Privacy Policy

1. Data Controller

The controller of personal data is: PENTEST Rafał Dyck, ul. Tadeusza Kościuszki 64/17, 81-198 Pogórze, Poland, NIP (Polish tax ID): 5782867795, REGON: 221013827, e-mail: kontakt@studym8.app. The Controller has not appointed a data protection officer — for all matters concerning personal data, you can contact the Controller directly at the e-mail address above.

2. Who This Service Is For

StudyM8 is intended for adult natural persons who use the service outside of any trade, business or profession (consumers within the meaning of Art. 22¹ of the Polish Civil Code). The Application is aimed at students, but the Controller does not verify student status. Upon request submitted within the statutory time limit, the Controller issues a sales document (invoice) in accordance with applicable regulations; an invoice issued to a consumer does not include the buyer's tax ID.

3. What Data We Process, for What Purpose and on What Basis

Below we describe each category of data separately — what data it covers, what it is used for, on what GDPR legal basis we process it, and whether providing it is required.

3.1 Account Data

Name, e-mail address, password (stored as a cryptographic hash, never in plain text). Purpose: creating and operating the Account, enabling login. Basis: Art. 6(1)(b) GDPR (necessary to conclude and perform the Account agreement). Providing this data is required — without it, creating an Account is not possible.

3.2 Profile Data (optional)

The name of your university and field of study, if you choose to provide them in Settings. Purpose: personal labelling of the profile (this data is never shown to other Users or used for any other purpose). Basis: Art. 6(1)(a) GDPR (voluntary consent given by entering this data). Providing this data is entirely optional, and you can withdraw consent at any time yourself, by clearing the value in Settings — without affecting the lawfulness of processing already carried out.

3.3 Semester, Course, Task, Note and Link Data

Course names and descriptions, instructor data, grading methods, Task content and deadlines, Note content, Link addresses — data entered by the User and stored on the Controller's server (not locally on the device). Purpose: providing the Application's core function. Basis: Art. 6(1)(b) GDPR. Notes are visible only to their author; other Course data becomes visible to a Friend only upon conscious sharing (point 3.4).

Instructor data (name and, optionally, e-mail) concerns a third party who is not a User of the Application and from whom the Controller does not collect data directly — the source is the User entering that data while using the Application. The Controller processes it under Art. 6(1)(f) GDPR (legitimate interest in providing the function the User is requesting), limited to storing it, displaying it to the User, and — if the Course is consciously shared — passing it to a Friend. Providing the instructor's e-mail is optional.

The Controller has an information duty toward such a third party under Art. 14 GDPR. The Controller has assessed that performing it individually for every instructor entered (this data is entered by individual Users, typically from information already published by their university, and the Controller itself holds no contact details for these people beyond the optional e-mail) would involve disproportionate effort within the meaning of Art. 14(5)(b) GDPR, and fulfils this duty by providing the information required under Art. 14(1)–(2) GDPR in this Policy and by offering an easy point of contact (kontakt@studym8.app) for any such person who wishes to exercise their rights. A person whose data was entered this way may contact the Controller at kontakt@studym8.app regarding their rights (point 7) — in particular to request that such data be removed from the Application.

3.4 Friend and Sharing Data

The Friend Code (a random account identifier), the status of invitations and Friend relationships, and a snapshot of a shared Course, visible to both parties once shared: the Course's name, type and colour, the instructor's name and (if provided) e-mail address, all of that Course's grading methods together with their description and maximum points, and the first name of the sharing User. Purpose: enabling the addition of Friends and the sharing of Courses. Basis: Art. 6(1)(b) GDPR. Providing this data is required if the User wants to use this function; the function itself is entirely optional.

3.5 Technical and Device Data

IP address, system logs, device and browser information, the device token used for push notifications (Firebase Cloud Messaging) together with the device name and platform. Purpose: ensuring system security, detecting and preventing abuse, diagnosing errors, delivering push notifications about Task deadlines. Basis: Art. 6(1)(f) GDPR — the Controller's legitimate interest in the security and proper functioning of the Application, and in delivering the function the User is using. The notification token is automatically deleted once it is no longer valid.

3.6 Payment Data

Card details and online banking login details are processed exclusively by the payment operator PayU S.A. — the Controller never receives or stores them. The Controller transfers to PayU the User's name, e-mail address and IP address, and the order's own data (description, amount, currency, order ID), necessary to initiate the payment. The Controller retains, on its own side, information about the order: the Semester, amount, status, date, order ID, any Promo Code used, and — for a paid purchase — the record of the statement described in point 3.8. Purpose: processing payment for Paid Access, accounting and tax documentation. Basis: Art. 6(1)(b) GDPR (performance of the agreement) and Art. 6(1)(c) GDPR (tax obligations concerning payment documentation). With respect to processing and securing the payment itself, PayU acts as a separate controller of the payer's data (point 4).

3.7 Contact Form

Name (if sent from the studym8.app website), e-mail address, chosen subject and the content of the message sent via the contact form in the Application or on the website. A message sent from the Application is linked to the Account (User identifier) that sent it. The content of the message is stored in the Application's database solely to handle the request, and is also sent by e-mail to kontakt@studym8.app, from where it reaches the Controller's mailbox hosted on Google Workspace (Gmail). To limit spam, for 24 hours we store a hash of the sender's IP address (from the website, without login) and the time sent. Purpose: providing a reply and conducting correspondence, protecting the form from abuse. Basis: Art. 6(1)(f) GDPR — the Controller's legitimate interest in responding to messages addressed to it and in securing the service; where the message concerns an existing agreement — Art. 6(1)(b) GDPR. Providing an e-mail address is required in order to receive a reply.

3.8 Record of Acceptance of the Terms, Review of the Privacy Policy, and the Purchase Statement

Upon registration, and when a new version of these documents takes effect, we record which version of the Terms a given User accepted and which version of the Privacy Policy they confirmed having reviewed (version date), and when; we do not record an IP address for this. For every paid purchase of Paid Access, we additionally record, together with the order (point 3.6): the exact text and version of the statement requesting that performance begin before the withdrawal period expires (§7(3) of the Terms), and the date and time it was made — this record is stored together with the information about that order (point 6), independently of Account deletion, because it serves to demonstrate the terms of that specific agreement. Purpose: demonstrating the conditions under which the agreement was concluded, and establishing, pursuing or defending against claims. Basis: Art. 6(1)(f) GDPR — the Controller's legitimate interest in documenting the terms of the agreement concluded.

3.9 Reports of Violations, Complaints, Appeals, Claims

Data contained in the content of a report, complaint or appeal (§8 and §11 of the Terms) and related correspondence. Purpose: handling the report/complaint, defending against or pursuing claims. Basis: Art. 6(1)(f) GDPR.

3.10 Waitlist (before paid registrations launch)

E-mail address and chosen language (PL/EN), provided when signing up to the waitlist on the studym8.app website, and the sign-up date. Purpose: a single, one-time notification of the Application's launch, including any individual promo code. Basis: Art. 6(1)(a) GDPR (voluntary consent given by signing up to the waitlist). Recipient of the message: Resend (point 4). Consent can be withdrawn at any time by writing to kontakt@studym8.app — withdrawal before the message is sent means the entry is deleted without the notification being sent. Retention period: until the one-time launch notification is sent, and then deletion of the entry within 30 days of sending; waitlist data is not used for any further marketing activity.

4. Data Recipients

Data may be transferred to the following entities, in the role indicated for each:

• Supabase Pte. Ltd. (Singapore) — the main processor of our database and authentication infrastructure (database physically located in the Frankfurt, Germany — EU region), supported operationally by its affiliate Supabase Inc. (USA); processor under a data processing agreement, transfer to Singapore and the USA based on Standard Contractual Clauses (SCCs),
• Vercel Inc. — hosting of the Application and the studym8.app website; processor under a data processing agreement,
• PayU S.A. (Poland) — payment processing; with respect to processing and securing the payment, PayU acts as a separate controller of the payer's data, not as the Controller's processor,
• Plus Five Five, Inc. (Resend) — sending e-mail messages (including the waitlist); processor under a data processing agreement,
• Cloudflare, Inc. — protection, DNS and forwarding of e-mail addressed to kontakt@studym8.app; processor under a data processing agreement,
• Google LLC (Firebase) — delivering push notifications (Firebase Cloud Messaging); processor under a data processing agreement,
• Google LLC / Google Ireland Limited (Google Workspace) — the mailbox (Gmail) to which mail sent to kontakt@studym8.app, including contact-form messages, is delivered; processor under a data processing agreement.

The Application's interface uses a typeface (Google Fonts) loaded from Google LLC's servers every time the Application is opened — the Application does not self-host this font. Loading the font requires the User's browser to connect to Google's servers and disclose its IP address and basic browser technical data to Google, regardless of whether the User uses any other Google services.

5. Transfer of Data Outside the EEA

Due to the use of services from entities such as Supabase (Singapore/USA), Vercel and Google (Firebase, Google Fonts, Google Workspace), data may be transferred outside the European Economic Area (to Singapore and the USA) — the Application's database is, however, physically hosted in the Frankfurt (Germany, EU) region. Depending on the provider, the basis for the transfer is its certification under the Data Privacy Framework (EU–US) or Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring an adequate level of data protection. A copy of the relevant safeguards can be obtained by contacting the Controller at kontakt@studym8.app.

6. Retention Period

• Account: until deleted. You can delete your Account yourself in Settings ("Delete account", confirmed via a link sent to the Account's e-mail address) or by writing to kontakt@studym8.app. Deleting the Account erases Account data, Semesters, Courses, Tasks, Notes, Links, Friend relationships, registered devices, notification settings and the record of document acceptance. We continue to retain, without any link to the Account, only information about payments made (Semester, amount, date, order ID at the payment operator) — for the period required by tax law (see below).
• Data shared with a Friend: a copy of a Course accepted by a Friend remains in their data regardless of the deletion of the Account of the person who shared it — it is a separate record, not a reference to the original.
• Payment information and invoices: for the period required by tax law — as a rule, until the end of the limitation period for the tax obligation related to a given payment (Art. 70 §1 of the Polish Tax Code), counted from the end of the calendar year in which the tax payment deadline fell; this period may be suspended or interrupted in accordance with applicable regulations.
• Record of acceptance of the Terms and review of the Privacy Policy: for as long as the Account exists, and deleted together with it. The record of the statement made at a specific purchase is retained together with the information about that order — independently of Account deletion, for the period required by tax law.
• IP addresses and security logs: up to 12 months from the event, unless needed longer in connection with investigating a specific security incident or abuse.
• Authentication and session tokens, and the push-notification token: until the session expires, logout, Account deletion, or the token becomes invalid.
• Contact form and e-mail correspondence: for the duration of the correspondence, and then for up to 3 years after it ends, unless you request deletion earlier and there is no basis for further retention. The hashed IP address used for the message limit — 24 hours.
• Reports of violations, complaints and appeals: for the period they are being handled, and for up to 3 years after the matter is closed.
• Waitlist: until the one-time launch notification is sent, and then up to 30 days after sending.

7. Your Rights

You have the right to:

• access your data and obtain a copy of it,
• rectify data that is inaccurate or incomplete,
• erase data ("the right to be forgotten") — to the extent our legal obligations (e.g. tax-related) or other grounds for further processing do not prevent this,
• restrict processing — in the cases provided for by Art. 18 GDPR,
• data portability, for data we process on the basis of consent or an agreement in an automated manner, to another controller, in a commonly used format,
• object to processing based on our legitimate interest (point 3.3 — instructor data, 3.5, 3.7, 3.8, 3.9) — after you object, we will not process data for that purpose, unless we demonstrate compelling legitimate grounds overriding your interests,
• withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal — where processing is based on consent (points 3.2 and 3.10).

To exercise the above rights, write to kontakt@studym8.app. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

8. Cookies and Browser Storage

The service does not use marketing or analytics tools, so we do not display a consent banner. The Application does not use cookies in the traditional sense — state is stored in the browser's local storage (localStorage). Most of the items below are strictly necessary to deliver the service expressly requested by the User (Art. 399 of the Polish Electronic Communications Law); where an item is not so clear-cut, we say so explicitly:

• login session (Supabase Auth) — provider: Supabase; purpose: keeping the User's session logged in across visits to the Application; lifetime: until logout or session expiry; strictly necessary,
• access state — provider: StudyM8; purpose: remembering the Access expiry date so the Application works smoothly during a brief loss of network connectivity; lifetime: until logout or a change in access state; strictly necessary,
• payment screen shown flag — provider: StudyM8; purpose: showing the access-activation screen only once after login or a change in access state; lifetime: until the access state changes; strictly necessary,
• PWA install-banner state — provider: StudyM8; purpose: remembering that the User dismissed the banner suggesting adding the Application to the home screen; lifetime: 14 days from dismissal, or permanently after the third dismissal; this is not a record strictly necessary to deliver the service — we treat it as carrying out an explicit action by the User themself (clicking "×"); the User can clear it at any time by clearing the site's browser data,
• PayU (redirect to the payment gateway) — provider: PayU S.A.; the purpose and cookies set on the payment page are determined by PayU's own privacy policy, over which StudyM8 has no control; relevant only at the moment of making a payment.

9. Profiling

Data is not subject to automated decision-making or profiling within the meaning of the GDPR.

10. Security

The Controller uses connection encryption (SSL/TLS), stores passwords as a cryptographic hash (not in plain or reversibly encrypted form), and uses row-level database access controls (Row Level Security), to ensure a high level of protection for your information. No system is fully immune to threats — in the event of a personal data breach, the Controller follows the notification obligation set out in Art. 33–34 GDPR.

11. Versions and Changes to This Policy

This Privacy Policy is a versioned document, on the terms described in §13 of the Terms and Conditions — under §13(5) of the Terms, a change to the Privacy Policy alone (not tied to a change in the Terms) requires only that Users be informed, not renewed acceptance. The Controller reserves the right to update it. Users will be informed of changes requiring renewed acceptance at their next login to the Application; of changes materially and adversely affecting the scope of data protection — additionally by e-mail.