1. Data controller & scope
Szymon Dukla (NIP: 6692544511) is the controller of personal and company data processed for TankTrasa Data API customers. This policy applies to commercial API subscriptions, billing profiles, and integration support. It does not replace the consumer privacy policy for the free driver map, alerts, or garage features.
2. Data we collect
For Data API accounts we process: • Company profile: legal name, billing email, VAT/NIP where provided, billing address • Account linkage: your TankTrasa login identifier (the same credential may access both products; billing profiles stay separate) • API credentials: key labels, prefixes, creation and revocation timestamps (secrets are stored hashed; full keys are shown once at creation) • Usage and security: request counts, credit consumption, endpoint paths, timestamps, client IP for rate limiting and abuse prevention • Payment metadata: Stripe customer and subscription identifiers, invoice status (card details are handled by Stripe)
3. Why we process data
We use this data to: • Provide and secure API access under your subscription • Bill included credits, trials, and optional overage via Stripe and Metronome • Send contract notices, usage alerts, and support replies • Detect fraud, enforce rate limits, and investigate incidents • Meet accounting and tax obligations for B2B invoices
4. Processors & transfers
We share data only when needed to run the Data API: • Stripe — card payments and customer billing portal • Metronome — usage metering and contract invoicing • Resend — transactional email (invoices, alerts, support) • Hosting providers (e.g. DigitalOcean, Vercel) — infrastructure and logs Processors are bound by contracts. Data is primarily processed in the EU/EEA; where providers operate elsewhere, we rely on appropriate safeguards.
5. Retention
Billing records and invoices are kept for statutory accounting periods. API usage aggregates follow your active subscription lifecycle. Request logs used for security and metering are retained for a limited period, then aggregated or deleted unless needed for an open billing dispute or legal claim.
6. Your rights
Under GDPR you may request access, correction, deletion, restriction, portability, or object to processing where applicable. Contact privacy@tankomat.app or sales@tankomat.app. You may also lodge a complaint with your supervisory authority. Deleting a Data API profile does not automatically delete your consumer TankTrasa account, and vice versa.
7. Relationship to the driver app
TankTrasa Data API and the consumer map are separate products with separate billing. A single login may access both, but garage data, route history, push alerts, and driver preferences are governed by the consumer privacy policy — not this document. Commercial terms for API access are in the Data API Terms.
See also API terms · Driver app privacy policy · Product overview