Analytics and privacy

Operator and contact

The service operator is Daniil Klimianok. Privacy contact: daklin754@gmail.com.

Purpose of measurement

With your permission, a limited set of events about the current screen, action and outcome will help us improve Zlecora.

Data scope

We measure only admitted events about the screen, action and outcome.

We do not send names, contact details, VINs, registration numbers, form text or monetary amounts.

Recipient and possible transfers

After you give permission, selected events will be sent to Google Analytics, a service provided by Google Ireland Limited. Google uses subprocessors, and processing may involve third countries.

We do not use a user ID, advertising features, Google Signals, Enhanced Measurement, granular location or cross-domain tracking.

Order photographs

A workshop can attach photographs of the vehicle to an order, taken to document the repair. The basis is the workshop’s contract with its customer — the documented repair — which these photographs document. The photographs are stored in the workshop’s own storage area within Zlecora and are not sent anywhere else. The workshop remains the controller of these photographs; Zlecora processes them as a processor, on the workshop’s instructions. This feature is not yet available to any workshop.

A photograph is kept for as long as the order it is attached to exists, unless the workshop deletes it earlier: it is deleted when that order is deleted, or when the workshop stops using the service — there is no separate, fixed period and no other use.

Hosting and storage location

The controller of a given record is whichever party is named for that record’s category — for customer records, as stated in the relevant workshop’s own notice. The application’s database and its backups are held in Cloudflare’s EU jurisdiction; Cloudflare processes them on Zlecora’s behalf, as Zlecora’s processor. Sign-in identities — email address, profile name (if provided) and login data — are held by the identity provider Auth0, in the Europe region, as Zlecora’s processor.

VIN lookup and NHTSA

When a workshop uses the VIN lookup (/vin), the VIN you type is sent to the United States — to the public NHTSA vPIC database — solely to decode the vehicle’s make, model and specification. We do not send the customer’s name, registration plate, phone number or workshop identity along with it.

The result is only shown and is not stored unless the workshop explicitly adds the vehicle to its records. Questions about this transfer go to the operator named in the “Privacy questions” section below.

Parts wholesalers

Zlecora sends data to a parts wholesaler’s API only when the workshop connects Zlecora to its own account with that wholesaler, using API access the wholesaler issued to the workshop. Today this applies only to Inter Cars; Auto Partner and ProfiAuto have no working API connection yet, so nothing is sent to their APIs. When parts are searched, price and availability are checked or documents are fetched, the wholesaler receives only the access details of that account, the part number and the quantity (for documents, a date range). We do not send the customer’s data, the registration plate or the VIN. Zlecora never logs in to a wholesaler’s catalogue website on the workshop’s behalf.

If a workshop configures its wholesaler’s catalogue address, on an order with an assigned vehicle it can open a “find in the wholesaler’s catalogue” link — also for a wholesaler with which Zlecora has no API connection. The click sends only that vehicle’s VIN or registration plate — never the customer’s name, phone number or address — and only at the moment of the click, never automatically in the background. The catalogue opens in the employee’s own browser, and Zlecora does not log in to it on the workshop’s behalf.

SMS messages

If a workshop turns on sending SMS messages to a customer through an external gateway, that gateway receives only the customer’s phone number and the text of the message sent. We do not send the customer’s address, their other orders or vehicles, and the workshop’s internal cost or margin. This integration is not yet available to any workshop.

Invoices and KSeF

If a workshop turns on invoicing with National e-Invoice System (KSeF) support, the invoice’s data — including the buyer details an invoice requires, line items, VAT amounts and payment terms — goes to the chosen invoicing provider (for example inFakt or Fakturownia), which submits the invoice to the Ministry of Finance’s system. We do not send data beyond what an invoice requires, such as internal cost, margin or diagnostic notes. This integration is not yet available to any workshop.

The payment link (Przelewy24)

If a workshop sends a customer a link to pay for a handed-over order, the payment provider Przelewy24 (przelewy24.pl) receives only: Zlecora’s own Przelewy24 merchant account identity, the same one for every workshop, a one-time session identifier (never the order’s or customer’s own identifier), the amount to pay in PLN, a description limited to the workshop’s name and the order number, the customer’s e-mail address, and the customer’s language code. We do not send the customer’s name, phone number, address, registration plate, VIN, order line items, or the workshop’s internal cost or margin. The payment link itself is then sent to the customer as an SMS message, as described in the SMS gateway entry above. This integration is not yet available to any workshop.

WhatsApp messages

If a workshop turns on sending messages to a customer through WhatsApp (Meta’s Cloud API), Meta receives only the customer’s phone number and the text of the message sent. We do not send the customer’s address, their other orders or vehicles, or the workshop’s internal cost or margin. This integration is not yet available to any workshop — and, unlike the others described above, it is also not yet connected to any screen or process in the application, so no message can be sent through it today.

Start and retention

After permission is granted, measurement starts with the current safe view. Earlier activity is not replayed.

Event and user data in Google Analytics is retained for 2 months. New activity does not restart that period.

Your choice

Declining will not limit the app. You can change your choice at any time.

Withdrawal immediately stops further measurement and clears analytics state owned by Zlecora. It does not automatically delete data sent earlier.

Cookies and browser storage

This section lists the cookies and browser-storage keys (localStorage and sessionStorage) Zlecora uses, with their purpose and how long each is kept. The necessary entries always run; the analytics cookies described below are set only after the permission described above is given.

Necessary to sign in (no consent required)

The `__Host-dobra_robota_oidc` cookie stores the sign-in-in-progress state for 10 minutes, and the `__Host-dobra_robota_session` cookie keeps you signed in for 12 hours by default. Both are Zlecora’s own cookies (first-party), set only by our domain and unavailable to any other party. They are necessary to provide the service you explicitly requested by signing in — so, under Art. 399(3) of Poland’s Electronic Communications Law (Prawo komunikacji elektronicznej), setting them does not require your consent.

Remembered language choice (no consent required)

The `dobra_robota_locale` cookie remembers your chosen interface language for 1 year. We set it only in response to your own action — when you choose a language, or start signing in (to keep the page’s language) — never merely by opening a page. Like the pair above, this does not require consent: it stores only the interface language, not data about you.

Functional markers (no consent required)

We also store our own (first-party) functional markers, unrelated to analytics. That you have been shown “Introduction to Zlecora” is remembered on your account in the workshop (the `memberships.help_tour_seen_at` marker), not in your browser. The keys `zlecora.help-tour-seen.v1.owner`, `zlecora.help-tour-seen.v1.adviser` and `zlecora.help-tour-seen.v1.mechanic` in browser storage (localStorage) are now only read once (left by an earlier version) and are no longer written. The keys `zlecora.create.v1:<id>`, `zlecora.booking-write.v1:<id>` and `zlecora.workstation-update.v1:<id>` in session storage (sessionStorage; `<id>` is a technical identifier of the user, workshop and record) hold only technical data, no form content, and let a save interrupted by, for example, a lost connection be checked; they disappear once the save is settled or the tab is closed. They do not require your consent.

Analytics cookies (optional, only after consent)

The Google Analytics cookies `zlecora_ga_ga` and `zlecora_ga_ga_<id>` are set by Zlecora and read by Google as a third party. They expire 60 days after the last measured visit (each such visit extends that period) — separate from the 2-month retention described above for the events and user data themselves inside Google Analytics. We set them only after the analytics permission described above is given; declining, or not deciding, means they are never set.

Browser storage and your choice

We store your analytics decision in browser storage (localStorage) under the key `zlecora.analytics-consent.v1`, together with the notice version it refers to, until you change it. The `zlecora.cookie-banner-dismissed` key in session storage (sessionStorage) only remembers that you dismissed the cookie banner for the current browser session, and disappears when it ends. Neither key is sent anywhere else.

You can review and change your analytics cookie choice at any time in “Cookie settings”.

Privacy questions

Contact the operator to ask about this analytics processing or exercise your data rights.

This page does not replace the relevant workshop’s notice about customer data.