Privacy policy

This English version is provided for customers outside Poland. It has not yet been reviewed by a lawyer. If anything in it differs from the Polish version, or something is unclear, please contact us at [email protected].

Who is responsible for your data

The controller of personal data collected on rytuo.com is LIFTAYA Sebastian Maćkowski, ul. Kapelanów Wojskowych 1A/26, 44-194 Knurów, Poland, EU VAT ID PL9690838055, the company that operates Rytuo ("we"). Data protection matters are handled on the controller's behalf by Damian Maćkowski, founder of Rytuo. For anything about your data, write to [email protected].

This policy applies the EU General Data Protection Regulation (GDPR) and, for visitors in the United Kingdom, the UK GDPR and the Privacy and Electronic Communications Regulations (PECR).

When you start a free trial, you create your account on the sign-up page of the Rytuo app (app.rytuo.pl/start). We receive the details you enter there, such as the salon or spa name, your name, email address and phone number, and the page and campaign tags you came from (for example utm tags in the link, the referring site and, for visits from a Meta ad, the click identifier). We use them to open and run your account and the trial, to contact you about your account and to measure which pages and campaigns bring sign-ups.

When you write to us by email, we receive your message and the details you include, and use them only to reply and, if you wish, to arrange a demo and set up your account.

Legal basis: performance of a contract and steps taken at your request before entering into it (Article 6(1)(b) GDPR / UK GDPR), and our legitimate interest in replying to enquiries and measuring our marketing (Article 6(1)(f)). Giving the data is voluntary, but without it we cannot open an account or reply.

If you have accepted marketing cookies when you create the account, we also send the account creation and trial start to Meta through the Meta Conversions API, with your email address and phone number in hashed form (SHA-256, a one-way code; Meta compares hashes and does not see the data itself), together with the browser identifiers described below. Without a marketing consent nothing from the sign-up is sent to Meta.

We keep account data for as long as the account exists; if you do not choose a plan after the trial, we keep the salon's data for 30 days. Email enquiries are kept until our conversation ends, and no longer than 12 months after the last contact.

Demo bookings and email

The "Book a free demo" buttons open our scheduling page on Cal.com. The details you enter there (name, email, salon details, the time you choose) are used to hold the demo with you, on the same legal basis as the form. Cal.com processes them under its own terms. Emails you send us are handled through our email provider.

Who else receives the data

Data goes only to providers without whom the website and contact do not work: our server provider (Contabo GmbH, Germany), Cloudflare (hosting and delivery of rytuo.com, DNS and email forwarding) and Google (email and the enquiry spreadsheet). Cloudflare uses your country, derived from your IP address, to show prices in your currency; we do not store it. We do not sell personal data and do not pass it to anyone for their own marketing, apart from the Meta and Google Analytics measurement described in Cookies, which only runs with your consent.

International transfers and hosting

The Rytuo app and its databases are hosted on servers in the European Union. Some providers named in this policy (Cloudflare, Google, Meta, Anthropic, Resend) may process data outside the European Economic Area and the United Kingdom, in particular in the United States. Where they do, transfers rely on the European Commission's standard contractual clauses (with the UK addendum where UK data is involved) or on the EU-US Data Privacy Framework and its UK Extension, as applicable to each provider.

Your rights and complaints

Under the UK GDPR and the EU GDPR you have the right to access your data, have it corrected or erased, restrict processing, receive it in a portable format and object to processing based on our legitimate interest. Where processing is based on consent, you can withdraw consent at any time, without affecting what was done before. Write to [email protected]; we reply within one month.

You can also complain to a data protection authority: in the United Kingdom, the Information Commissioner's Office (ICO, ico.org.uk); in Poland, where we are established, the President of the Personal Data Protection Office (UODO, uodo.gov.pl); or the authority in the EU country where you live or work. If you are outside the UK and the EU, for example in the United States, you can send us the same requests and we will handle them in the same way. We do not sell personal data.

The Rytuo app, Messenger, Instagram and WhatsApp

Salons using the Rytuo app (app.rytuo.pl) can connect their Facebook Page, Instagram account and WhatsApp number. When you write to such a salon through Messenger, Instagram or WhatsApp, Rytuo receives your message, the identifier Meta assigns to you for that page or number and, if Meta provides it, your name. This data is used only to reply to your message and to handle bookings at that salon, including by the Rytuo Assistant (the salon's virtual assistant based on an AI model).

The controller of this data is the salon you write to; we process it on the salon's behalf as a processor. We do not use it for advertising, do not sell it and do not combine it with other salons' data. Conversations are kept for as long as the salon uses Rytuo, and no longer than 30 days after the salon stops. You can ask for deletion through the salon, through your Facebook settings or as described on data deletion. To generate AI replies, the conversation may be sent to the language model provider (Anthropic), which does not use it to train its models.

Internal tools and Google APIs

Rytuo uses internal, server-side tools that access Google APIs (Google Ads including Keyword Planner, Google Analytics, Google Search Console) with the Rytuo owner's own Google account, after OAuth consent. The tools are used only by the Rytuo team; no customers or third parties use them. We retrieve only keyword ideas, search volumes and statistics of our own campaigns and website, we do not collect other people's personal data through them, and we do not sell or share the data. Rytuo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Access can be revoked at any time in the Google Account settings.

Cookies, Google Analytics and Meta Pixel

On your first visit to rytuo.com we show a window with three choices: Accept all, Necessary only or Settings, where you switch analytics and marketing cookies on or off separately. Until you choose, only necessary storage is used and nothing optional runs. You can change or withdraw your choice at any time with the link in the footer of every page.

Necessary (always on)

Security and remembering your choice; the site does not work properly without them. The rytuo_consent cookie stores your choice (consent version, categories, date) for 12 months on rytuo.com. If you pick a currency in the price switcher, your browser remembers it in local storage on your device; it is not sent to us. Legal basis: storage strictly necessary for the service you request (PECR regulation 6(4) in the UK and the equivalent rules in the EU).

Analytics: Google Analytics (with your consent)

If you accept analytics cookies, we load Google Analytics 4, a tool of Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland). It counts visits and where they come from, so we know what works on the site. Without consent the Google Analytics script is not loaded and no data is sent to Google.

Google Analytics sets the _ga and _ga_<id> cookies (a random browser and session identifier) for 14 months. Google receives the page address and the referring page, campaign tags in the link, browser and device information, approximate location (Google does not store the full IP address) and events such as viewing pricing, a click on a free-trial sign-up button or a demo link click. We do not send your name, email or phone. Data is kept in Google Analytics for 14 months. Advertising features (Google Signals, ad personalization) are switched on only if you also accept marketing cookies.

Google processes this data as our processor and may transfer it to Google LLC in the United States under the Data Privacy Framework and standard contractual clauses. Legal basis: your consent (Article 6(1)(a) GDPR / UK GDPR, and PECR regulation 6 in the UK). Withdraw it at any time in Cookie settings; we then delete the _ga cookies and stop sending data.

Marketing: Meta Pixel and Conversions API (with your consent)

If you accept marketing cookies, we load the Meta Pixel, a tool of Meta Platforms Ireland Ltd. (Merrion Road, Dublin 4, Ireland). It measures whether a visit from a Facebook or Instagram ad ended in a demo booking or a free-trial sign-up, and helps target those ads better to salons that may be interested. Without consent the Meta Pixel is not loaded and nothing is sent to Meta.

The Meta Pixel sets the _fbp cookie (a browser identifier) and, when you arrive from an ad, _fbc (a click identifier), usually for 90 days. Meta receives the page address, browser and device information, your IP address, these identifiers and events: page view, viewing pricing or a feature page, a click on a free-trial sign-up button and a click on the demo link. Browser events do not include your name, email or phone.

Account creation and the start of the trial are also sent from our server (Meta Conversions API), so that measurement is accurate and Meta counts each event only once. The server then adds the email address and phone number from the account in hashed form (SHA-256), the _fbp/_fbc identifiers, the page address and browser information. We do this only if marketing consent was on when you created the account.

For collecting and transmitting this data, Meta Platforms Ireland is a joint controller with us; afterwards it processes the data as a separate controller under its own privacy policy. Meta may transfer data to Meta Platforms, Inc. in the United States under the Data Privacy Framework and standard contractual clauses. Legal basis: your consent (Article 6(1)(a) GDPR / UK GDPR, and PECR regulation 6 in the UK). Withdraw it at any time in Cookie settings (we then delete the _fbp and _fbc cookies and stop sending events) or by writing to [email protected]. You can also manage your ad settings in your Facebook or Instagram account.

Visit statistics without cookies

Regardless of your choice, the site sends cookieless visit statistics to our own server at rytuo.pl/api/hit: the page visited and the site it was on, the domain of the referring site, campaign tags in the link, device type, scroll depth and sections reached, clicks on the free-trial, demo and currency buttons and which button was chosen in the cookie window (without recording who chose it). No cookies or other storage are used for this. We do not store your IP address; to count unique visits we use a hash that changes every day and does not identify you. Links in emails we send to salons may contain a recipient marker, in which case we know the page was opened by someone from that salon (legal basis: our legitimate interest in business contacts, Article 6(1)(f)). Statistics are stored on our server, not shared with anyone, and deleted after 12 months.

Changes to this policy

We will update this page when the way we process data changes, and show the date of the last change below. Children: rytuo.com is a site for businesses and is not directed at children.

Last updated: 9 November 2026.