Privacy policy
Effective from 28 October 2026. This is a translation; in case of any discrepancy the Polish version prevails.
This policy describes how we process personal data in connection with the portal.aqumi.pl portal (the dashboard for viewing and setting up devices), the AQUmi devices that send their readings to it, and the aqumi.pl website.
1. Data controller
The data controller is Marcin Wnuk, running a business (brand peHa:68), ul. Odkryta 46B/35, 03-140 Warsaw, Poland, VAT ID (NIP) 5221925271. For anything related to personal data, write to biuro@peha68.pl.
2. What data we process
- Account data — email address, first and last name (if present in your Google account) and your Google account identifier when you sign in with Google; your account's role and plan and the devices assigned to it.
- Data from AQUmi devices — measurements (e.g. temperature, pH, TDS), device status and settings, serial number (based on the MAC address), firmware version, the device's IP address on the local network and the IP address it connects to the server from.
- Notification data — the email addresses alerts should go to, and browser push subscription data.
- Technical and security data — sign-in and portal usage times, IP address, browser type, a log of settings changes and administrative actions.
We never know or store your Google account password.
3. Data from your Google account
Sign-in with Google is used only to confirm who you are. We receive only your email address (and whether it is verified), your first and last name and your account identifier. We get no access to your mail, files, contacts or any other data in your Google account. We use this data only to sign you in and run your portal account — we do not sell it, share it with anyone else or use it for advertising. Our use of information received from Google complies with the Google API Services User Data Policy, including the Limited Use requirements.
4. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Running your account, showing measurements, changing device settings, sending alerts | Art. 6(1)(b) — performance of a contract |
| Security of the portal and devices, detecting abuse, backups | Art. 6(1)(f) — legitimate interest |
| Billing and tax obligations for paid services | Art. 6(1)(c) — legal obligation |
Providing data is voluntary, but the portal can't be used without it. We do not make automated decisions or profile users.
5. Cookies
The portal uses only cookies that are strictly necessary for it to work:
aqumi_session— keeps you signed in, valid for up to 180 days from your last visit, deleted when you sign out;aqumi_oauth— secures the Google sign-in process, valid for 10 minutes.
We use no advertising or tracking cookies. The aqumi.pl site collects anonymous visit statistics with a tool running on our own server, without cookies and without identifying anyone.
6. Who we share data with
- Google — when you sign in with Google (Google acts as a separate controller; see the Google privacy policy) and as the storage for encrypted database backups (Google Drive). Backups are encrypted on our server before they reach Google.
- Our email provider (cyber_Folks S.A.) — when sending email alerts.
- Browser push services (e.g. Apple, Google, Mozilla) — if you turn on push notifications; we pass on only the notification content, in encrypted form.
The portal and its database run on our own server in Poland. Google may also process data outside the European Economic Area, on the basis of standard contractual clauses or the EU-US Data Privacy Framework.
7. How long we keep data
- account data — for as long as you use the portal; when an account is deleted we remove it from the database;
- device measurements — full (per-minute) data for 30 days; hourly averages for 30 days on the basic plan and for 12 months on the Pro plan; the latest reading of each sensor until the device is removed;
- backups — up to 30 days;
- sign-in and change log — up to 12 months;
- billing data — for the period required by tax law.
8. Your rights
You have the right to access your data, to have it corrected or erased, to restrict its processing, to data portability and to object to processing based on legitimate interest. To use these rights or delete your account, write to biuro@peha68.pl. You may also lodge a complaint with the Polish data protection authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw).
You can revoke the portal's access to your Google account at any time in your Google account settings.
9. Security
Connections to the portal are encrypted (HTTPS). Each client sees only their own devices, and access is checked on the server with every request. Sign-in sessions can be revoked, and backups are encrypted.
10. Changes to this policy
We will announce material changes to this policy in the portal or by email. The current version is always available on this page.