Privacy policy and cookies
1. Data controller
The controller of your personal data is Artur Chruszcz Porusza, Dulina 1/9, 80-180 Gdansk, Poland, tax identification number (NIP): PL5833100159. Contact in all matters concerning personal data: [email protected].
2. What data we process, and why
| Data | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Name, e-mail address, password (stored as a hash) | Running your account, signing in, confirming the e-mail address, resetting the password | Art. 6(1)(b) - performance of a contract | until the account is deleted |
| Purchase and subscription history, amounts and currencies, Stripe payment identifiers | Taking payment, settlements, handling complaints and withdrawals | Art. 6(1)(b) and (c) - the contract, and tax and accounting duties | 5 years from the end of the tax year |
| Search queries, and the questions you ask the course assistant | Finding lessons, answering from course transcripts, improving the quality of results | Art. 6(1)(f) - legitimate interest (running and improving the search) | up to 24 months |
| Listening records - which lesson, how many seconds, when | Resuming lessons, and dividing subscription revenue among the teachers by minutes listened. The monthly payout reports keep only totals per lesson, never who listened | Art. 6(1)(b) and (f) - the contract, and the legitimate interest of paying the teachers fairly | until the account is deleted |
| Comments you post, with your name next to them | Publishing them under the lesson or on the teacher's page, and e-mailing you when someone mentions you (you can turn that off in your profile) | Art. 6(1)(b) - performance of a contract | until you or we delete them |
| E-mail address on a course waiting list | Telling you when that course opens or a seat frees up - nothing else | Art. 6(1)(b) - a service you asked for | until you leave the list |
| Server logs (IP address, time of request, browser) | Security, error diagnosis, limiting abuse | Art. 6(1)(f) - legitimate interest | up to 90 days |
Providing data is voluntary, but without a name, an e-mail address and a password no account can be created, and without payment details no purchase can be made. We do not profile you and we make no automated decisions about you with legal effects.
If you teach here: the name, photo, biography, certification and links you add to your teacher profile are published on your teacher page and next to your lessons. Your earnings statements stay in your studio, visible to you and the Operator.
3. Who processes data for us
We use processors that run the Service's infrastructure:
- Hetzner Online GmbH (Germany; servers located in Finland) - hosting of the server and the database,
- Cloudflare, Inc. - storage of the lesson audio files and streaming of video lessons,
- Stripe Payments Europe, Ltd. (Ireland) - payment processing; Stripe is a separate controller of payment data, to the extent described in its own privacy policy,
- Brevo (Sendinblue SAS, France) - sending transactional e-mail (address confirmation, password reset, purchase and waiting-list notices),
- OpenAI (USA) - processing search queries to match them with lessons. Queries are passed without your name and e-mail address; even so, do not type into the search anything you would not want passed on,
- Anthropic (USA) - generating the course assistant's answers from your question and excerpts of the course transcripts. The same rule applies: no name or e-mail address travels with the question,
- Sentry (Functional Software, Inc., USA) - error reports, configured to carry no IP addresses, cookies or request contents.
Live sessions take place on a third-party video-conferencing service chosen by the teacher; its own privacy policy applies to what happens there.
Some of these providers (Cloudflare, OpenAI, Anthropic, Sentry, and Stripe to a limited extent) process data outside the European Economic Area, in particular in the USA. Transfers rest on the standard contractual clauses approved by the European Commission or on an adequacy decision (the EU-US Data Privacy Framework). Data may also be disclosed to authorised public authorities where the law requires it.
4. Your rights
At any time you have the right to:
- access your data and receive a copy of it,
- have your data corrected,
- have your data erased ("the right to be forgotten") - except data we must keep under the law (for example accounting records),
- restrict processing,
- port the data processed under the contract,
- object to processing based on legitimate interest.
To exercise these rights, write to [email protected]. We answer within a month at the latest. You also have the right to lodge a complaint with a supervisory authority - the Operator's is the President of the Personal Data Protection Office in Poland (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), and you may equally turn to the authority in your own country of residence.
5. Cookies and local storage
- Cookies necessary for the Service to work (no consent needed):
- session_id - keeps you signed in and secures forms; until you sign out,
- locale - remembers the interface language you chose; one year,
- cookie_consent - remembers your decision about cookies; one year.
- Local storage (not cookies, never sent to us): your browser keeps the theme you chose and where you stopped in a lesson, so playback resumes there.
- Analytics cookies (only with your consent): we use none at present. Should we add a privacy-preserving analytics tool, it will load only after you click "Accept" in the banner. We use no advertising or tracking cookies, and we share no cookie data with third parties for marketing.
- You can change or withdraw your consent at any time - click "Cookie settings" in the footer. Withdrawal does not affect the lawfulness of processing before it.
- You can also delete or block cookies in your browser settings. Blocking the necessary cookies makes signing in impossible.
6. Security
The connection to the Service is encrypted (TLS). Passwords are stored only as hashes (bcrypt) - we do not know them and cannot read them. Access to production data is limited to the Operator.
7. Changes to this policy
We announce material changes to this policy by e-mail and with a notice in the Service at least 14 days before they take effect. The rules of using the Service are set out in the Terms of service.