EN
Request an inviteRequest
Menu

Documents

Privacy notice

Draft. This notice describes our current data handling and identifies planned features where relevant. It is pending legal review. We are publishing it now because we already ask for your email, and you should know what happens to it.

We do not sell personal data. Our analytics use no cookies, and you choose whether to subscribe to optional emails. You can change your mind at any time.

1. Who we are

The controller is nobrainer.zone s.r.o., IČ 29352151, registered with the Regional Court in Brno, file C 74411, with its registered office at Mojmírovo náměstí 3105/6a, Královo Pole, 612 00 Brno, Czech Republic. We operate povesta (povesta.ink). For questions about this notice, contact hello@povesta.ink. We have not appointed a data protection officer.

2. What this covers

This notice covers the website, the invitation waiting list, and the povesta platform during its invite-only alpha for adults aged 18 and over. We do not knowingly process data of anyone under 18; users declare their age themselves when they register.

3. What we process, and why

On this website:

  • Invitation requests — your email address and page language, when you ask for an invitation. We mark your request as confirmed only after you click the link in our email. We use it only to contact you about the alpha and its opening. You can remove your request at any time through the link in our email or by writing to us. Legal basis: your consent (Art 6(1)(a) GDPR).
  • Analytics — Plausible counts visits without cookies. We see combined page counts, not individual people, and cannot identify you from this data. Legal basis: legitimate interest (Art 6(1)(f)).
  • Technical logs — server logs, including IP addresses, kept for a short time to maintain and secure the service. Legal basis: legitimate interest (Art 6(1)(f)).

On the platform (alpha accounts):

  • Account data — email and a hashed password, and the pen name you choose. Basis: contract (Art 6(1)(b)).
  • Your content and activity — chapters, comments, votes; needed to provide the platform. Basis: contract.
  • Account email — verification, receipts, security and legal notices. We send these messages to run your account, whether or not you subscribe to optional emails. Basis: contract / legal obligation.
  • Reading and voting data — we limit the detail we collect and delete these records after 90 days. They help us improve the platform and keep voting fair. Basis: legitimate interest.
  • Optional email — you can give separate consent for platform announcements and for planned messages from authors you follow. Both choices are off by default. Author messaging is not available yet; when introduced, we will relay the messages without revealing your email address to the author. Basis: consent, withdrawable at any time.
  • Payments — paid features are off during the alpha. When enabled, payments will be handled by Stripe; we never store card data. Payout and tax-reporting records are kept as the law requires. Basis: contract / legal obligation.
  • Consent records — which notice version and language you agreed to, and when; kept to demonstrate consent (Art 5(2)).

We do not sell personal data, and we do not disclose your email to authors or other users.

You choose whether to receive optional emails in Account → Communication preferences. These choices are off by default. Withdrawing consent is as easy as giving it (Art 7(3)), and takes effect immediately for future emails. It does not stop the account emails needed to run your account. Giving consent for the planned author messages records your preference; that service is not available yet.

5. Who processes data for us

  • Hetzner (Germany/Finland) — hosting.
  • Plausible (EU) — cookieless analytics.
  • Proton Mail (Switzerland, an EU adequacy country) — email delivery, including the invite confirmation mail.
  • Stripe — payments; transfers to the US rest on Standard Contractual Clauses.
  • Sentry (EU data region) — error monitoring. We operate our other monitoring tools ourselves.

Processing happens in the EEA except where noted; where a provider processes data outside it, the transfer rests on an EU adequacy decision or Standard Contractual Clauses.

6. Retention

  • Invitation requests — we delete unconfirmed requests when their links expire, after 14 days. We keep confirmed requests until you join, decline, or ask us to remove them.
  • Logs are kept for a short time; reading and voting data is deleted after 90 days.
  • When you erase your account, we anonymize identifying data while preserving poll results. You can also choose to have your content removed.
  • Financial records are retained as long as the law requires and are exempt from erasure to that extent.

7. Your rights

You have the following rights under the GDPR:

  • access, and a copy of your data — we provide an export;
  • rectification;
  • erasure, with the legal exceptions above;
  • restriction, and objection;
  • withdrawal of consent, at any time.

To exercise any of them, write to hello@povesta.ink. You may lodge a complaint with the Czech supervisory authority, Úřad pro ochranu osobních údajů (ÚOOÚ), or the authority where you live.

8. Cookies and local storage

This website sets no cookies. Your theme choice lives in your browser’s local storage and never leaves it. Analytics are cookieless. The platform app uses strictly necessary session cookies for signing in, plus a language-preference cookie set when you pick a language — nothing else.

9. Changes

We keep a version history of this notice in each language. We announce material changes and ask for your consent again where required.

10. The law we cite