After signing in you'll come back here.
Free. No phone number needed.
Document
Last updated: 04.11.2026
This document explains what data we collect, why, who sees it, who we entrust it to and how to delete it. We describe what the service actually does — in plain language and without filler.
The data controller is INGVARR Sp. z o.o., registered in Katowice — the company that runs the robotatut.pl service. Full registration details and the address are at the end of this page.
For any matter concerning your data, write to the address given at the end of the page or use the “Write to us” form. We have not appointed a data protection officer — the law does not require us to; the company’s management board is directly responsible for this.
At sign-up: your e-mail address and password (or your Google account, if you choose that way in — then Google gives us your name, e-mail address and photo). We store the password only as an irreversible hash — we do not know it and cannot read it.
Later, if you provide them: first name and surname, profile photo and cover, profession and specialisations, city, experience, licences and certificates, languages, CV, description, photos and videos of your work, posts, reels, stories, comments, messages, voice messages and files sent in a chat, applications for jobs, contracts, services and bookings.
What we do NOT ask for and do not keep: phone number, sex, date of birth, ID document number, home address. We remove the location and camera data from photos and videos before they reach the server.
A profile is not mandatory — but until it is filled in, companies cannot find you by profession.
Name, NIP (tax ID), address, company number (the company’s work phone, not a person’s), logo, description, gallery, job ads, contracts and services. A company’s data on its page and in its job ads is public — the company provides it so that it can be found.
Data of people acting on behalf of a company (owner, manager, recruiter): first name and surname, e-mail address, role in the company, and who did what in the company account (for example, who published a job ad or bought a plan).
For invoices: company details with NIP and an e-mail address for invoices. We check the NIP in public registers (KRS, the VAT white list, REGON) to show the “Verified company” badge.
The server’s technical log: IP address, time, browser and device. It is needed for security, investigating abuse and fixing errors.
The list of devices on which your account is open, with an approximate city (worked out from the IP address), and your sign-in history (Settings → Security).
A device identifier for notifications — when you turn them on.
Your chosen language, theme, the role your account is open in (“Looking for work” or company), and your privacy and notification settings.
Viewing traces: who opened your profile or CV and when (we show this in “Who viewed”), which company opened your data, how many times a job ad or post was viewed (companies and authors see only totals, not names).
Note: when you open someone else’s profile while signed in, that person may see it in “Who viewed”.
We store only the city you enter yourself in your profile, job ad or contract.
The “My location” button in search asks your browser for your location once, with your consent, turns it into the nearest city and stores nothing. A location you send in a chat is seen only by the other person in that chat.
Account, profile, search, jobs, applications, contracts, bookings, chats, calls, the feed, content translation — so that the service works the way you request it (Art. 6(1)(b) GDPR).
Payments, invoices, KSeF (National e-Invoice System), accounting, responding to requests from courts and authorities, obligations under the Digital Services Act (DSA) — because the law requires it (Art. 6(1)(c)).
Security, protection against fraud and spam, moderation, limits, statistics on how the service works, showing ads by profession and location (city or region), establishing and pursuing legal claims — our legitimate interest (Art. 6(1)(f)). You can object to this (pr_18).
E-mail notifications about new jobs, “Profile on Google”, access to the microphone, camera and location — only with your consent, which you can withdraw at any time (Art. 6(1)(a)).
We do not sell your data, do not rent it out and do not pass it to anyone for their own advertising.
Profile: you choose who can open it — Everyone, Signed-in users only, Companies only or No one (Settings → Privacy). “Profile on Google” is off by default; when you turn it on, search engines may show your name, profession and city.
CV: a company sees it when you apply for its job or when you have “Looking for work” turned on. Otherwise the company has to ask (“Request CV”), and you agree or not. Every time a company opens your CV, you see it in “Who viewed”. You can hide a chosen company — then it will not find you at all.
No one but you sees your list of contacts.
Posts: “Everyone” — anyone with access to the feed; “Contacts only” — only your contacts. Stories disappear after 24 hours.
Your contacts see “Online” — you can turn it off in Settings → Privacy. “Read” is always visible to the person you chat with.
We do not show a phone number anywhere, because we do not have one. When someone types a number or an address into a text, the portal covers it and suggests a chat in Messages.
A company that downloads its applications to a file is itself responsible for that file — the portal cannot undo what the company has saved on its side.
Moderation sees data when it handles a report or checks content before publication; we record every such access.
We store messages, photos, videos, video notes, voice messages and files from chats on the server — without this, the chat does not exist. They are seen by the participants in the chat, and by moderation only when someone reports the chat.
A message deleted “for both” disappears for both sides and stays in the database for 90 days — it is the only trace when someone reports threats or fraud. Disappearing messages disappear 1 hour after being read and do not come back.
There is a storage limit for chat files (Settings → Chat files). What you delete on your side stays with the other person.
Voice and video calls are possible only between contacts and are NOT recorded. Sound and video go directly between devices, encrypted from one end to the other; when the network requires it, they go through our relay server, which neither decrypts nor stores them. We record only who talked to whom, when and for how long.
Captions in conferences are off by default. When you turn them on, speech is turned into text by your browser, which sends the voice to its maker’s speech recognition service (Google in Chrome, Apple in Safari). We receive the finished sentence and show it to the other participants.
Everyone reads the portal in their own language. Posts, comments, job ads, contracts and messages are machine-translated when they are saved: the text (without the name and without any file) is sent to the DeepL translator and comes back translated. The original is always one tap away: “Show original”.
DeepL operates in the European Union (Germany) and does not use the texts it receives to train its models.
To keep the portal safe, some content is first checked by a program: it covers phone numbers and addresses in text, stops requests for upfront payment, and flags offensive words and content that looks like fraud. Ads and a new company’s job ads are reviewed by a person before they are shown for the first time.
The program never blocks an account on its own. When content is taken down or an account is restricted, you receive a statement of reasons: what, why, on what basis, and whether a person or the program decided. You can appeal within 6 months — an appeal is always handled by a person (DSA, Art. 17 and 20).
Anyone, even without an account, can report illegal content. We tell the person who reported the outcome; we do not show their details to the person reported.
A feed ad always carries the label “Sponsored” and a “Why am I seeing this?” button: who pays and why it is shown to you.
We choose ads only by the profession and location (city or region) in your profile. We do NOT use: age, sex, messages, contacts, health, views, or what you do outside the portal. There are no ads in the “Contacts” filter or next to “Contacts only” posts.
The advertiser does not get your data — it sees only totals: how many people saw the ad and how many clicked.
You can hide and report an ad. You can object to ads being chosen by profession and location (city or region) in Settings → Privacy or by writing to us — ads will then be general, not targeted.
You pay for plans, promotion and Premium through the payment operator Przelewy24 — by BLIK, card, Google Pay or fast bank transfer. We do not see or store your card number or your bank login details; the operator passes us only the result: paid or not, amount, time.
We issue companies a VAT invoice in KSeF — the invoice data goes to the Ministry of Finance, because the law requires it. Invoices are created by an invoicing system Fakturownia. A person without a company receives a payment confirmation by e-mail.
Who in a company may pay, and up to what amount, is set by the company owner; we record every purchase with the name of the person who made it.
We keep accounting documents for 5 years from the end of the year in which the tax payment deadline passed — as tax law requires. They remain even after the account is deleted.
We send push notifications only about things that concern you: a message, an application, an invitation, a call, a deadline ending. You can turn each type on and off in Settings → Notifications.
For a push to arrive, the device identifier goes to an intermediary: Google (Firebase) for the Android app, and for a browser — its maker’s intermediary (Google, Mozilla, Apple, Microsoft). A notification contains the sender’s name and the beginning of the message; on a locked screen we do not show message content or amounts.
We send e-mails only when they are needed: address confirmation, a new password, account security, an invoice, an important change to the terms, or when a push has nowhere to go. We do not send marketing e-mails without your consent.
Notifications about new jobs (also without an account): we keep your e-mail address and criteria — profession, city, region, rate, language and country — solely to send matching jobs. We do not give this address to companies. You unsubscribe with the link in every e-mail; unsubscribing deletes the saved search. We delete an unconfirmed address after 30 days.
The app shows the same service as the website and is covered by the same policy. You can download it from Google Play or from the robotatut.pl website.
We ask for permissions only when they are needed: notifications — at the first important event, microphone — at the first call or voice message, camera — at the first photo or video. You can withdraw each one in your phone’s settings.
The app does not collect the advertising ID, your contact list, SMS messages or background location.
Our data is processed on our behalf, under a data processing agreement, only by:
• server and database hosting — servers in Poland (SEOHOST.pl);
• the call relay server — our own server in the European Union (Hetzner, Germany);
• outgoing mail — a mailbox with the hosting provider in Poland;
• Google Ireland Ltd — notifications (Firebase Cloud Messaging) and encrypted backups (Google Drive);
• DeepL SE (Germany) — content translation;
• the payment operator Przelewy24 and the invoicing system Fakturownia;
• an accounting office — accounting documents.
Separately, as independent controllers: Google when you sign in with a Google account and in Google Play; your browser’s maker for push and conference captions; the Ministry of Finance (KSeF); courts and authorities when they request data under the law.
Some Google services may transfer data outside the European Economic Area (USA). This is done on the basis of a European Commission decision (EU–US Data Privacy Framework) and standard contractual clauses.
• An account and its content — until you delete it.
• An account no one has used for 24 months — we send a reminder (notification or e-mail); after 36 months without signing in we delete it (first 30 days in the bin, you can come back).
• Stories — 24 hours.
• “Who viewed” — 90 days.
• The record of which company opened your CV or data, and when — 12 months.
• A message deleted “for both” — 90 days in the database, then permanently deleted.
• Call records (who, when, how long) — 12 months.
• The server’s technical log — up to 12 months.
• Moderation cases and appeals — 12 months from the end of the case; longer if a dispute or proceedings are under way.
• The record that an e-mail was sent — 30 days; when an account is deleted, we remove your address from it straight away.
• Job notifications — until you unsubscribe; an unconfirmed address — 30 days.
• Invoices and payment documents — 5 years from the end of the tax year.
• Backups — daily for 4 weeks and monthly for 12 months; deleted data disappears from a backup when that backup expires.
You can download a copy of everything the portal holds about you — profile, CV, posts, messages, chat files, applications, contracts, contacts, payments — yourself: Settings → My data → “Download a copy (.zip)”.
You delete your account yourself: Settings → “Delete account”. You confirm with your password (if you sign in with Google — with a code sent by e-mail). You disappear from the portal at once, and for 30 days you can come back by signing in. After 30 days we delete the account permanently and send a confirmation to your address.
After deletion, your profile, CV, posts, stories, comments, contacts and your chats disappear. Applications sent to companies stay with them, with their text and date, but without your name, e-mail address or profile link. Also kept is what the portal cannot undo (a file a company downloaded to its own systems) and what the law requires (accounting documents — 5 years).
Deleting a company account: this is done by the company owner; job ads disappear, invoices are kept for the period required by law. Full description — on the “How to delete your account” page.
You have the right to: know what data we hold and get a copy of it; correct it; delete it; restrict its use; move it to another service; withdraw your consent at any time (without affecting what happened before the withdrawal).
You have the right to object to what we do on the basis of our legitimate interest — including choosing ads by profession and location (city or region).
You have the right not to be subject to a decision made solely by automated means: a decision by the program can always be reviewed by a person.
Write to us — we reply within one month at the latest (for a complex matter we may extend this by two months, and we will let you know).
If you believe that we process data unlawfully, you can lodge a complaint with the Prezes Urzędu Ochrony Danych Osobowych (President of the Personal Data Protection Office, UODO), ul. Stawki 2, 00-193 Warszawa (uodo.gov.pl).
We use only the cookies without which the service does not work:
• session — so you do not have to enter your password on every page (until you close the browser or sign out);
• “Remember me” — when you tick it (up to 12 months);
• protection of forms against request forgery (CSRF) — for the duration of the session;
• chosen language and theme — 12 months;
• a trace of entry to moderation — for moderators only.
The law does not require consent for such cookies, so we do not show a consent banner.
Small conveniences stay in your browser storage: the last tab you opened, a hidden bar, an unfinished message. This stays on your device and is not sent to us.
We have no advertising or tracking cookies and no third-party analytics. If they are ever added, we will ask first — in a single window with equally visible “I agree” and “Essential only” buttons — and you will be able to change your choice at any time in “Cookies”.
The connection to the service is encrypted (HTTPS). We store passwords as an irreversible hash. We confirm every new sign-in to your account with a “New sign-in” e-mail containing a “That wasn't me” button, and you can log out of all devices in Settings → Security. Backups are encrypted. Only a few people in moderation have access to data, with two-step sign-in, and we record every access.
If a breach occurs that may put you at risk, we will notify UODO within 72 hours, and you without undue delay.
The service is for adults — aged 18 and over. We do not run accounts for children and do not knowingly collect their data. If we learn that an account was created by a minor, we delete it.
When we change it, the date at the top and “What changed” will change. We will give notice of an important change in the service and by e-mail at least 14 days in advance. We send previous versions on request.