Privacy Policy
Last updated: March 20, 2026
1. Introduction
This Privacy Policy explains how Almenar ("we", "us", "our") collects, uses, and protects your personal data when you use our metric tree visualization platform.
Almenar is operated from Poland, within the European Union. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR) and applicable Polish data protection law.
This policy works alongside our Terms of Service. For details on your rights, see Section 9.
2. Data We Collect
We collect the following categories of data:
Account Data
When you sign up, we collect your email address and password. If you sign in with Google, we receive your name and email address from Google.
User Content
Data you create within the service, including metric trees, metric names, metric values, and any data you import via CSV files.
Usage and Analytics Data
We collect pseudonymized usage data through PostHog (hosted in the EU) to understand how the product is used and to improve it. This includes events such as page views, feature usage, and interaction patterns. We do not track individual keystrokes or record screen content.
Technical Data
Standard information collected automatically, including IP address, browser type and version, device type, operating system, and referring URL.
3. How We Use Your Data
We use your data to:
- Provide, maintain, and improve the Almenar service.
- Authenticate your identity and secure your account.
- Analyze usage patterns to improve the product experience.
- Send you service-related emails (e.g., welcome email, password reset).
- Communicate with you about your account or service updates.
- Comply with legal obligations.
4. Legal Basis for Processing
Under GDPR Article 6, we process your personal data on the following legal bases:
- Contract performance: Processing necessary to provide the service you signed up for (account data, user content).
- Legitimate interest: Product improvement and security, provided these interests do not override your fundamental rights.
- Consent: Analytics cookies (PostHog) — we collect usage data only after you give consent via our cookie banner. You can withdraw consent at any time through the cookie settings link in our footer.
- Legal obligation: Where we are required to retain data by law.
5. Cookies and Similar Technologies
Almenar uses cookies and similar technologies (such as localStorage) to operate the service and, with your consent, to understand how you use it. You can manage your preferences at any time through our cookie settings.
| Name | Provider | Purpose | Category | Duration |
|---|---|---|---|---|
sb-*-auth-token | Supabase | Session authentication | Strictly necessary | Session |
__cf_bm | Cloudflare | Bot management | Strictly necessary | Up to 30 min |
cf_clearance | Cloudflare | Security challenge verification | Strictly necessary | Configurable |
ph_*_posthog | PostHog | Usage analytics | Analytics (requires consent) | Up to 1 year |
cookie_consent | Almenar | Your cookie preferences | Strictly necessary | Persistent (localStorage) |
Strictly necessary cookies are required for the service to function and cannot be disabled. Analytics cookies are only set after you give your consent.
6. Third-Party Services
We use the following third-party services to operate Almenar. Each processes data only as necessary to provide their service:
- Supabase (EU region) — database hosting and user authentication.
- PostHog (EU region) — product analytics.
- Vercel (US-based, with servers in the EU) — application hosting.
- Google — OAuth authentication (only if you choose to sign in with Google).
- Resend — sends emails on our behalf (e.g., welcome emails, password resets).
7. Data Sharing
We do not sell, rent, or trade your personal data. We share data only with the third-party service providers listed above, and only to the extent necessary to operate the service.
If you create a share link for a metric tree, anyone with that link can view the shared tree's data. You control which trees are shared and can revoke share links at any time.
8. Data Retention
We retain your data for as long as your account is active. If you delete your account, we will delete your personal data and user content within 90 days, unless we are required by law to retain it longer.
9. Your Rights
Under GDPR, you have the following rights regarding your personal data:
- Access: Request a copy of the personal data we hold about you.
- Rectification: Request correction of inaccurate data.
- Erasure: Request deletion of your data ("right to be forgotten").
- Portability: Request your data in a machine-readable format.
- Restriction: Request that we limit processing of your data.
- Objection: Object to processing based on legitimate interest.
- Withdraw consent: Where processing is based on consent, you can withdraw it at any time.
To exercise any of these rights, contact us at hello@almenar.io. We will respond within one month, as required by GDPR.
You also have the right to lodge a complaint with a supervisory authority. In Poland, this is the President of the Personal Data Protection Office (UODO).
10. International Transfers
We host our core services (database, analytics) in the EU. Where data is processed outside the EU (e.g., Vercel's US infrastructure), we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.
11. Automated Decision-Making
We do not use automated decision-making or profiling that produces legal or similarly significant effects.
12. Children's Privacy
Almenar is not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a notice in the service. The "Last updated" date at the top of this page reflects the most recent revision.
14. Contact
If you have questions about this Privacy Policy or want to exercise your data rights, contact us at hello@almenar.io.
This policy is governed by the laws of Poland and applicable EU data protection regulations.