Privacy Policy
Version 1 · effective September 27, 2026
Data controller
The controller of the personal data collected through melee.pl and the Melee app is:
[TO BE FILLED: full company name, registered address, tax ID (NIP), business registration number (CEIDG or KRS)].
Contact for data protection matters: kontakt@melee.pl.
What data we collect, and from whom
We collect data from four groups of people:
- a visitor to the melee.pl site — the technical data described in the service table below; the site sets no cookies (see below);
- someone on the beta list, the marketing list, or the demo list — an email address, first name, fleet name, fleet size, language, and the content of the contact or demo form message;
- a fleet owner using the Melee app — the account’s email address, first and last name, avatar, and the fleet data listed below;
- a driver invited by a fleet owner into the Melee app — first and last name, phone number, email, an identifier, the start date, the employment form, the settlement form, plus the ride, shift and GPS position data listed below.
Fleet data held in the app
On the fleet owner’s behalf, the Melee app stores: driver data (name, phone, email, identifier, start date, employment form, settlement form), vehicle data (name, identifier, registration number, inspection date), shifts, rides (earnings, passenger count, ride type, start and end time, cancel reason), ride positions (latitude, longitude, accuracy, address — recorded only at ride start, a passenger change, and ride end; the app does not track location in the background), and driver invitations (email address).
For this data, the fleet owner is the controller, and Melee processes it only as a processor — see “Melee’s role as processor for fleet data” below and the data processing chapter in the Terms of Use.
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Beta list or demo list sign-up, confirmation email | consent (GDPR Art. 6(1)(a)) |
| Sending marketing emails to the marketing list | consent (GDPR Art. 6(1)(a)) |
| Marketing consent | consent (GDPR Art. 6(1)(a)) — see “Marketing consent” below |
| Creating and running the app account, providing the service to the fleet owner and the driver | performance of a contract (GDPR Art. 6(1)(b)) |
| Site and app security, abuse prevention | legitimate interest of the controller (GDPR Art. 6(1)(f)) |
| Cookie-free site analytics | legitimate interest of the controller (GDPR Art. 6(1)(f)) |
| App crash and error reports | legitimate interest of the controller (GDPR Art. 6(1)(f)) |
Who we share data with — services
We use the services below. Each processes data in the scope described in the table, under a data processing agreement (GDPR Art. 28) between Melee and that provider.
| Service | Role | Data it gets | Where |
|---|---|---|---|
| Cloudflare | hosting, CDN, Workers, request logs; the auth.melee.pl proxy |
IP address, user agent, request URL | global edge network; a US company |
| Cloudflare Turnstile | bot check on the sign-up and contact forms | browser signals, IP address | a US company |
| Brevo | the beta list, the marketing list and the demo list, double opt-in confirmation emails | email address, first name, fleet name, fleet size, language, demo form message | EU |
| PostHog (EU, cookieless) | site analytics, no cookies | page views, funnel events, UTM parameters, an anonymized or hashed visitor id | EU (Frankfurt); a US company |
| Supabase | the app database, sign-in, avatar storage | account email, first and last name, avatar; the fleet data described above | eu-central-1 (Frankfurt); a US company |
| Resend | email sign-in codes and driver invitations | email address, email content | a US company |
| Sentry | app crash and error reports (sendDefaultPii=false, no personal data by default) |
user id, fleet id, role flags, device and app info | [TO BE FILLED: Sentry server region]; a US company |
| Google geocoding | turns a ride’s GPS coordinates into a street address on Android; on iOS, only Apple’s own on-device geocoding is used, and no data leaves the device | latitude and longitude | a platform service (Android) |
| Firebase App Distribution | test builds for beta testers | tester’s email address | a US company (Google) |
Marketing consent
When you check the marketing consent box in the Melee app (“zgodnie z Polityką prywatności” / “per the Privacy Policy”), you agree to receive marketing information about the Melee product under this Privacy Policy. You can withdraw consent at any time by writing to kontakt@melee.pl; withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
Transfers outside the European Economic Area
Some of the providers in the service table (Cloudflare, Cloudflare Turnstile, PostHog, Supabase, Resend, Sentry, Firebase App Distribution) are US-based companies, or process data outside the EEA. These transfers rely on a European Commission adequacy decision (the EU-US Data Privacy Framework) or standard contractual clauses approved by the European Commission.
Retention periods
- Account data and fleet data — for the length of the agreement, plus [TO BE FILLED: the retention period after the relationship ends, matching tax and accounting rules].
- Beta list, marketing list and demo list data — until consent is withdrawn, or [TO BE FILLED: a maximum retention period].
- Security logs and analytics data — [TO BE FILLED: retention period].
- Sentry error reports — [TO BE FILLED: retention period].
Your rights
You have the right to: access your data, correct it, have it deleted, restrict its processing, receive it in a portable format, and object to processing based on legitimate interest. Where processing relies on consent, you can withdraw that consent at any time. You also have the right to file a complaint with the President of the Personal Data Protection Office (UODO).
To use these rights, write to kontakt@melee.pl.
Deleting your account
The app does not yet offer self-service account deletion. To delete your account and its data, write to kontakt@melee.pl.
No cookies
The melee.pl site sets no cookies on your device. Site analytics (PostHog) runs in a cookieless mode.
Melee’s role as processor for fleet data
For driver, vehicle, shift, ride and GPS position data (the “Fleet data held in the app” section above), the fleet owner is the controller, and Melee processes it only on the owner’s instructions, as a processor. The terms of this arrangement are set out in the “Data processing agreement” chapter of the Terms of Use.
Changes to this Privacy Policy
A change to this Privacy Policy gets a new version number and a new effective date in this document’s header.