XYZ-365

Draft – pending legal review.

Privacy policy

Last updated: 8 October 2026. Applies to xyz-365.com and to the GlucareHub service (glucarehub.com).

1. Controller

The data controller is XYZ-365, Krzysztof Mazurkiewicz, Lublin, Poland, NIP 6911024072. Contact: krzysztof@xyz-365.com.

2. Data we process

  • contact data you send by e-mail (name, e-mail address, message content);
  • GlucareHub account data: e-mail address and, for paid plans, billing data;
  • e-mail addresses and (if enabled) Telegram identifiers of carers who receive alerts;
  • data in your Nightscout instance, including glucose readings – this is health data (Art. 9 GDPR);
  • technical server logs (IP address, request time) to the extent necessary.

3. Purposes and legal bases

  • replying to messages – legitimate interest (Art. 6(1)(f) GDPR);
  • providing the hosting and alert service – performance of a contract (Art. 6(1)(b));
  • processing health data – explicit consent (Art. 9(2)(a));
  • billing and tax obligations – legal obligation (Art. 6(1)(c));
  • service security – legitimate interest.

Planned AI summaries (Claude API) are not available yet. When they launch they will be optional and based on consent that you can withdraw at any time; we will update this policy before launch.

4. Recipients

  • the infrastructure provider that runs GlucareHub (servers in the EU);
  • Cloudflare – delivers the xyz-365.com website and processes technical request data such as IP addresses;
  • an e-mail delivery provider – for alerts and account messages;
  • Telegram – only if a carer turns on Telegram alerts;
  • a payment provider – only when you buy a paid plan;
  • public authorities where required by law.

We do not currently share any data with Anthropic. That will change only when the planned AI summaries launch, and only for people who opt in.

5. Retention

Account and Nightscout data – for as long as you use the service; you can ask us by e-mail to delete it earlier. Correspondence – as long as needed to handle the matter. Billing documents – as required by law. Technical logs – as long as needed to keep the service secure.

6. Your rights

You have the right to access, rectify, erase, restrict, port your data, to object, and to withdraw consent at any time (without affecting prior lawful processing). You may lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

7. Profiling

We do not profile for marketing purposes and make no solely automated decisions with legal effects.

8. Cookies

We use only strictly necessary cookies (e.g. the GlucareHub login session). No analytics or advertising cookies and no trackers.

9. Changes

We will announce material changes on this page and, where appropriate, by e-mail.