyft operates.
• Legal / accounting firm — to the extent required for legal and accounting services.
• Public authorities — where required by law (e.g. tax authorities, courts).

We have concluded a Data Processing Agreement (DPA) with each sub-processor in accordance with Art. 28 GDPR.

5. International Data Transfers

Some of our sub-processors (including Stripe and Resend) are based in the United States. Transfers to the USA take place under the European Commission's adequacy decision no. 2023/1795 (EU-US Data Privacy Framework) or — for entities not covered by that framework — on the basis of Standard Contractual Clauses (SCC) approved by Commission Decision 2021/914. You have the right to obtain a copy of the safeguards applied — contact us at [email protected].

6. Retention Periods

We retain your data for the period necessary to fulfil each processing purpose:

• Account data: for the duration of the contract and, after termination, until expiry of the limitation period for claims (3 or 6 years under Polish civil law).
• Invoices and accounting documents: 5 years from the end of the tax year in which the tax obligation arose (Polish Tax Code).
• Marketing data (newsletter): until consent is withdrawn.
• Technical and analytical logs: up to 13 months.
• Entrusted data (your customers' contacts): for the duration of the service; deleted promptly upon termination of the DPA.

7. Your Rights

Under the GDPR, you have the following rights:

• Right of access (Art. 15 GDPR) — you may request confirmation of whether we process your data and obtain a copy.
• Right to rectification (Art. 16 GDPR) — you may request correction of inaccurate or completion of incomplete data.
• Right to erasure ("right to be forgotten") (Art. 17 GDPR) — you may request deletion of data that is no longer necessary for the purposes for which it was collected.
• Right to restriction of processing (Art. 18 GDPR) — you may request restriction of processing in cases specified in the GDPR.
• Right to data portability (Art. 20 GDPR) — you may receive your data in a structured, commonly used format.
• Right to object (Art. 21 GDPR) — you may object to processing based on legitimate interest, including direct marketing.
• Right to withdraw consent — where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, contact us at [email protected]. We will respond without undue delay, and no later than 30 days.

8. Cookies

Our website uses cookies — small text files stored on your device. We use three categories:

• Essential — required for the service to function (user session, JWT token, security preferences). No consent required. Duration: session or up to 7 days.
• Functional — remember your preferences (e.g. last project, language). Duration: up to 12 months. Consent required.
• Analytical — help us measure traffic and improve the service (Google Analytics). Duration: up to 13 months. Consent required.

You can change cookie settings in your browser or via the cookie preferences panel in the service. Disabling essential cookies may prevent some features from working.

9. MarketLyft as a Data Processor (DPA)

As an email marketing platform, MarketLyft processes your customers' contact data (names, e-mail addresses, behavioural data) solely on your instructions. In this scope you are the data controller and Spotling Sp. z o.o. acts as the data processor within the meaning of Art. 28 GDPR. The terms of processing are governed by a separate Data Processing Agreement (DPA) available on request. Each MarketLyft project runs on isolated infrastructure — your customers' data is never shared with other users of the platform.

10. Data Security

We implement appropriate technical and organisational measures to protect personal data, including TLS/SSL encryption, access controls, regular backups, and isolation of each client's infrastructure (dedicated Docker containers). Access to personal data is limited to authorised personnel bound by confidentiality obligations. Despite these measures, no internet transmission can be guaranteed to be 100% secure.

11. Final Provisions and Policy Updates

This Privacy Policy takes effect on 10 March 2026. We reserve the right to amend it — in the event of material changes, we will notify you by e-mail or via a prominent notice in the service at least 14 days in advance. The current version is always available at marketlyft.app/privacy. Continued use of the service after the effective date of changes constitutes acceptance.

12. Contact

For all personal data matters, please contact us: