Privacy policy

This site is static. It sets no cookies and contains no advertising or tracking scripts. It does count page views, with one cookieless beacon that cannot identify you. Beyond that, the only personal data we handle is what you send us by email, plus the technical logs our hosting provider keeps.

Last updated: 2026.09.04

1. Who is responsible for your data

Baltano is an independent one-person software studio based in Poland, run by a private individual rather than a registered company. That individual is the controller of your personal data.

The contact point for anything concerning your data is support@baltano.com. Messages are read by the controller, not by a support team.

We do not publish the controller’s name and postal address on this site. If you are a data subject or a supervisory authority and need them — to exercise your rights or to lodge a complaint — ask at the address above and we will give them to you.

The same policy applies to our product sites, merchgain.com and merchlint.com, which are run by the same controller and carry their own copy of it.

2. What we collect, and why

Email correspondence

If you write to us, we process the data contained in your message: your email address, your name if you give it, and whatever you put in the message itself.

• Purpose: answering your question and providing support.
• Legal basis: Article 6(1)(f) GDPR — our legitimate interest in corresponding with people who write to us. Where a direct contract with us exists, Article 6(1)(b) GDPR.
• Retention: for as long as needed to resolve the matter, and afterwards for up to 24 months so we can recognise a returning issue.

Page views — one cookieless beacon

This site uses Cloudflare Web Analytics, which counts page views without setting a cookie, without fingerprinting your browser and without any identifier that could follow you to another site. It reports aggregates — how many people opened which page, roughly where from, which browser — and nothing that identifies you. There is no heatmap, no session recording and no advertising pixel.

That is also why this site has no consent banner: cookieless, non-identifying measurement does not require one, and there is nothing stored on your device to consent to. Cloudflare’s own statement of what the product does and does not collect is at cloudflare.com/web-analytics.

• Purpose: knowing which pages are read and which are not, so the documentation gets written where it is needed.
• Legal basis: Article 6(1)(f) GDPR — our legitimate interest in understanding how the site is used, weighed against a measurement method chosen precisely because it does not identify anyone.
• Retention: we hold no visit-level data of our own; we see only aggregate reports in Cloudflare’s dashboard, kept for the period its service documentation states.

Search performance is read separately from Google Search Console, which reports on search results rather than on your visit and requires nothing on this site beyond a proof that we own the domain.

Server logs

Our hosting provider records standard technical data for every request to this site: IP address, date and time, the page requested, HTTP status, user agent and referrer.

• Purpose: keeping the site available and secure, and diagnosing faults.
• Legal basis: Article 6(1)(f) GDPR — our legitimate interest in the security and stability of the site.
• Retention: as configured by the hosting provider; we do not use these logs for any other purpose and do not combine them with other data.

3. What we do not do

• We set no cookies and use no local storage.
• We run no advertising, and we embed no third-party trackers, fonts, maps or videos. Apart from the cookieless beacon described above, every asset on this site is served from this domain.
• We do not build profiles and make no automated decisions about you within the meaning of Article 22 GDPR.
• We do not sell, rent or trade personal data.

4. Who else sees your data

Only the providers we need to run the service, each acting on our instructions:

• Hosting: small.pl, serving this site and keeping the technical logs described above.
• Email: support@baltano.com, carrying and storing our correspondence.
• Analytics: Cloudflare, Inc., providing the cookieless page-view measurement described in section 2.

We may also disclose data where the law obliges us to. Where a provider processes data outside the European Economic Area — Cloudflare being a company established in the United States — we rely on an adequacy decision of the European Commission or on standard contractual clauses. Tell us if you would like to know which safeguard applies to a particular provider.

5. Your rights

Under the GDPR you may ask us to:

• tell you what data we hold about you, and give you a copy;
• correct data that is wrong or incomplete;
• erase your data, where we have no overriding obligation to keep it;
• restrict how we process it;
• transfer it to another controller, where the processing rests on a contract;
• stop processing based on legitimate interest, by objecting to it.

Write to support@baltano.com and we will answer within one month. If you think we are handling your data unlawfully, you can complain to the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa (uodo.gov.pl).

6. Purchases

We do not sell anything on this site and take no payments here. Our paid products are sold through marketplaces — the marketplace is the seller and handles payment, invoicing and the transaction record. We never see your payment details.

7. Our products

This policy covers this website only. Our plugins run inside your own WordPress installation: they read the data already in your store in order to produce a report, and that data never leaves your server unless a feature you explicitly enable sends it somewhere. Each product documents its own data handling, and where a product transmits anything to us, its documentation says exactly what and why.

For Merchlint, the free version published in the WordPress plugin directory, there is nothing to document: it makes no outbound connections at all. No account, no sign-up, no usage statistics. The audit reads your store and writes its findings to its own tables on your server; removing the plugin removes them.

The same holds for Merchgain. It makes no outgoing connections either — no account, no licence check, no telemetry — and it reads rather than writes: your orders, costs, margins and product names stay on your hosting because nothing sends them anywhere. What it stores in your database is its own options and cached query results, both removed when you uninstall it. WordPress itself contacts wordpress.org to check for plugin updates; that is the WordPress updater, for every plugin on your site, and not something our plugins do.

8. Changes to this policy

If we change how we handle data, we will update this page and the date at the top of it. Material changes will be described here rather than quietly folded in. The cookieless analytics beacon described in section 2 was added on 4 September 2026, and this page was rewritten the same day.