Privacy policy

The controller of your personal data is Marcin Frątczak Labs, ul. Warszawska 40/2A, 40-008 Katowice, Poland, tax ID (NIP) 6252163911. For anything about your data, write to [email protected].

For employee data processed within a company account - names, work email addresses, learning results visible in the company panel (reports, employee page, error statistics) - the controller is the employer, and we process that data on its behalf as a processor.

• account: your email address, optionally your first and last name, the date you accepted the terms and the version you accepted; if you log in with Google, also your Google account identifier and your name, if Google provides it - Google also confirms to us that the email address belongs to you
• learning: lesson and test results (speed, accuracy, number of errors, time), pairs of mixed-up characters that feed the error map, certificates issued, goals and trainer settings
• company accounts: company name, group membership and role (administrator, instructor, participant)
• purchases: transaction ID, number of seats paid for and the amount - as passed on to us by the payment provider
• correspondence: whatever you write to us yourself
• security: your IP address when you log in and when login codes are sent - we use it only to limit the number of attempts and never store it permanently; when you request a code, Cloudflare Turnstile checks that a human, not a script, is asking, and in doing so sees your IP address and browser data
• login log: the date and method of creating your account and of each login (email code or Google) - without IP address or browser data; it helps us when you write that you can't log in
• how you found the site: the campaign name and tags from the link (source, traffic type, ad keyword, ad click ID), the landing page and the address of the page you came from - recorded once, when your account is created
• consent to news emails: whether you gave it, and the date - or that you didn't
• visit statistics: page views, page address without parameters (except utm campaign tags), traffic source, approximate country, device and browser type, and on public pages also cursor movement, clicks and scrolling

Card payments are handled by Dodo Payments as the merchant of record - your card number never reaches us. Speed tests work without an account and without storing anything about you: if you're not logged in, the result stays only in your browser, and we store it only when you add it to your account after logging in.

• running your account and the course, saving progress, issuing certificates - performance of a contract (Art. 6(1)(b) GDPR)
• billing and keeping billing records - legal obligation (Art. 6(1)(c) GDPR)
• progress reports for the company account administrator - performance of the contract with the company; toward employees we act as a processor
• security, preventing abuse, defending against claims - our legitimate interest (Art. 6(1)(f) GDPR)
• replying to messages - our legitimate interest, in other words ordinary courtesy put into legal terms
• visit statistics and improving the site - our legitimate interest (Art. 6(1)(f) GDPR); you can object to this
• news emails - your consent (Art. 6(1)(a) GDPR), separate from the terms and not required to create an account; you can withdraw it with one click on your account page or in the footer of any such email, and withdrawing it doesn't affect what we sent before

We don't profile you, we don't make automated decisions with legal effects, and we don't sell data.

Data is processed on our behalf only by the providers needed to run the site:

• Prisma Data, Inc. - managed Postgres database (EU region)
• Amazon Web Services EMEA SARL (Luxembourg) - Amazon SES: sending the site's email, namely login codes and invitations to employee accounts with a name and email address; processed in the eu-central-1 region in Frankfurt
• Dodo Payments Inc. (Delaware, United States) - card payment processing as merchant of record; billing details and email address
• Hetzner Online GmbH - application hosting, Germany
• Microsoft Ireland Operations Ltd. - Microsoft Clarity: visit statistics and recordings of activity on public pages
• Cloudflare, Inc. (San Francisco, United States) - Cloudflare Turnstile: checking that a human, not a script, is asking when a login code is requested; forwarding email sent to addresses on the site's domain to our mailbox

We send email through the European region of Amazon SES (eu-central-1, Frankfurt), so message content and recipient addresses stay in the European Economic Area.

Some of the others (Google, Dodo Payments, Microsoft, Cloudflare) may process data outside the European Economic Area. Such transfers are based on the European Commission's standard contractual clauses and - where applicable - an adequacy decision.

We share data with public authorities only when the law requires us to.

• account data and progress - as long as the account exists; deleting the account deletes them irreversibly
• login log - the entry about creating the account as long as the account exists, login entries for 12 months
• billing data (purchases) - 5 years from the end of the tax year, as required by the Polish Tax Ordinance
• correspondence - up to 3 years, in case the matter continues
• certificates - as long as the account exists; the verification code stops working when the account is deleted

• access to your data and a copy of it
• correction of inaccurate data
• erasure of your data (the "right to be forgotten")
• restriction of processing
• portability of the data you provided to us
• objection to processing based on our legitimate interest

Just email [email protected]. We reply within one month at the latest. You also have the right to lodge a complaint with a supervisory authority: the authority for our company is the President of the Personal Data Protection Office (UODO) in Poland (uodo.gov.pl), and you can also complain to the data protection authority in the EU country where you live or work, or where the alleged infringement took place - though we'd prefer you write to us first.

If you use a company account, send requests about data visible in the company panel to your employer; we'll help your employer handle them.

We measure how our pages are used - how many people start a lesson, where they stop reading, which button confuses them. We use two tools for this:

• Umami - a page view counter running on our own server. It sets no cookies, builds no profile and doesn't store IP addresses. It records page addresses without parameters - except campaign tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term) - so one-time codes in links never reach it.
• Microsoft Clarity - click and scroll maps and recordings of activity on the page. Recordings don't show what you type into form fields: that content is masked.

Clarity doesn't run on pages behind a login - your account, learning statistics, the company panel - or on the login pages. So learning results, employee data and order data never end up in recordings, and one-time codes in links don't end up in the addresses Clarity records.

The legal basis is our legitimate interest (Art. 6(1)(f) GDPR): a site nobody measures can only be improved blindly. We don't link this data to your account, don't build an advertising profile from it and don't sell it to anyone.

You can object to this at any time - write to [email protected], and we'll reply with how to turn off measurement in your browser.

We set two cookies of our own, and both are necessary for logging in; in addition there are a few entries in browser storage and two cookies from the analytics tool:

• tt.session_token (on an encrypted connection: __Secure-tt.session_token) - your session after you log in, httpOnly; expires after 30 days without use or when you log out
• tt.state - a cookie for the duration of Google login, at most 5 minutes: it links the return from Google to the login you started
• tt_terms_pending - browser storage: a marker of terms acceptance carried through Google login; removed on return
• bezwzrokowo.sound - browser storage: the trainer's sound setting for people who aren't logged in
• tt-limit-goscia - browser storage: a daily counter of exercises done without an account, reset at midnight
• tt-wyniki-goscia - browser storage: results of exercises done without logging in, so you can add them to your account after you log in; at most 30 results from the last 14 days, removed once added or dismissed
• tt-o-kursie-zwiniete - browser storage: remembers that you collapsed the panel describing the account next to the lessons, for people who aren't logged in
• tt_zrodlo - browser storage: how you first found the site (for example a search engine or a campaign name); attached to your account when you create it
• tt_marketing_pending - browser storage: a marker of consent to news emails carried through Google login; removed on return
• tt_wejscie_karty - browser tab storage: a marker that this tab has already reported its visit to the statistics; disappears when you close the tab
• tt-zakup-<payment number> - browser storage: a marker that this purchase has already been counted in the statistics
• gra.clientId, gra.nick - browser storage: a random browser identifier and the nickname you chose in the game; the leaderboard uses them to keep your best score
• _clck, _clsk - Microsoft Clarity cookies: they let Clarity recognize that subsequent page views belong to the same visit. They don't identify a person and aren't used for advertising; the first lasts a year, the second one day
• umami.disabled, clarity.disabled - browser storage: a marker that measurement is turned off, set when you ask us to turn off visit statistics

We don't use advertising cookies, don't build profiles and don't share data with anyone for targeting. Analytics cookies are used only to count and understand visits - and you can opt a visit out of that counting, as described in the visit statistics section above.

Connections are encrypted (TLS), and there are no passwords - you log in with a code sent to your email address or with Google; we store the code only in hashed form, and it's valid for 10 minutes. Only the people who run the site have access to data, and permissions in the company panel are separated: an instructor sees only their own group.

No system is 100% secure. If a breach threatening your rights ever occurred, we would notify you and the Polish supervisory authority (UODO) in line with Articles 33 and 34 GDPR.

The date at the top always shows the version in force. We'll announce material changes - a new data recipient, a new purpose - on the site before they take effect.