Privacy notice
The information the app uses and where your progress is stored.
1. Controller and contact
Data controller: [ADD the operator’s legal name, business registration number, address and privacy contact email]. This notice is incomplete without these details.
2. Account and orders
A Blackjack Lab account uses an email and its own password. The database stores the account identifier, email, name, a secure password hash and login sessions including IP address, browser information and expiry times. These details identify the account and verify access. When sales are enabled, order records contain user and order identifiers, price, currency, payment status, payment references and creation and update times. The purpose is to perform the contract; any required accounting records are also kept to meet legal obligations.
3. Progress and preferences
Language preference and course progress are stored in your browser. Progress includes completed lessons, the last opened lesson and the best test result, with separate storage keys for each account. The app does not send this progress to its database. You can remove it by clearing site data. See Cookies and local storage for details.
4. Services involved
The website uses Sites hosting and Cloudflare infrastructure. Fonts are loaded from Google Fonts, which may receive an IP address and technical request information. Planned payments use a hosted Stripe checkout supplied with the email and order references; the app does not store full card numbers. [ADD the exact contracting entities, recipient roles, processing locations and any safeguards for transfers outside the EEA based on the actual service configuration.] When email sending is enabled, we provide Resend with the recipient address and the account or payment message. The notification queue stores message content and sending status. Password reset links are not stored in this queue.
5. Retention
The language cookie lasts one year. Local storage records have no automatic expiry set; the user or browser may remove them. Order retention must reflect the access period, accounting duties and handling claims. [ADD retention periods and deletion procedures for orders, failed payments, correspondence and operational logs; verify retention by infrastructure providers.] Automatic deletion of database records is not currently implemented.
6. Your rights
Subject to GDPR conditions, you may request access, correction, erasure, restriction and portability, and object where applicable. Where consent is the basis for processing, you may withdraw it. Send requests to the controller contact that must be completed above. Responses should be provided without undue delay, normally within one month; any lawful extension must be explained. You may complain to the Czech Office for Personal Data Protection.