Privacy Policy

Last updated: 7 September 2026

This policy explains what personal data we collect when you use the OptimizeXL website and the Decks application, why we collect it, who processes it on our behalf, how long we keep it, and what rights you have. We have written it to be read, not skimmed past. If anything is unclear, write to us at the address in section 1.

In short: we collect what is needed to run the website, answer your messages, and provide your Decks account and subscription. We do not sell personal data and we do not use it for advertising.

1. Who is responsible for your data

The controller of your personal data is Artur Pluta, trading as Artur Pluta OptimizeXL, a sole proprietorship registered in the Polish business register (CEIDG), ul. Ruczajowa 16A/13, 65-153 Zielona Góra, Poland, NIP 7272777634, REGON 521897930 ("we", "us", "OptimizeXL"). You can reach us about anything in this policy at privacy@optimizexl.com or through the contact form.

2. What this policy covers

This policy applies to:

• the website at optimizexl.com and www.optimizexl.com, including its contact form, newsletter and conversion-audit sign-up ("the website");
• the Decks application at decks.optimizexl.com and data.optimizexl.com, including Decks Product, Decks CRM and Decks Data ("Decks").

It does not cover other websites we link to. Where we name a company below that acts as an independent controller (Stripe for payments, Google for sign-in), their own privacy policy governs what they do with your data.

3. What we collect

3.1 When you visit the website

Server logs. Our servers keep technical logs with your IP address, browser type, the pages requested and the time of each request. We use them to keep the site running and secure.

Analytics. We use Google Analytics 4 to understand which pages are viewed, how far visitors scroll and which links are used. See section 6 for what Google receives and how to opt out.

3.2 When you contact us or sign up for email

Contact form. When you send a message through the contact form we receive your name, email address and the message itself. The message is delivered to us as an email through Brevo (see section 5.3) and we use your address only to reply. Submissions are rate-limited by IP address to block spam; those addresses are held in memory for ten minutes and are not stored.

Newsletter and audit sign-ups. When you subscribe to our newsletter, request a conversion audit or ask for a content download, we store your email address, your name where you give it, and the page and campaign you signed up from. Every list uses double opt-in: nothing is sent until you confirm the address by clicking the link in the confirmation email. Each email we send carries an unsubscribe link.

3.3 When you use Decks

Account data. When you create a Decks account we store your email address, first and last name, whether your email is verified, and how you sign in. If you sign in with Google we receive your Google account identifier, name, email and profile picture from Google; we never receive your Google password. If you sign up with email and password we store only a cryptographic hash of the password, never the password itself. Password-reset and verification links are single-use codes that expire.

Subscription data. If you subscribe to a paid plan we store your plan, subscription status and renewal date, and the identifiers Stripe assigns to you as a customer and to your subscription. We do not receive or store card numbers.

Team data. If you create or join a team we store the team name, its billing email, the seats purchased and used, who belongs to it and in what role, and any invitation you send, including the invitee's email address.

Usage data. We record which pages and features you use and, for the checkout, which step you reached (see section 6). Our servers keep technical logs with your IP address, browser type, the pages requested and the time of the request.

Sign-in sessions. A session record ties your browser to your account for 7 days after your last activity.

What we do not collect. Decks analyses public operator websites and marketing emails. The screenshots and extracted data in the Decks catalogue are about those operators, not about you. We do not read the content of your Decks searches or notes for any purpose other than showing them back to you.

4. Why we use your data and on what legal basis

We do not sell personal data, we do not use it for advertising, and we do not make automated decisions about you that have legal or similarly significant effects.

5. Who processes your data

5.1 Payments: Stripe

Payments are processed by Stripe Payments Europe, Ltd. (Ireland). When you subscribe you enter your card details on a page served by Stripe; we never see or store them. Stripe receives your email address, name, the plan and seat count you chose, and the amount. Stripe acts as an independent controller for the payment itself; its privacy policy is at stripe.com/privacy. Receipts and invoices are sent by Stripe on our behalf.

5.2 Sign in with Google

If you choose "Continue with Google", Google LLC authenticates you and shares your name, email address, profile picture and a Google account identifier with us. Google's privacy policy governs what Google does with your sign-in; see policies.google.com/privacy. We use the data only to create and sign you into your Decks account.

5.3 Email: Brevo

We send email through Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany), which processes it on our behalf on servers in the European Union.

For the website, Brevo holds the contact lists for the newsletter, audit requests and content downloads (email address, name, sign-up source), and relays contact-form messages to us.

For Decks, we share with Brevo your email address, first and last name, our internal account identifier, and a small set of facts about your account: whether your email is verified, how you sign in, your plan, the number of seats, whether you administer a team, your current account stage (for example "free account", "PRO subscriber", "subscription cancelled") and the date that stage last changed.

• Service email (verification, password reset, team invitations, notices about your subscription) is part of providing Decks and cannot be switched off while you have an account.
• Product news, tips and offers, including reminders related to a purchase you started, are sent only if you have given consent, for example by ticking the box at sign-up or in your account settings. Every such email contains an unsubscribe link, and you can also withdraw consent in your account settings. Withdrawing consent does not affect service email. We never send marketing email to an address that has not been verified.

Brevo keeps your contact record for as long as you are subscribed or have a Decks account; it is deleted when you unsubscribe or delete your account. Brevo's own privacy policy is at brevo.com/legal/privacypolicy.

5.4 Error monitoring: Sentry (Decks)

To detect and fix faults in Decks we use Sentry (Functional Software, Inc., 45 Fremont Street, San Francisco, USA), configured to store data in its European data centre in Germany. When an error occurs in your browser or on our servers, Sentry receives a report containing the error, the page you were on, your browser and operating system, your IP address and, if you are signed in, your account identifier and email address. Reports are kept for 90 days. Sentry processes this data on our behalf under a data processing agreement.

5.5 Hosting and storage

The website and Decks run on servers rented from Hostinger International Ltd. in Frankfurt am Main, Germany. Decks screenshots, uploaded files and database backups are stored with Amazon Web Services in the European Union (Ireland region, eu-west-1).

We use Google's Gemini models to generate descriptions and search terms for the website screenshots in the Decks catalogue. Those screenshots are of public operator websites and marketing emails; no data about you is sent to this service.

5.6 International transfers

All of the companies named in this policy process data under contracts that meet the requirements of GDPR art. 28, or act as independent controllers where the law provides for it (Stripe and Google for sign-in). Where data leaves the European Economic Area, for example to Google or Sentry in the United States, the transfer relies on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

6. Analytics: Google Analytics 4

We use Google Analytics 4, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), to understand how the website and Decks are used: which pages are viewed, which features are opened, and which step of the subscription checkout is reached or abandoned.

Google Analytics sets cookies (_ga and _ga_*, valid for up to 2 years) that assign your browser a random identifier. For signed-in Decks users we also send Google a pseudonymous account identifier so that visits from the same account can be counted once. We do not send Google your email address, name, card details or the content of what you type.

Google truncates IP addresses before storing them, and we have disabled Google Signals and advertising personalisation, so the data is not used for advertising or combined with your Google account. Google may transfer data to the United States under the EU–US Data Privacy Framework and standard contractual clauses. We keep analytics data for 14 months. Google's description of how it uses data from sites that use its services is at policies.google.com/technologies/partner-sites.

You can disable analytics cookies in your browser settings; the website and Decks work without them. You can also block Google Analytics on every website with the browser add-on at tools.google.com/dlpage/gaoptout.

7. Cookies and local storage

The website itself sets no cookies of its own. We set no advertising cookies and no third-party tracking cookies anywhere.

8. How long we keep your data

9. Your rights

You can ask us to access, correct, delete or export your data, to restrict or object to how we use it, and you can withdraw any consent you gave, all by writing to privacy@optimizexl.com or through the contact form. Decks users can delete their account themselves in account settings. We answer within one month and we do not charge for a request unless it is clearly excessive.

If you believe we handle your data unlawfully you can complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or to the data protection authority in your own country.

If you live outside the European Economic Area, for example in the United Kingdom or California, we extend the same rights to you. We do not sell personal data, so there is nothing to opt out of in that respect.

10. Children

The website and Decks are for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes to this policy

We will post any changes on this page and update the date at the top. If a change materially affects Decks account holders, we will also announce it by email before it takes effect.