This policy explains how Paso processes personal data on paso.to, in our web, desktop, and mobile apps, and through optional calendar, AI, and MCP integrations. It describes what we collect, why, who receives it, and your rights. Reading this policy or using Paso does not, by itself, constitute consent to tracking.
1. Who is responsible for your data
The data controller is Maciej Brzeziński, trading as Paso Maciej Brzeziński,
Nowodwór 42, 08-503 Nowodwór, Poland.
Email: [email protected].
Contact us about privacy, access, deletion, or an objection to processing. This policy also covers information someone else provides about you, such as your email address for a project invitation.
2. Data we collect and its sources
Accounts and planning content
When you register or sign in with email and password, Google, or Apple, Firebase Authentication processes sign-in credentials and assigns an account ID. We receive your email address and profile information available through your chosen sign-in method, such as your name. Apple may provide a private relay email address.
We store projects, notes, tasks, details, dates, recurrence rules, completion status, reminders, assignments, and project membership. Account and planning data are processed in Firebase, including Cloud Firestore and Realtime Database. The apps also keep local settings and cached data on your device. A free account does not mean that its data stays only on the device.
Shared projects and invitations
Project members can provide other people's email addresses for invitations and assignments. We process these addresses, membership information, and invitation status to provide collaboration and send invitations. Other members can see content and member information available to them in a shared project, including calendar events imported into that project. Share a project only with people who should have access to its contents.
Technical and notification data
Our infrastructure and providers receive IP addresses, browser or device type, operating system, app version, language, time zone, request times, account and device identifiers, and error details. An IP address can be used to infer an approximate location; this is different from accessing precise GPS location.
For notifications, we process push tokens, device and permission information, reminder times, and delivery attempts and outcomes. Reminder payloads can contain task text for display on your device, including its lock screen according to your settings. Delivery uses Firebase Cloud Messaging and, on Apple devices, Apple's notification infrastructure.
Payments and subscriptions
Paddle handles web checkout as Merchant of Record. Apple and Google handle app store purchases. RevenueCat manages subscription status and entitlements. Depending on the purchase channel, these providers process payment and billing details. We receive customer identifiers, product and plan, transaction or order IDs, amount, currency, purchase and renewal dates, trial status, refunds, and subscription status. These integrations do not provide us with your full payment card number.
Support and contact
We process your email address, messages, attachments you send, and our correspondence. The website contact form sends messages through Firebase and Resend to our support mailbox. It also uses a daily keyed hash derived from your IP address and counters to limit abuse. This hash is a pseudonymous identifier, not anonymous data.
3. Analytics, session recordings, and diagnostics
We use Mixpanel and PostHog to understand product use, diagnose problems, measure registration and subscription journeys, and compare product variants. Events describe visits, clicks, viewed sections, scrolling, onboarding, feature use, task and project changes, invitations, checkout, and subscription outcomes. Properties can include account, project, item, device, and session IDs, feature settings, timestamps, experiment variants, attribution, and purchase values. Invitation analytics can include the invited member's email address.
Website analytics receive page URLs and query parameters, referring pages, link destinations, viewport dimensions, and interactions with published page content. Avoid putting confidential information in URLs. Our backend also sends events about account, planning, and subscription activity; blocking browser scripts does not block these events.
Analytics profiles can be linked to your Paso account ID and email address. Visitor and device activity can be linked to that account during registration. These records are not all anonymous, even when reports show totals or trends.
PostHog supports session replay in the apps and receives error reports, stack traces, and diagnostic context. App replay is configured to mask text. Microsoft Clarity provides website interaction recordings and heatmaps. Recordings can show navigation, clicks, scrolling, and visible interface content, subject to masking and provider settings. These are different from microphone recordings. We do not claim that every part of every recording is anonymous or that masking removes all personal information.
4. Advertising and campaign measurement
We measure which campaigns lead to visits, registration, activation, and purchases. Links can carry campaign parameters and advertising click identifiers. Attribution information is stored in browser storage and account records and can pass between the website, app, and subscription journey.
AppsFlyer provides mobile installation attribution and OneLink download and deep links. It can receive device and installation identifiers, campaign information, and a Paso customer ID. Available advertising identifiers depend on device permissions, including Apple's App Tracking Transparency permission where applicable.
We use X advertising tools and Google Tag Manager on the website, and Google Tag Manager in the web app, to support campaign measurement. Depending on the event, browser event data can include email address, account and event identifiers, and checkout value. Google Tag Manager manages how configured tags receive these events.
We use Meta's advertising tools to measure campaign performance and optimize advertising. We collect information about key actions in Paso and share it with Meta.
For relevant Business Tools processing, Meta'sBusiness Tools Terms andjoint controller termsdescribe respective responsibilities. Meta also processes data for its own purposes under its Privacy Policy. Contact us about our disclosure and Meta about its own processing.
5. Cookies and similar technologies
Paso and providers use cookies, browser and SDK storage, and similar technologies for sign-in, preferences, cached data, identification, attribution, analytics, and advertising. The purpose matters whether a technology is called a cookie or local storage.
- Authentication and local app data support sign-in and requested functions.
- Mixpanel and PostHog identifiers connect visits and actions to analytics profiles.
- Clarity identifiers, such as _clck and _clsk, support website interaction analysis.
- Meta identifiers, such as _fbc and _fbp when present, support attribution.
- Paso's paso_landing_query_params storage keeps landing URL parameters until replaced or cleared, without automatic expiry. AppsFlyer Smart Script stores incoming parameters and referrer information. Its incoming-parameter entries have a two-hour validity window and are pruned when the script runs.
Device permissions, including Apple's tracking permission, control the relevant device functions and identifiers. Your browser and operating system also provide settings for cookies, site storage, and app permissions.
You can clear site storage or limit scripts and cookies in your browser and change device permissions in system settings. These actions do not erase data already received by providers or reliably stop backend events. Contact us to object, withdraw any consent given, or request deletion of data already held.
6. Optional calendar integrations
Google sign-in and connecting Google Calendar are separate functions. A calendar connection lets Paso access the connected email, available calendar names and IDs, selected events, titles, dates, times, time zones, recurrence, locations, meeting links, organizer and attendee names and email addresses where available, and integration metadata. We store OAuth access and refresh tokens on our backend to maintain the connection and import selected events.
The Google connection requests calendar.readonly and userinfo.email permissions. Enabling editing also requests calendar.events. With write permission and a writable calendar, rescheduling an event in Paso can update its dates and times in Google Calendar. The integration is not always read-only.
On supported Apple devices, the Apple Calendar integration requests system calendar access, reads selected calendars and events, including available locations, meeting links, and organizer and attendee information, and synchronizes selected data to Paso's backend. It can update events when you make supported changes and the calendar permits editing. Revoking device access does not itself erase copies already synchronized to Paso.
Paso uses connected calendar content for the integration and planning functions you request, not for targeting ads or training generalized AI models. Imported events can be visible to members of the destination Paso project and to an MCP client authorized to access it. Consider this before importing a private calendar into a shared project or connecting an assistant.
Paso's use and transfer of information received from Google APIs adheres to theGoogle API Services User Data Policy, including the Limited Use requirements. Disconnect Google Calendar in Paso to remove the integration and imported events. You can also revoke authorization through yourGoogle Account connections. Disconnecting Paso does not delete original events from Google Calendar.
7. AI-assisted setup and voice input
We send your text, relevant project names and task context, language, and date context to OpenAI to prepare plans and interpret assistant requests. Voice recordings are sent to OpenAI for transcription. OpenAI processes this data under itsAPI data controls.
Paso stores setup text, transcripts, generated plans, request metadata, and your changes for troubleshooting and quality review by authorized administrators. These review records have no automatic expiry; deleting a task does not delete them. You can request their deletion by email. Paso does not use them to train its own general-purpose AI model.
8. External AI clients connected through MCP
An MCP client you authorize can request data and perform supported actions under your account. Access can include projects, timeline, notes, tasks, and imported calendar events, including shared projects you can access. We process authorization records, client identifiers, tokens, and tool-use metadata to provide and secure the connection. Returned data is disclosed to the client and its provider.
The provider's privacy policy and your settings determine further use, retention, and model training. Paso cannot promise that an external AI provider will not retain or train on data it receives. Revoke access under Settings > Integrations > MCP. Revocation stops further authorized access but does not delete data the client already received.
9. Purposes and legal bases
For GDPR-covered processing, the purpose determines the applicable legal basis:
- Providing requested services: account management, content storage and sync, collaboration, reminders, subscription access, and optional integrations rely on performance of a contract or steps you request before a contract (Article 6(1)(b)), where necessary for that purpose.
- Security, support, and claims: our legitimate interests in protecting the service, preventing abuse, diagnosing faults, answering correspondence, and establishing or defending claims (Article 6(1)(f)), subject to your rights. Support may also be necessary for the contract. Invitations to people without accounts rely on our and the inviting user's legitimate interest in enabling requested collaboration.
- Legal and accounting duties: compliance with applicable obligations (Article 6(1)(c)), including legally required transaction records.
- Optional analytics, session replay, advertising, and attribution: consent (Article 6(1)(a)) where required, together with applicable device-storage rules. These are not necessary to provide your planner.
Basic account information is needed for an account. Content, calendar access, voice input, and external connections depend on features you choose; without the relevant data or permission, we cannot provide that feature. Advertising consent is not a condition for the core planning service.
10. Who receives data
Depending on the channel and functions you use, recipients include:
- Google / Firebase / Google Cloud: sign-in, databases, backend processing, app infrastructure, notifications, and logs.
- OpenAI: AI-assisted planning, assistant requests, relevant task context, and audio transcription.
- Cloudflare: website delivery and network infrastructure, including connection and request data.
- Mixpanel andPostHog: analytics and identified profiles; PostHog also handles replay and error diagnostics.
- Microsoft Clarity: website interaction analysis, heatmaps, and recordings.
- Meta,X, andAppsFlyer: advertising, measurement, attribution, and link services described above.
- Paddle,RevenueCat, Apple, and Google Play: purchases, transaction records, and subscriptions.
- Resend and Google Gmail: support, password reset messages, and project invitations.
- Project members and external MCP clients you authorize, as described above.
Authorized people operating Paso can access data as needed for support, security, maintenance, and the onboarding review described above. Authorities and legal advisers may receive data where required by law or necessary for claims. Providers' roles differ: some act on our behalf, while payment, sign-in, and advertising providers may also act as controllers for their own purposes. Their policies do not replace our responsibility for disclosures we make.
11. International processing and security
Providers operate internationally and data may be processed outside Poland and the European Economic Area, including the United States. Mixpanel and PostHog use EU collection endpoints, but that does not guarantee all support access, subprocessors, advertising, or AI processing stays in the EEA. The AI integration uses OpenAI API endpoints.
Transfers outside the EEA require an applicable mechanism, such as an adequacy decision or standard contractual clauses with any necessary supplementary safeguards. The applicable mechanism depends on the provider, contracting entity, service, and destination. Contact us for information about the mechanism and a copy of safeguards applicable to your data.
Protection includes authenticated access, access rules, restricted administrative records, and encrypted network connections. Paso's cloud service processes readable content to provide its functions; it is not an end-to-end encrypted vault. No system can guarantee complete security. Protect your devices and account as well.
12. Retention and deletion
Retention depends on the purpose and system holding the data. No single automatic deletion period covers all Paso services and providers.
- Account and planning records: retained to provide your account and content until you delete content or the account, subject to records needed for legal obligations, security incidents, or claims. Account deletion initiates removal of account data, owned planning records, onboarding and review records, and membership references in Paso's databases. Some separate integration and technical records require additional removal; account deletion does not currently guarantee removal of every calendar credential or attribution record. Disconnect integrations before deleting the account or contact us for their removal. Account deletion does not delete original events in your calendar provider.
- AI setup review: copies can outlast onboarding and deletion of imported tasks. Review copies currently remain until separately removed or deleted with the account; there is no fixed automatic retention period for them.
- Analytics, recordings, attribution, and logs: these have separate provider retention settings and may outlast your account. Account deletion does not automatically erase historical records from every analytics, advertising, or logging service. Contact us to request erasure of linked records; we assess the request and notify relevant recipients where required. Local caches and browser storage also require separate clearing.
- Correspondence: retained as needed to answer and resolve requests and, where necessary, document handling or address disputes.
- Transactions and legal records: retained for periods required by tax and accounting law and where necessary for claims. Payment providers retain records under their own obligations. Deleting a Paso account does not itself cancel a subscription with a store or payment provider.
Delete your account in the app or contact[email protected]. If data is retained after a request for a lawful reason, we will explain the reason and retention criteria. We do not promise immediate erasure from every provider, log, or backup.
13. Your rights and choices
Where GDPR applies, you can request access, correction, erasure, restriction, and portability where the relevant conditions are met. You can object to legitimate-interest processing and, at any time, to direct marketing including related profiling. You can withdraw consent without affecting the lawfulness of processing before withdrawal.
Send requests to [email protected]. We may need proportionate identity verification. We normally respond within one month; if a lawful extension is needed, we will explain it within that first month. You can complain to your local supervisory authority. In Poland this is thePresident of the Personal Data Protection Office (UODO). You do not need to contact us before complaining.
Advertising services may infer interests and match activity to profiles. AI plan suggestions are subject to your review. Paso does not use those suggestions for solely automated decisions producing legal or similarly significant effects on you.
14. Children
Paso is not intended for children under 13. Where local law requires a higher age or parental authorization for consent-based processing, that requirement also applies. The age in our terms does not mean a 13-year-old can independently consent to all tracking. Contact us if you believe a child has provided data in circumstances that are not permitted so we can investigate and take appropriate action.
15. Changes
We revise this policy when processing changes and update the date above. Where required, we provide notice before a new purpose or material change takes effect and obtain consent where needed. Publishing a new policy does not itself obtain consent.