Privacy Policy

This Privacy Policy explains what personal data STEMviz collects, why, and what rights you have over it under the General Data Protection Regulation (GDPR).

1. Data controller

The data controller is [to be completed once STEMviz's operator registers a JDG], [registered business address — to be completed] (Poland). For any privacy question or to exercise the rights below, contact stemvizapp@gmail.com.

2. What we collect

• Account data — email address and authentication credentials, managed by our authentication provider (Supabase Auth). We never see or store your raw password.
• OAuth profile data — if you sign in with Google, we receive your name, email address and profile picture from Google.
• Purchase and entitlement data — which product you purchased, when, and a payment-processor reference. We do not store full card numbers; those are handled directly by the payment processor.
• Technical data — standard server logs (IP address, browser user-agent, request timestamps) generated by our hosting provider for security and abuse prevention.
• Cookies — see our Cookie Policy.

3. Why we process it, and on what legal basis

• Providing your account and the Service — necessary to perform our contract with you (GDPR Art. 6(1)(b)).
• Processing payments and keeping accounting records — necessary to perform the contract and to comply with Polish tax and accounting law (Art. 6(1)(b) and (c)).
• Security, fraud and abuse prevention — our legitimate interest in keeping the Service and its users safe (Art. 6(1)(f)).
• Marketing emails, if we ever introduce them — only on the basis of your consent (Art. 6(1)(a)), which you can withdraw at any time.

4. Who we share data with

We use the following processors to run the Service. Each processes data on our behalf under a data processing agreement, and may store or process data outside the European Economic Area (in particular in the United States); where that happens, transfers rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard.

• Supabase — database hosting and authentication.
• Vercel — application hosting.
• Google — optional OAuth sign-in.
• Lemon Squeezy — merchant of record and payment processor for course purchases; they collect and remit applicable sales tax/VAT on our behalf.

We do not sell personal data to third parties.

5. How long we keep it

We keep account data for as long as your account is active. Purchase and invoicing records are kept for as long as required by Polish tax law (generally 5 years from the end of the tax year in which the purchase occurred). If you delete your account, we delete or anonymise personal data that we are not legally required to retain.

6. Your rights

Under the GDPR, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• request erasure of your data ("right to be forgotten");
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time, where processing is based on consent;
• lodge a complaint with a supervisory authority — in Poland, the Prezes Urzędu Ochrony Danych Osobowych (UODO), or the data protection authority of your own EU member state.

To exercise any of these rights, email stemvizapp@gmail.com. We will respond within one month, as required by Art. 12(3) GDPR.

7. Children

The Service is intended for users aged 16 and over. We do not knowingly collect personal data from children under 16 without parental consent, consistent with Art. 8 GDPR.

8. Security

We use HTTPS/HSTS in transit, store credentials via our authentication provider (never in plaintext), and enforce Row Level Security on our database so a user can only ever read their own records. Administrative database access is restricted to server-side, service-role credentials that are never shipped to the browser.

9. Automated decision-making

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.

10. Changes to this policy

We may update this Privacy Policy from time to time; the "Last updated" date above reflects the latest revision.