Privacy policy

Last updated: 14 September 2026. Covers the migiem Android app and the migiemfaktury.pl website. The Polish version is the binding one.

1. Who is responsible

The data controller is PRACOWNIA ADAM KUSIAK, Polish tax ID (NIP) 5242696031, REGON 362824189, ul. Żurawia 6/12 lok. 745, 00-503 Warsaw, Poland. For anything about your data, write to [email protected].

The client details you put on invoices are processed by you, as the controller for your own business. We see them only for a moment, while turning your dictation into invoice data (section 3), and we do that on your instruction.

2. What stays on your phone

The app works without an account and without a database on our side. The app's private storage on your phone holds:

• your company details (name, tax ID, address, trade, bank account),
• your clients and your invoices: issued ones and those downloaded from KSeF,
• your KSeF credential (token or certificate), encrypted with a key from the Android Keystore that never leaves the device,
• settings and the counter of voice invoices used this month.

Android system backup is switched off for this data. Uninstalling the app deletes all of the above. We have no access to it and cannot recover it.

3. Dictating an invoice

When you dictate an invoice, the app records your voice (using the microphone permission you grant in the system). The recording goes over an encrypted connection to our server, which runs on Cloudflare. The server asks OpenAI (whisper-1 and gpt-5-mini models, via the API) to turn speech into text and read the invoice details out of it.

Together with the recording we send what helps recognise the invoice correctly: your company's tax ID, the names of your clients (so "for Kowalski" matches the right company), your trade, your default payment term and the app language. You can also paste text instead of recording; then we send only the text.

Our server does not store the recording, the text or the recognised invoice. It stores only the numbers needed for cost accounting: recording length in seconds, number of processed tokens, cost and a random request ID. Technical logs contain no content, tax IDs or IP addresses. The recording on the phone is deleted after it is sent.

OpenAI processes the data under its business API terms: it does not train its models on it and keeps it for at most 30 days for abuse monitoring, then deletes it.

4. KSeF and the VAT whitelist

You send invoices to KSeF (the Polish national e-invoicing system run by the Ministry of Finance) directly from your phone, with your own credential. You download invoices issued to your company the same way. This traffic goes straight from your phone to KSeF, not through our servers.

When you check a client, the app sends their tax ID to the Ministry of Finance VAT whitelist (wl-api.mf.gov.pl). It is a public register; we are not in the middle of that request.

5. Notifications

Notifications about new invoices in KSeF and about payment deadlines are created by the app itself, on the phone, after it checks your KSeF inbox. There is no push server and we send no push tokens anywhere. You can turn them off in the system settings (notification permission).

6. App statistics and crash reports

To know what breaks and what gets used, we rely on Google services: Firebase Analytics, Crashlytics and Performance Monitoring. They receive: in-app events (for example "invoice issued", "pricing shown"), phone model, Android and app version, approximate country, crash reports with stack traces, and a pseudonymous installation ID assigned by Firebase. The only user properties we set are: light or dark theme, whether KSeF is connected, and a broad trade category from a fixed list.

Invoice contents, amounts, tax IDs and client names never reach the statistics. Collection is disabled in developer builds.

7. Pro subscription

Payment is handled by Google Play. To manage the subscription we use RevenueCat, which receives an anonymous installation ID and the purchase confirmation from Google Play, so it knows whether the Pro plan is active. We never see your card number or payment details; only Google has those.

8. Ads

The app shows no ads, starts no ad network and does not profile you for advertising.

9. Who else sees the data

• Cloudflare, Inc. (USA): the server that processes dictations, website hosting, website statistics.
• OpenAI, L.L.C. (USA): speech to text and reading invoice details.
• Google LLC (USA): Firebase (statistics, crashes), Google Play (distribution, payments).
• RevenueCat, Inc. (USA): subscription status.
• Polish Ministry of Finance: KSeF and the VAT whitelist, which you connect to yourself.

US companies operate under standard contractual clauses or the EU-US Data Privacy Framework. We do not sell data and do not pass it to anyone for marketing.

10. Legal basis (GDPR)

• performance of a contract, that is running the app you use: dictation, KSeF, subscription (Art. 6(1)(b)),
• our legitimate interest: statistics, crash detection, security and abuse prevention (Art. 6(1)(f)),
• your consent: microphone and notification access, which you grant in the system and can withdraw at any time (Art. 6(1)(a)).

11. For how long

• on your phone: until you delete the data or the app,
• our server: we store no content; cost counters without personal data are kept for accounting,
• OpenAI: up to 30 days,
• Firebase: statistics up to 14 months, crash reports 90 days,
• RevenueCat: for the life of the subscription and the period required for accounting.

12. Your rights

You have the right to access, rectify, erase, restrict, object to and port your data. Data on your phone you delete yourself by uninstalling the app. To have statistics or subscription data removed, email [email protected]; we reply within 30 days. You can also lodge a complaint with the President of the Polish Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw) or your local supervisory authority.

13. Children

The app is a business tool intended for adults. We do not knowingly collect data from children.

14. The migiemfaktury.pl website

The website uses no cookies and no browser local storage, so there is no consent banner. Traffic is measured with Cloudflare Web Analytics, which works without cookies and shows only aggregate data (page views, referrers, country, page speed). Cloudflare, as the network operator, sees technical connection data including your IP address and uses it to deliver and protect the site (Art. 6(1)(f) GDPR). The "Download" button leads to Google Play, which has its own privacy policy.

15. Changes

When we change how data is processed, we update this document and the date at the top. The current version is always at this address, and the app links to it from its settings.