Terms of Service and Data Protection

1. About the Application

Commission Clarity (hereinafter: "the app") is a tool for calculating and monitoring commissions for insurance advisors. The app functions as a calculator that, based on parameters entered by the user, calculates expected commissions and compares them with the amounts actually received.

2. Personal Data Processing

All data about policies, clients, commissions, and payout rules remains exclusively in the user's Google Sheets documents, which are owned and fully controlled by the user. The user decides which documents to share with the app and when to revoke access.

Commission rules, payout schedules, and calculation parameters are also stored in the user's Google Sheets document — the app re-reads them on every use rather than duplicating them in its own database.

Manual status changes and comments are likewise written directly by the user into their Google Sheets document. The app does not store these changes locally — it re-reads them from the user's document on each use.

The app permanently stores in its database only the minimum technical data necessary for the service to function:

• The user's email address (for sign-in and subscription billing)
• Identifiers (IDs) of connected Google Sheets documents
• Authorization tokens for Google Sheets API access (encrypted)
• Subscription status (linked to the Stripe payment system)

The stored data includes no personal data about the user's clients, no amounts, no commissions, and no policy content.

3. How It Works – Calculations

The app functions exclusively as a computational tool. Based on entered parameters (insurer, product, calculation method, value, duration, etc.), the app calculates expected commissions and compares them with actual data from the user's documents.

The app does not make decisions on behalf of the user, does not send data to third parties, and does not carry out any transactions.

4. Subscription Plans and Features

The app is available in three subscription plans. The user selects the plan that best suits their way of working:

For all three plans, the app does not copy or archive content from the user's sources. It stores in its database only the minimum metadata necessary for the service to function (e.g. links between tasks and clients, visit status, manual notes, and visit records). This metadata is created by the user and, where applicable, synced back to their Google Sheets documents so it remains under their ownership.

The user can revoke access permissions to Google Sheets, Gmail, or Google Calendar at any time, immediately preventing the app from reading this content further. Any metadata already created by the user within the app is deleted on request.

5. User Responsibility

6. Security Measures

The app provides the following security measures:

• Sign-in uses the user's email address and a secure single-use sign-in link; no password is stored by the app.
• Access to Google Sheets uses a separate authorization flow with limited (read-only) permissions.
• All data is transmitted over encrypted connections (HTTPS/TLS).
• Authorization tokens are stored in a secure database with access restrictions (row-level security policies).
• The app does not share data with third parties.

7. User Rights

The user has the right, at any time, to:

• Disconnect the app from their Google Sheets documents.
• Revoke the app's access to their Google account in their Google account settings.
• Request deletion of all data stored by the app (rules, settings, tokens).
• Stop using the app without any obligations.

8. Data Protection (GDPR)

Processing of personal data in the app is carried out in accordance with Regulation (EU) 2016/679 (GDPR) and applicable general data protection law.

8.1 Types of Personal Data We Process

• App user data: email address, Google account ID, encrypted authorization tokens for accessing Google Sheets, Gmail, and Google Calendar, subscription status (Stripe ID), and IDs of connected Google Sheets documents.
• Technical data: basic error and access logs to maintain the secure operation of the service.
• Metadata created by the user: client visit notes, task statuses, and links between tasks and clients. Where applicable, this is synced back to the user's Google Sheets documents.

The app does not store personal data of the user's clients (e.g. insured persons) in its database — it reads such data in real time from the user's Google Sheets documents and does not retain it after the session ends.

8.2 Legal Basis and Purposes of Processing

• Performance of a contract (GDPR Art. 6(1)(b)) — providing the service, authentication, access to Google Sheets, subscription billing.
• Legal obligation (GDPR Art. 6(1)(c)) — retention of accounting records in accordance with applicable tax law (up to 10 years).
• Legitimate interest (GDPR Art. 6(1)(f)) — technical logs for security and troubleshooting.
• User consent (GDPR Art. 6(1)(a)) — explicit approval for the app to access the user's Google Sheets, Gmail, and Google Calendar.

8.3 Processors and Recipients of Data

The app does not share personal data with third parties for marketing purposes. We use the following processors to operate the service:

• Supabase (database hosting and authentication) — processing may take place within the EU.
• Google LLC / Google Ireland — authentication (OAuth), access to Google Sheets, Gmail, and Google Calendar based on the user's explicit permission.
• Stripe Payments Europe, Ltd. — subscription payment processing.
• Hosting provider (CDN) — technical hosting of the web application.

If data is transferred outside the EU/EEA, such transfers are made subject to European Commission standard contractual clauses or other appropriate safeguards.

8.4 Retention Periods

• User account data: for the duration of an active subscription and up to 6 months after cancellation.
• Authorization tokens: until access is revoked by the user or the token expires.
• Invoices and payment data: 10 years (in line with applicable tax law).
• Technical logs: generally up to 90 days.

8.5 Data Subject Rights Under GDPR

As a data subject, you have the right to:

• access your personal data (GDPR Art. 15);
• rectify inaccurate data (GDPR Art. 16);
• request erasure — "right to be forgotten" (GDPR Art. 17);
• restrict processing (GDPR Art. 18);
• data portability (GDPR Art. 20);
• object to processing based on legitimate interest (GDPR Art. 21);
• withdraw consent, without affecting the lawfulness of prior processing;
• lodge a complaint with your competent data protection supervisory authority.

Requests to exercise any of the above rights can be sent to the contact details of the controller listed in the section on the site operator. We will respond no later than 30 days after receiving the request.

8.6 Security of Processing

We implement appropriate technical and organizational measures to protect personal data: encrypted transmission (HTTPS/TLS), encrypted storage of authorization tokens, database-level access restrictions (row-level security policies), regular system updates, and data minimization.

8.7 Automated Decision-Making and Profiling

The app does not carry out automated decision-making with legal effects on individuals and does not carry out profiling within the meaning of GDPR Art. 22.

8.8 Cookies and Browser Local Storage

The app uses only strictly necessary cookies and browser local storage (localStorage). We do not use analytics, advertising, or profiling cookies. All keys listed below are consistent with our Cookie Policy, where they are described in more detail.

• sb-<project>-auth-token (Supabase session) — until sign-out or session expiry.
• anima-rq-cache (React Query cache) — up to 24 hours.
• pn_sheets_cache_v1::* (Google Sheets read cache) — up to 7 days.
• pn_sheets_inc_v1::* (incremental row cache) — up to 30 days.
• sub_cache_v1 (subscription status) — up to 24 hours (or 5 minutes near expiry).
• pn_sidebar_mode, pn_active_days (user preferences) — persist until the user clears them.
• Third-party cookies: Stripe Checkout (during payment) and Google OAuth (during sign-in/connection to Google).

Google OAuth access and refresh tokens are not stored in the browser, but encrypted in our database (see sections 8.1 and 8.4).

8.9 User Responsibility as Data Controller

When processing personal data of their own clients (insured persons) in their own Google Sheets documents, the app user acts as an independent data controller under GDPR. The user is solely responsible for the legal basis of that processing, informing their clients, and ensuring their rights.

9. Subscription and Payment

Access to the app requires an active subscription. The user can choose between three individual plans (Client Hub, Commission Monitor, or the Combo plan), each available in two billing intervals:

• Client Hub — €20.00/month or €200.00/year.
• Commission Monitor — €20.00/month or €200.00/year.
• Combo (Client Hub + Commission Monitor) — €30.00/month or €300.00/year.

An annual subscription offers savings compared to monthly billing. All subscriptions are commitment-free — the user can cancel at any time.

Payment is processed through the secure Stripe payment system. The subscription automatically renews at the end of the billing period unless the user cancels it beforehand.

The user can manage their subscription (change plan, cancel, update payment method) on the My Account page within the app.

Upon cancellation, the user retains access until the end of the already paid billing period. After the subscription expires, access to the app's features is disabled, but stored data (rules, settings) is preserved in case of reactivation.

10. Trial Period

With the first subscription, the user is entitled to a 14-day free trial period. During this time, all features of the app can be tested without restrictions.

Each user may use the trial period up to twice. After both trial periods have been used, further free trial periods are not available — a paid subscription is required to continue using the app.

After the trial period ends, the subscription automatically continues at the selected billing interval (monthly or annual) unless the user cancels it beforehand.

11. Limitation of Liability

The app provider is not liable for any damage arising from:

• Unauthorized access to the user's Google account.
• Incorrectly entered data or parameters by the user.
• Temporary unavailability of the Google Sheets API or other external services.
• Decisions made based on the app's calculations.

12. Site Operator

13. Contact

For questions regarding data protection or the operation of the app, please contact the site operator at the address or phone number above.