Privacy Policy
Last updated November 11, 2026
We collect as little as we can to run Requestarium, and we never sell your data.
1. Data controller
The controller of your personal data is Mykola Kuropatkin, ul. Domaniewska 17/19 lok. 133, 02-672 Warszawa, Poland, NIP 9512570691, REGON 525596466. For anything about privacy, email [email protected].
2. What we collect
- Account data: name, email, organization, and team membership.
- Workspace data you sync to Requestarium Cloud: collections, environments, and settings. Secrets are encrypted at rest. Data you keep only in the desktop app stays on your device.
- Billing data: plan, seats, and subscription status. Card details go to Paddle, never to us.
- Contact data: what you send through our forms or by email.
- Technical data: app version, OS, and server logs (IP address, timestamps) used for security and update checks.
3. Why we use it and on what basis
- To provide the Service and your plan — performance of a contract (Art. 6(1)(b) GDPR).
- To keep the Service secure, prevent abuse, and improve it — our legitimate interests (Art. 6(1)(f)).
- To keep accounting and tax records — legal obligation (Art. 6(1)(c)).
- To send product news, only if you opt in — consent (Art. 6(1)(a)), which you can withdraw at any time.
4. AI assistant
The AI assistant uses your own model key. Prompts go directly from your app to the model provider you choose (for example Anthropic or OpenAI) under that provider's terms. We do not receive or store them.
5. Integrations and share links
An organization admin can connect Jira and Confluence, and a member can connect GitHub, GitLab, or Bitbucket to sync collections with a repository. We then store the access token for that connection, encrypted at rest, and send the provider only what a member asks for: a Jira issue created from a failed run, a link from a request to an issue, collection documentation published to Confluence (credential-looking header values are masked), or collection files synced to the repository (environments only if the sync includes them). The provider processes that data under its own terms, as a service your organization chose. Disconnecting deletes the stored token.
A share link makes a request or a collection's documentation readable by anyone who has the link, without an account. Share links only with people you trust.
7. How long we keep it
Account and workspace data: while your account is active. When you delete your account, it stays available for 30 days so you can export your data or change your mind, and is then erased, together with organizations where you are the only member. Billing records: as long as Polish tax law requires (generally 5 years). Server logs: up to 90 days.
8. Your rights
You can ask to access, correct, delete, export, or restrict your data, and object to processing based on legitimate interests. Email [email protected] and we will reply within 30 days.
You can delete your account yourself in the app under Settings ▸ Profile ▸ Delete account. The account is erased 30 days later; until then you can sign in, export your collections, or cancel. Before deleting, cancel any paid subscription, and if you are the only administrator of an organization with other members, choose who takes over.
You can also complain to the Polish data protection authority (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl) or the authority in your country.
10. Changes
We will post updates here and notify you of material changes by email or in the app.