Privacy Policy.

Controller identity

The controller of personal data handled through EngineersCalc is Daniel Mrowiński, an individual operating the EngineersCalc project in Poland (not represented here as a registered company). Postal address: ul. Starołęcka 110, 61-341 Poznań, Poland. For privacy matters and requests to exercise your rights, email [email protected].

Data collected

Depending on the features you use, we may process:

• Account details: username, first and last name, email address, hashed password, activation and account status, assigned user role, and authentication-related information.
• Acceptance records: the UTC date and time of accepting the Terms of Service, the accepted terms-version identifier and registration-form identifier.
• Contact enquiries: contact topic, name, email address and message, with an optional page, tool or company URL.
• Dashboard feedback: feedback type and message, with optional page URL and email address.
• Engineering content: saved calculations and finalized Engineering Artifacts, inputs, outputs, timestamps, tool/workflow context, user ownership identifiers and integrity metadata. Content supplied by users may itself identify a person.
• Technical information: IP addresses, security events, service logs, session identifiers and request metadata when required for service operation or protection.
• Cookie and analytics information: consent preferences and, only where applicable consent is given, analytics identifiers and usage measurements.

Account registration requires the mandatory username, name, email address and password fields; without them we cannot create or operate the account. Optional form fields and optional Analytics are not required for ordinary access to public calculators. Most account, form and engineering information is supplied by you, while technical security and consent data can be generated automatically during use.

Do not include special-category personal data, passwords for other services, unnecessary personal identifiers or confidential third-party project material in free-text engineering fields.

Purposes and legal bases

We process personal data for the following purposes and legal bases, as applicable:

• Providing accounts, authentication, saved engineering functions and recording acceptance of service terms: Article 6(1)(b) GDPR, where necessary to provide the services requested and document the applicable agreement; where relevant, Article 6(1)(f) for demonstrating acceptance and managing disputes.
• Answering contact enquiries and reviewing voluntary product feedback: Article 6(1)(f), our legitimate interests in communication, troubleshooting and improving the service; Article 6(1)(b) may apply to a request concerning the provision of services.
• Protecting the website, preventing abuse and investigating faults: Article 6(1)(f), our legitimate interests in service security and integrity; Article 6(1)(c) where a specific legal duty applies.
• Optional analytics, including the calculator-view counting cookie: Article 6(1)(a), consent through the cookie-preference controls.
• Complying with a specific legal obligation: Article 6(1)(c) where that obligation applies.

Our legitimate interests are balanced against the rights and freedoms of individuals. Acceptance of Terms of Service is a contractual action; it is not presented as GDPR consent for essential account processing.

Contact and support

The Contact form (WPForms form 3659) requests a contact topic, name, email and message, with an optional URL/company reference. The Engineering Dashboard feedback form (WPForms form 3428) requests feedback type and message, with optional page URL and email. We receive email notifications at [email protected], sent via the configured mail service hosted with SeoHost.

Messages may contain personal data included voluntarily in free-text fields. Cloudflare Turnstile supports anti-spam verification. It may process technical signals used to evaluate the request; technical and security signals may be processed by Cloudflare under its applicable service terms. We cannot promise individual responses to anonymous feedback.

Accounts and engineering records

Registration uses Ultimate Member with email confirmation; activation links are configured to expire after two days. Users can edit account profiles. There is no self-service control for deleting an entire account.

Where the function is available, finalized Engineering Artifacts are saved as private ec_artifact records associated with the owning WordPress account. Authenticated APIs enforce ownership checks. The dashboard may display a maximum of 50 recent records, which is not the full count stored for an account. Individual artifact deletion and PDF export are available where supported by the relevant tool.

Account erasure: a verified account-deletion request sent to [email protected] is handled manually. The account-deletion mechanism has been tested to remove the account and all associated server-side ec_artifact records from the active database, not only those listed on the dashboard. Other information such as support correspondence and legal records is evaluated separately under the applicable retention rules. Users should export needed engineering documents before requesting closure.

Some activity is stored on the user's own device. The ec_artifacts_v2_* browser store may contain up to 20 artifacts, and ec_saved_calculations_v2_* may contain up to 10 calculation snapshots; export temporarily uses ec_artifact_export in sessionStorage. Local browser copies are not remotely removed by account deletion or logout. Clear website data in your browser if you wish to remove them, bearing in mind that this may erase work you have not separately exported. Individual workflows use account-scoped ec_wfa_v3_* local state. Legacy shared keys are discarded when updated modules load.

Analytics and cookies

CookieYes provides the consent banner and preference interface. The WordPress Consent API and Site Kit support consent signals, while Google Tag Manager is used to load Google Analytics 4 where permitted by the chosen preferences. The GA4 identifiers _ga and _ga_B7MCH1J11W were observed only after analytics consent in the reviewed browser tests.

The optional ec_viewed_calc_* cookie family prevents repeated increments of individual calculator view counters for 30 days, through an AJAX endpoint that checks analytics consent. Some Sourcebuster/WooCommerce attribution cookies (sbjs_*) may be used on relevant routes and are inventoried as analytics-related. Cookie classification does not on its own guarantee that a third-party script is technically blocked; implementation is subject to ongoing checks.

You can reject, accept or customise optional cookies and later change or withdraw consent using the CookieYes preference control. Rejecting analytics does not automatically erase local browser storage used to provide engineering features. See the separate Cookie Policy for the current cookie categories and periods.

Recipients and service providers

Depending on the service used, recipients and providers include:

• SeoHost: website hosting, WordPress database, email transport/hosting and provider-managed backups. An agreement governing the processing of personal data has been concluded with SeoHost.
• Google Analytics 4 and Google Tag Manager: consent-dependent website measurement and supporting tag delivery, where the user allows analytics.
• Cloudflare: Turnstile protection for forms and applicable security verification, under the provider's contractual terms.
• CookieYes: consent-management functionality, subject to its contractual and privacy terms.

WordPress, Ultimate Member, WPForms, WooCommerce, Wordfence and other installed components also process site data within the configured website environment. Using a plugin does not necessarily mean its author independently receives all records processed locally. Third-party recipients may use authorised sub-processors in accordance with their applicable arrangements.

Backup storage change: automatic UpdraftPlus transfers to a private Google Drive account have been disabled, and the operator has removed the historical EngineersCalc backup files from that Drive. Automatic backups remain available through the hosting provider. UpdraftPlus may still be used for manual backup operations.

International transfers

Providers such as Google, Cloudflare, CookieYes or authorised sub-processors may handle relevant information outside Poland or the European Economic Area. Where an actual transfer of personal data outside the EEA takes place, it must be covered by an applicable GDPR Chapter V mechanism, such as a European Commission adequacy decision or contractual safeguards where appropriate. We do not represent that every third-party service operates exclusively within the EEA.

For information about applicable safeguards and, where relevant, how to obtain a copy, contact [email protected].

Retention

The following retention periods and procedures apply, subject to justified legal exceptions and the technical distinctions indicated:

• Active accounts: account records are kept while the account exists, until it is closed or an applicable erasure request is implemented.
• Saved Engineering Artifacts: retained until individually deleted or until the associated account is deleted following a verified request, subject to lawful exceptions. On account deletion the tested mechanism deletes all linked artifacts from the active database.
• Accounts awaiting email confirmation: unactivated records are scheduled for removal once they are more than 30 days old; the operator reviews such registrations manually each month. Removal may therefore occur at the next monthly review, not at an automatic 30-day cutoff. Activation links expire after two days.
• Contact and feedback correspondence: ordinarily retained for 12 months after the relevant matter is resolved, then subject to manual review and deletion, unless a legal duty, dispute or legitimate claim requires longer storage.
• Security logs: the site's operating retention objective is 90 days, unless a security investigation or lawful obligation justifies longer storage. Logs managed by hosting or other security providers may follow their own periods; those settings must be verified separately.
• Cookies and optional analytics: retained in accordance with the specific storage periods described in the Cookie Policy; the calculator-view cookie is configured for 30 days.
• Backups: SeoHost maintains hosting backup restore points for files and databases on its own rotation schedule. A fixed maximum retention period for these provider-managed copies has not been established. Automatic UpdraftPlus schedules have been switched off, and historical backup files on the personal Google Drive have been removed by the operator.

Deleting information from the active site does not necessarily remove it immediately from pre-existing hosting backup copies. Backups expire under the provider's rotation arrangements. Following any restoration, the operator must take steps to avoid reintroducing records that were previously deleted. Browser-local copies and user-downloaded files are managed separately on the user's device.

Rights and complaints

Subject to the conditions of GDPR, you may request access to your personal data, rectification, erasure, restriction of processing, and portability; object to processing based on legitimate interests; and withdraw consent at any time without affecting processing carried out lawfully before withdrawal. Some rights depend on the applicable legal basis and are not unconditional.

Send requests to [email protected]. We may need proportionate information to verify your identity before disclosing or changing data. Requests are handled within the timeframes required by GDPR, subject to applicable extensions or lawful exceptions. You may lodge a complaint with a supervisory authority, including Poland's President of the Personal Data Protection Office (UODO), where competent.

We do not describe the engineering PASS/FAIL indicators as automated decisions having legal or similarly significant effects on a person under Article 22 GDPR. They are engineering calculation outputs provided for user assessment, not a decision about an individual's rights.

Security and updates

We use authenticated access controls, account-specific authorisation checks for engineering records, security monitoring and hosting backups to help protect service information. Saved Engineering Artifacts can include checksum or provenance metadata to detect changes; these are not digital signatures or independent validation of an engineering result. No internet service can promise absolute security.

We will review this policy when processing purposes, providers, storage practices or relevant law change materially. The effective date shown above identifies the version of the public notice currently presented on this page.