Privacy Policy

Last updated: August 20, 2026

1. Data controller

The controller of skanfirmy.pl is Bartosz Kuć (sole proprietorship), tax ID (NIP) 7393933151. Contact: [email protected].

2. What data we process

The site processes identification numbers you enter yourself: tax ID (NIP) and KRS number (company verification) and tax ID (NIP) or PESEL (tax micro-account generator). Tax ID and KRS number are company identifiers. PESEL is personal data, but in the micro-account generator it is processed entirely locally in your browser — it is never sent or stored anywhere. We do not collect browsing history, location, login data, or any information identifying the user. The exception is the optional company monitoring service, where you provide your own email address — described separately in section 6.

3. How queries work

In six of the interactive tools (VAT White List, KRS, account check, tax micro-account, PKD, interest calculator), the number you enter is sent directly from your browser to the official, public APIs of government registers:

• wl-api.mf.gov.pl — VAT Payers Register (Ministry of Finance),
• api-krs.ms.gov.pl — National Court Register (Ministry of Justice).

For these tools we have no proxy server of our own — we do not intercept or store your queries. The tax micro-account generator sends no queries at all — the number is computed entirely in your browser.

The exception is four public server endpoints: skanfirmy.pl/nip/{number}, skanfirmy.pl/nips/{list} (bulk lookup of up to 30 tax IDs), skanfirmy.pl/regon/{nip} (REGON register data — Statistics Poland / GUS, the online REGON database) and skanfirmy.pl/vies/{country}/{number} (EU VAT verification in the European Commission's VIES system), meant to be read by search engines and AI agents and as the backend for the VIES tool — here the query to the registers is made by our server function (Cloudflare Pages Functions), not your browser. The response is temporarily cached on Cloudflare's CDN (max. 24 hours) to avoid overloading the daily query limits shared by all visitors. We do not keep our own, persistent database or query log — beyond Cloudflare's standard infrastructure logs. For sole proprietorships, the "name" field from the VAT Register may be a natural person's first and last name; processing here happens under the same legal basis as in section 8 (legitimate interest — verifying a business counterparty), for no longer than the cache period noted above.

skanfirmy.pl/mcp works the same way — an MCP (Model Context Protocol) server letting AI agents call our tools directly. Same server function, same source registers, same lack of persistent query logging — the only difference is technical: responses to POST requests are not cached on the CDN (standard behavior for this kind of request), so every call reaches the relevant register directly. (Note: when you use the monitoring tools via MCP or REST with an API key, the rules in section 6 additionally apply.)

4. Local storage (cache)

We save query results only locally in your browser (localStorage) for up to 24 hours, to reduce the number of queries to the registers. This data is never sent anywhere; you can delete it at any time by clearing the site's data in your browser.

5. No tracking

We do not use tracking cookies, analytics, or advertising tools. We do not sell your data and we do not share it with third parties for their own purposes. The exception are processors we entrust data to solely in order to perform the monitoring service you requested — listed in section 6.

6. Company monitoring (optional service)

skanfirmy.pl offers an optional company monitoring service: you watch selected tax IDs (NIP; up to 10 per e-mail address), and once a day we check the Ministry of Finance VAT Register and notify you of a change in VAT status, bank account, or registry data shown in the White List (name, address, KRS or REGON number) — by email, and for programmatic integrations optionally also via webhook (a push notification). This one service alone stores data on our side — all other tools work without an account and without a persistent database (sections 2–5). Providing an email address is voluntary but necessary to use monitoring — without it we cannot send notifications.

What we store when you use it:

• Your email address — to send the notifications you requested and to handle sign-up and unsubscription. We do not use it for marketing.
• The IP address at the moment you confirm sign-up — stored once as proof of consent (accountability, Article 5(2) GDPR).
• The tax IDs (NIP) you watch, and the current state of each, fetched from the public VAT Register (name, VAT status, bank account numbers, address, KRS and REGON numbers, registration/removal dates) and its change history. For sole proprietorships, the "name" field and the address may be a natural person's data (first and last name, home address).
• API key — when you confirm sign-up we issue you a key for optional programmatic or AI-agent integration. We store only its hash and the issue/last-used dates (for limits and security); we do not store the key value itself.
• Webhook configuration (if you enable push notifications) — the recipient URL you provide and a generated secret for HMAC signing. The URL is validated for security (only public https addresses are allowed).
• Operational technical data: the sign-up confirmation token (as a hash) and the unsubscribe token (in a form allowing one-click unsubscription from an email); a send log (linking subscriber, tax ID, and the mail provider's message identifier — for delivery confirmation); a counter protecting against abuse of confirmation-email sending; and a suppression list of addresses excluded from sending.

Data on the monitored businesses comes from the public VAT Register, i.e. not from the person it concerns (Article 14 GDPR). Given the public nature of the source and the scale of the service, this policy serves as the information notice for those persons (Article 14(5)(b) GDPR).

Where and for how long. We store the data in a Cloudflare D1 database located in the European Union. Retention periods:

• email address and the list of watched tax IDs — for the duration of your use of the service;
• company change history — up to 90 days (older entries deleted automatically);
• send log — up to 12 months;
• API key hash — until you stop using the service;
• webhook configuration (URL + secret) — until you remove it or stop using the service;
• proof of consent (confirmation IP address) and the suppression-list entry — kept also after unsubscription, to the extent and for the time needed to demonstrate lawfulness and to honour your unsubscription (until the limitation periods for claims expire);
• a company's state (snapshot) — only as long as anyone watches that tax ID; once no one watches it, we delete it automatically.

Unsubscription. Sign-up requires confirmation by clicking a link in an email (double opt-in). You can withdraw consent to notifications at any time — with one click in the footer of any alert, or by writing to [email protected]. After unsubscription we deactivate your watches, stop checking your tax IDs and send you no further messages, and your address is added to an internal suppression list. Full deletion of remaining data is carried out on your request (section 7).

Processors. To provide the service we use — solely on our behalf and for the purposes of this service:

• Brevo (Sendinblue SAS, France) — email delivery,
• Cloudflare — database hosting (EU region) and server functions.

We store the data in the EU and do not sell it or share it with anyone for their own purposes. To the extent providers (Cloudflare, Brevo) might process data outside the European Economic Area or share it with affiliates in the USA, this takes place on the basis of Standard Contractual Clauses (SCC) and/or an adequacy decision (EU-US Data Privacy Framework).

Legal basis. Email address and delivery of the requested notifications — Article 6(1)(b) GDPR (performance of the service you request). Confirming sign-up via double opt-in constitutes a separately required consent to electronic communication (Article 10 of the Polish Act on Providing Services by Electronic Means and the Electronic Communications Law), which you can withdraw at any time — withdrawal means we stop providing the service. Data on the monitored companies (tax ID and information from the VAT Register), proof of consent (IP) and the suppression list — Article 6(1)(f) GDPR (legitimate interest: providing and running the service, consent accountability, and honouring unsubscriptions).

Automated processing. We do not make decisions about you based solely on automated processing (including profiling) within the meaning of Article 22 GDPR. Only the daily comparison of company states from the VAT Register and the sending of notifications is automated — this produces no legal effects concerning you.

7. Your rights (GDPR)

With regard to the personal data we process (primarily in the monitoring service), you have the right to: access your data and obtain a copy, rectification, erasure, restriction of processing, objection, data portability, and withdrawal of consent at any time (without affecting the lawfulness of processing carried out before withdrawal). To exercise these rights, write to [email protected]. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO).

8. Legal basis (GDPR)

The free verification tools make it easier to access public government registers and perform calculations locally in the browser — for that scope we do not collect users' personal data on our server, and processing identifiers (tax ID/KRS number) is based on legitimate interest (Article 6(1)(f) GDPR): verifying a business counterparty. The only service that stores data on our side is the optional company monitoring — its legal bases are described in section 6.

9. Chrome extension (Skan Firmy)

The “Skan Firmy” browser extension follows the same principles as the website. Detecting NIP/REGON/KRS numbers on an open page happens entirely locally in the browser; the only thing sent off your device is the number you deliberately check — to the skanfirmy.pl domain, which relays queries to the MF, KRS, GUS and VIES registers. Lookup history, favorites, settings and the optional monitoring API key are stored only locally (chrome.storage) on your device and never reach us. The extension collects no personal data, does not track browsing activity and loads no remote code. Permissions are minimal and used solely for the stated purpose — company verification; access to page content is one-off and triggered only by your click.

10. Changes

We may update this policy. The current version is always available at this address.

← Back to skanfirmy.pl