Privacy Policy

Last updated October 26, 2026

This Privacy Policy explains how Sulfur Stack Sp. z o.o. collects and uses personal data when you visit tractionpal.dev or use the Traction Pal app, who we share it with, how long we keep it, and what rights you have. We have written it in plain language. If anything is unclear, write to [email protected].

1. Who we are

Traction Pal is operated by Sulfur Stack Sp. z o.o., the controller of the personal data described below:

• Registered office: ul. Sandomierska 2, 39-400 Tarnobrzeg, Poland
• Registered by the District Court in Rzeszów, XII Commercial Division of the National Court Register, under KRS number 0000804333
• NIP (VAT): 8672248549 (EU VAT number PL8672248549)
• REGON: 384388015
• Share capital: PLN 30,000.00
• Contact for data protection and everything else: [email protected]

We have not appointed a Data Protection Officer, because the law does not require one for our processing. Write to [email protected] with any question about your data.

This policy covers the website at tractionpal.dev and the Traction Pal app.

2. Our two roles

We handle personal data in two different roles:

• As a controller, we decide why and how data is used. This covers account, billing, support, communication and technical data, which is everything in this policy except customer content.
• As a processor, we handle customer content on behalf of our customers. Customer content is what customers put into Traction Pal: projects and their go-to-market state, experiments, tasks, evidence, learnings, decisions, prospects and companies (including lists you import), and the customer and prospect feedback logged as evidence. It also covers the AI proposals and agent run results generated from them. It can include personal data about the customer’s own customers and prospects. The customer is the controller of that data. We process it only to provide the service and on the customer’s instructions, under the data-processing section of our Terms of Service.

If your data is in customer content, for example because a founder logged a conversation with you as evidence, please contact that customer first. We will help them respond to your request.

3. What we collect

• Account data: your name, email address and password (stored only as a secure hash), and whether you have verified your email address.
• Billing data: your plan, trial and subscription status, renewal date, invoices and payment status. Payments are handled by Stripe. Your card details go to Stripe and never reach us.
• Usage data: how many AI messages and agent runs you use and how many projects you have, which we count to apply the limits of your plan.
• Customer content (processor role, see section 2).
• Slack connection data, if you connect Slack to a project: the name of your Slack workspace, the channel you choose, and the access token Slack gives us. We store the token encrypted and use it only to post notifications to that channel. We never read your Slack messages.
• Support data: emails you send us.
• Technical data: IP address, browser and device information, server logs and error reports.

The website at tractionpal.dev collects no personal data beyond the technical data that every web server logs.

4. Why we use it and on what legal basis

Where we rely on legitimate interest, you can object at any time (see section 10).

5. AI processing

Traction Pal uses AI models to answer questions about your project, classify it, draft plans, write proposals and run agents. To do this, the relevant customer content is sent to our AI model provider (see section 6).

• Some AI features, such as prospect research, let the provider search the web. The search queries are generated from your instructions and your project, and are processed by the provider.
• The provider processes it under its commercial API terms. It does not use API data to train its models, and may keep it for a limited period to monitor for abuse.
• We do not use customer content to train AI models.
• AI output is a draft for people to review. Proposals take effect only after you approve them. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.

6. Who we share it with

We use the following service providers. They process personal data only on our behalf and under contracts that protect it.

We may also disclose personal data:

• to public authorities, where the law requires us to;
• to a successor, if Traction Pal is involved in a merger, acquisition or sale of assets, in which case this policy continues to apply to your data.

We do not sell personal data.

7. Transfers outside the EEA

Some of the providers above are based in the United States or process data there. When personal data leaves the European Economic Area, it is protected either by the provider’s certification under the EU–US Data Privacy Framework or by the European Commission’s Standard Contractual Clauses.

8. How long we keep it

Cancelling a paid subscription is not the same as cancelling your account. When a subscription ends, your projects become read-only and we keep your data until you cancel your account.

9. Cookies and local storage

We only store what the service needs to work:

• the app sets a session cookie that keeps you signed in, and a security cookie that protects forms against forgery. Both are strictly necessary;
• the app keeps short-lived copies of some AI results, such as a draft plan, in your browser’s session storage, which is cleared when you close the tab.

We run no analytics and no tracking. We use no advertising or tracking cookies and no third-party analytics, so we do not show a cookie banner. Cloudflare may set strictly necessary security cookies, for example to tell people from bots. If we add analytics later, we will update this policy first.

10. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• rectify data that is wrong;
• erase your data;
• restrict how we use it;
• data portability: receive your data in a machine-readable format;
• object to processing based on our legitimate interest;
• withdraw consent at any time where we rely on it, without affecting what we did before.

You can change your name, email and password, and cancel your account, on the Profile page in the app. To use any other right, write to [email protected]. We reply within one month.

You also have the right to lodge a complaint with the Polish data protection authority: Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

11. Emails we send

We send only service emails: email verification, password reset, confirmation of an email change, and billing and account notices. They are part of the service and cannot be turned off while your account exists. We send no promotional email.

12. Security

We protect personal data with appropriate technical and organizational measures, including:

• encryption in transit;
• encryption of Slack access tokens at rest;
• access control;
• regular backups;
• error reports with personal data filtered out.

13. Who Traction Pal is for

Traction Pal is a service for businesses, and for people aged 18 or older acting on behalf of a business. It is not aimed at children.

14. Changes to this policy

When we change this policy, we update the “Last updated” date above. If a change is material, we tell account holders by email before it takes effect.

15. Contact

Sulfur Stack Sp. z o.o., ul. Sandomierska 2, 39-400 Tarnobrzeg, Poland: [email protected].