Privacy policy

DRAFT — NOT FOR PUBLICATION. Controller identity has been supplied. Confirm actual processors/transfers and retention. Resolve the health-data consent issue described in README.md; accepting a privacy notice is not explicit consent to processing health data. pycekxlab — Privacy policy 1. Who is responsible Stefan Majkowski, a sole trader in Poland, ul. Ogródkowa 6, 07-410 Ostrołęka, Poland (NIP 7582383148) is the controller of personal data used to operate pycekxlab. Contact pycekx@gmail.com about privacy and data rights. [DPO_CONTACT_IF_APPOINTED; otherwise remove this placeholder.] 2. Data and purposes We process application and contact details to consider your application and discuss an offer; account details to authenticate you; and training preferences, goals, plans, progress, chat messages and feedback to provide the features you use. The basis is taking steps at your request before a contract and performing that contract (GDPR Article 6(1)(b)). Providing the information necessary for the relevant feature is required to use that feature; other information is optional. We process purchase details and legally required records to meet accounting and other legal duties (Article 6(1)(c)). We process proportionate security logs, support correspondence and records needed to prevent abuse and handle legal claims for those legitimate interests (Article 6(1)(f)). [HEALTH_DATA: insert the confirmed, implemented Article 9 basis and withdrawal mechanism for optional injury, pain and health information. Do not treat the contract or acceptance of this notice alone as that basis.] 3. Who receives data Authorised coaching staff can access information needed to provide your service. Information you post in Community is visible to the members with access to that conversation or group; a direct message is visible to its participants. Do not post another person's private information without an appropriate basis. Technical providers process data to operate the service: Supabase for accounts and storage; Render and Vercel for hosting; Resend for transactional email; OpenAI for AI features; and Mux for video features when used. Stripe processes payment data and may also act as an independent controller for its own legal and security purposes. Payment-card details are entered with Stripe; pycekxlab receives payment status and purchase references rather than your full card number. Using AI features sends the relevant message and selected conversation or training context to the AI provider to produce a response. Responses may be inaccurate. A coach decides admission and negotiates the offer; AI training suggestions do not themselves decide admission or the price of your contract. [INTERNATIONAL_TRANSFERS: confirm the actual provider entities and regions; identify applicable adequacy decisions or contractual safeguards and how to obtain a copy. Do not claim all data stays in the EU without verifying this.] 4. Storage and browser data [RETENTION: confirm periods or concrete criteria for unsuccessful applications, account/training data, messages/media, logs, backups and legally retained purchase records.] The service uses cookies or browser storage needed for sign-in, security, private-offer verification and user preferences. [CONFIRM whether optional analytics or marketing technologies are active; identify them and obtain consent where required.] 5. Your rights Subject to the applicable conditions, you can request access, correction, erasure, restriction or a portable copy of your data. You can object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. Contact the controller above. The app also provides an account deletion route at https://pycekxlab.com/account-deletion. Deletion does not necessarily remove records that must be retained by law. You may complain to your local data protection authority. The Polish supervisory authority is the President of the Personal Data Protection Office (UODO), https://uodo.gov.pl/.