EN
Request an inviteRequest
Menu

The paperwork

Privacy notice

Draft. This notice describes how the system is actually built and is pending review by counsel. We publish it now rather than after that review, because we are already asking for your email — nothing about our data handling should be a secret in the meantime.

The short version: we collect almost nothing, we sell nothing, analytics are cookieless, and every optional email is opt-in and withdrawable.

1. Who we are

The controller is nobrainer.zone s.r.o., IČ 29352151, registered with the Regional Court in Brno, file C 74411, seat Mojmírovo náměstí 3105/6a, Královo Pole, 612 00 Brno, Czech Republic. The product is povesta (povesta.ink). Contact for anything in this notice: hello@povesta.ink. We have not appointed a data protection officer.

2. What this covers

This website, the invite wait-list, and the povesta platform in its 18+, invite-only alpha. We do not knowingly process data of anyone under 18; age is self-attested at registration.

3. What we process, and why

On this website:

  • Invite requests — your email address and page language, when you ask for an invite. Double opt-in: nothing is stored as confirmed until you click the link we send. Used only to contact you about the alpha and its opening; removable any time via the link in our mail or by writing to us. Legal basis: your consent (Art 6(1)(a) GDPR).
  • Analytics — we use Plausible, which is cookieless and aggregates visits; we see page counts, not people, and we cannot identify you from it. Legal basis: legitimate interest (Art 6(1)(f)).
  • Technical logs — short-lived server logs (including IP addresses) for security and operations. Legal basis: legitimate interest (Art 6(1)(f)).

On the platform (alpha accounts):

  • Account data — email and a hashed password, and the pen name you choose. Basis: contract (Art 6(1)(b)).
  • Your content and activity — chapters, comments, votes; needed to provide the platform. Basis: contract.
  • Transactional email — verification, receipts, security and legal notices. These operate your account and are never consent-gated. Basis: contract / legal obligation.
  • Coarse reading and voting telemetry — bucketed, minimized, purged after 90 days; used for product improvement and vote integrity. Basis: legitimate interest.
  • Optional email — platform announcements, and messages from authors you follow, are each a separate opt-in, off by default. Author messages are relayed by us: your address is never disclosed to the author. Basis: consent, withdrawable at any time.
  • Payments — handled by Stripe; we never store card data. Payout and tax-reporting records are kept as the law requires. Basis: contract / legal obligation.
  • Consent records — which notice version and language you agreed to, and when; kept to demonstrate consent (Art 5(2)).

We do not sell personal data, and we do not disclose your email to authors or other users.

Every optional email is off until you turn it on, in Account → Communication preferences. Withdrawing is as easy as granting (Art 7(3)) and takes effect immediately for future sends. Withdrawal does not affect the transactional email your account needs to function.

5. Who processes data for us

  • Hetzner (Germany/Finland) — hosting.
  • Plausible (EU) — cookieless analytics.
  • Proton Mail (Switzerland, an EU adequacy country) — email delivery, including the invite confirmation mail.
  • Stripe — payments; transfers to the US rest on Standard Contractual Clauses.
  • Sentry (EU data region) — error monitoring; observability beyond that runs on tooling we operate ourselves.

Processing happens in the EEA except where noted; where a provider processes data outside it, the transfer rests on an EU adequacy decision or Standard Contractual Clauses.

6. Retention

  • Invite requests — an unconfirmed request deletes itself when its link expires, after 14 days; a confirmed one is kept until you join, decline, or ask for removal.
  • Logs are short-lived; telemetry is purged after 90 days.
  • Account erasure works by anonymization: your identity is scrubbed while poll results stay frozen as they happened — and you may additionally choose removal of your content.
  • Financial records are retained as long as the law requires and are exempt from erasure to that extent.

7. Your rights

You hold the full GDPR set:

  • access, and a copy of your data — we provide an export;
  • rectification;
  • erasure, with the legal carve-outs above;
  • restriction, and objection;
  • withdrawal of consent, at any time.

To exercise any of them, write to hello@povesta.ink. You may lodge a complaint with the Czech supervisory authority, Úřad pro ochranu osobních údajů (ÚOOÚ), or the authority where you live.

8. Cookies and local storage

This website sets no cookies. Your theme choice lives in your browser’s local storage and never leaves it. Analytics are cookieless. The platform app uses strictly necessary session cookies for signing in, plus a language-preference cookie set when you pick a language — nothing else.

9. Changes

This notice is versioned per language; material changes are announced and, where required, re-consented.

10. The law we cite