Informational translation. This document is a translation provided for the convenience of English-speaking users. In the event of any discrepancies, the Polish version of the Privacy Policy, available at /polityka, shall prevail.

tippin' Privacy Policy

I. General Information

  1. This Privacy Policy sets out the rules for processing and protecting personal data of Users and Clients of the tippin' service.

  2. The data controller is Houda Tomasz Watras with registered office in Katowice, at ul. Żelazna 2, 40-851 Katowice, NIP 6292324622, REGON 521571765.

  3. Contact regarding personal data protection:

    • Email: kontakt@tippin.pl
    • Correspondence address: ul. Żelazna 2, 40-851 Katowice

  4. The Controller has appointed a Data Protection Officer, who can be contacted at: kontakt@tippin.pl

II. Categories of Processed Data

  1. User Data (tip recipients):

    • Identification data: first name, last name, email address
    • Contact data: phone number, residential address (processed by Stripe)
    • Professional data: service location, work category
    • Financial data: bank account number (processed by Stripe)
    • Verification data required by Stripe
    • Transaction data and received tips
    • Registration source data (only with marketing consent): Google Ads click identifier, campaign parameters (UTM), entry page and time of entry to the Service

  2. Client Data (tip senders):

    • Transaction data
    • Payment method data (processed by Stripe)
    • IP address and device data
    • Optionally: email address (when requesting an invoice)
    • Optionally: a nickname and message attached to the tip, shown in the alert on the User's stream
    • Optionally: a GIF from the GIPHY library attached to the tip (its identifier, title and file addresses), shown in the alert on the User's stream

  3. Data automatically collected when using the Service:

    • IP address
    • Device and browser information
    • Cookies and similar technologies
    • Data about Service usage

III. Purposes and Legal Bases for Processing

  1. Contract performance (Art. 6(1)(b) GDPR):

    • User account management
    • Tip transfer process handling
    • Payment processing through Stripe
    • Complaint handling

  2. Legal obligations (Art. 6(1)(c) GDPR):

    • Accounting documentation storage
    • Tax obligations fulfillment
    • Money laundering prevention
    • Implementation of data subjects' rights

  3. Legitimate interests of the Controller (Art. 6(1)(f) GDPR):

    • Service security
    • Fraud prevention
    • Analytics and statistics without cookies requiring consent
    • Server-side measurement of transactions in Google Analytics 4 - Service performance and security (Section VIII, point 4)
    • Own services marketing
    • Claims pursuit and defense
    • Moderating the nickname and message before they are shown in an alert on a stream (ModAI), including with an AI model. The decision only determines whether the nickname and message appear in the alert - it does not affect the payment and has no legal effects

  4. Data subject consent (Art. 6(1)(a) GDPR):

    • Third-party marketing
    • Marketing profiling
    • Image usage
    • Analytics and marketing cookies (Section VIII)
    • Measuring advertising campaign performance, including storing the registration source with the account (Section VIII)

IV. Data Recipients

  1. Data processors:

    • Stripe - payment operator
    • Apple Inc. - for Apple Pay payments
    • Hosting and IT service providers
    • Google Ireland Ltd. - Google Analytics (visit statistics - only with consent; server-side measurement of transactions - Section VIII, point 4)
    • Accounting office
    • Law firm
    • Vercel Inc. (AI Gateway) and the AI model providers it routes requests to (TypeSafe AI, with DigitalOcean as a fallback) - moderating nicknames and messages in stream alerts (ModAI); the data is not used to train models

  2. Independent controllers:

    • Stripe (for payment services)
    • Meta Platforms Ireland Ltd. - Meta Pixel and Conversions API (ad performance measurement, only with consent; joint controllership for data collection)
    • GIPHY, Inc. - the library of GIFs attached to tips: search phrases are sent to GIPHY from our server, without the Client's IP address, while the GIFs themselves are loaded by the Client's browser, the OBS widget and the User's tip history directly from GIPHY's servers, which receive the IP address and browser data in the process
    • State authorities in cases provided by law

  3. Data transfer outside EEA:

    • Data may be transferred to Stripe Inc., Google LLC, Meta Platforms Inc., Vercel Inc. and GIPHY, Inc. in the USA, and nicknames and messages also to AI model providers (ModAI)
    • Transfers are based on an adequacy decision (EU-U.S. Data Privacy Framework) or standard contractual clauses
    • Detailed information is available in the privacy policies of Stripe, Google, Meta and GIPHY

V. Data Retention Period

  1. User account data:

    • For the period of account possession
    • Up to 5 years after account deletion (for accounting and claims purposes)

  2. Transaction data:

    • 5 years from the end of the tax year (accounting requirements)
    • Longer in case of ongoing proceedings

  3. Marketing data:

    • Until consent withdrawal
    • Until objection is raised

  4. Analytics data:

    • Up to 26 months in aggregated form
    • Up to 14 days in detailed form

  5. Alert moderation log (ModAI):

    • Nicknames and messages blocked or assessed by the moderation - up to 90 days

VI. Rights of Data Subjects

  • Right to access data
  • Right to rectification
  • Right to erasure ("right to be forgotten")
  • Right to restriction of processing
  • Right to data portability
  • Right to object to processing
  • Right to withdraw consent
  • Right not to be subject to automated decision-making

VII. Apple Pay and Other Payment Methods

  1. Apple Pay:

    • When using Apple Pay, some data is processed by Apple Inc.
    • Apple Inc. acts as an independent data controller for Apple Pay services
    • The Service does not have access to payment card data stored in Apple Pay
    • Apple Inc. may collect and process additional data according to its privacy policy
    • Detailed information about data processing by Apple Pay is available at: https://support.apple.com/pl-pl/HT203027

  2. Scope of data processed for Apple Pay payments:

    • Transaction identifier
    • Transaction amount
    • Transaction date and time
    • Transaction status
    • Unique device identifier
    • Transaction location (country)

  3. Legal basis:

    • Data processing under Apple Pay is based on Art. 6(1)(b) GDPR (contract performance)
    • User additionally accepts Apple Pay terms of use

VIII. Cookies and Similar Technologies

  1. Types of cookies used:

    • Essential for Service operation: sign-in (up to 24 hours), language choice and remembering your cookie decision (up to 12 months), referral code (up to 30 days), and Stripe payment operator cookies used for fraud prevention on the payment page - no consent required
    • Analytics: Google Analytics (_ga, _ga_* - up to 24 months, _gid - 24 hours) - visit statistics and how the Service is used; for signed-in Users, Google Analytics also receives a pseudonymous account identifier so that visits from different devices can be linked
    • Marketing: Meta Pixel (_fbp, _fbc - up to 90 days) - measuring the performance of ads on Facebook and Instagram; for the same purpose and only with marketing consent, the Service may also report a registration or tip to Meta from its server (Conversions API)
    • Marketing: our own tippin_acq cookie (up to 90 days) - remembers which Google Ads click (gclid, wbraid, gbraid) or which campaign (utm_source, utm_medium, utm_campaign) brought the visitor to the Service, together with the entry page and time; on registration the Service stores this data with the new account to measure advertising campaign performance; only the click identifier itself (gclid, wbraid, gbraid) is shared with Google, and only in the events described in point 4. Withdrawal of consent deletes the cookie, and the data stored with the account at the latest the next time the account is used in the same browser; its deletion can also be requested at kontakt@tippin.pl

  2. Cookie consent:

    • Analytics and marketing cookies are stored only after consent is given in the banner shown on the first visit (Art. 399 of the Polish Electronic Communications Law and Art. 6(1)(a) GDPR)
    • Refusing consent is as easy as giving it and does not limit use of the Service
    • Consent can be changed or withdrawn at any time in the "Cookie Settings" panel in the Service footer; withdrawal deletes the cookies of that category
    • The tip payment page uses no analytics or marketing cookies

  3. Cookie management:

    • Through the "Cookie Settings" panel in the Service
    • Through browser settings (blocking essential cookies may prevent sign-in and payment)

  4. Server-side measurement of transactions (Google Analytics 4):

    • The Service also measures transactions on its server: once a payment is settled, it reports to Google Analytics 4 that a tip was received (including the first tip on an account) or that a tippin' platform support payment was made. This happens regardless of cookies in the browser
    • The event contains the amount, currency, transaction identifier, the account's language version and type, and a pseudonymous identifier of the tip recipient's account. The Service does not include the name, email address, payment data or any data of the person sending the tip; the support payment event contains no identifier of the person paying
    • The Google Analytics cookie identifier (_ga) saved at registration is included only if analytics consent was given at registration, and the Google Ads click identifier (gclid, wbraid, gbraid) only if marketing consent was given (point 1). Withdrawing the relevant consent deletes the corresponding identifier from the account
    • The legal basis is the Controller's legitimate interest (Art. 6(1)(f) GDPR) in measuring the performance of the Service and its advertising campaigns and in ensuring the security of transactions
    • Users have the right to object to this processing (Art. 21 GDPR). A message to kontakt@tippin.pl is enough - once it is received, events concerning the User's account are no longer sent

IX. Data Security

  1. Technical measures:

    • SSL/TLS encryption
    • Server security
    • Regular system updates
    • Backup copies

  2. Organizational measures:

    • Security policies and procedures
    • Employee training
    • Access control
    • Data processing agreements

X. Profiling and Automated Decision-Making

  1. Profiling scope:

    • Service activity analysis
    • User segmentation
    • Content personalization

  2. Profiling consequences:

    • Marketing communication adaptation
    • Service feature recommendations

  3. Objection to profiling:

    • Can be raised at any time
    • Does not affect basic Service functionality

XI. Final Provisions

  1. Privacy Policy changes:

    • Announced 14 days in advance
    • Communicated through Service and email
    • Archived versions available upon request

  2. Last update date: October 18, 2026

  3. Applicable law:

    • Polish law
    • GDPR and other personal data protection regulations

XII. Detailed Information for Specific User Groups

  1. Gastronomy sector:

    • Processing of workplace data
    • Rules for sharing data with gastronomy establishments
    • Specific QR code requirements

  2. Beauty sector:

    • Processing of service provision data
    • Cooperation rules with salons
    • Reservation requirements

  3. Internet content creators:

    • Processing of social media channel data
    • Identity verification rules
    • Promotion requirements