Privacy Policy

1. Who is responsible for your data

The controller of your personal data is:

We have not appointed a data protection officer. For any question about your data or to exercise your rights, write to info@blowstack.com.

2. What we process, why, and for how long

Visiting the website

When you open any page, your browser sends your IP address, the address of the page and information about your browser and device. Amazon Web Services, which hosts BlowStack, uses them to deliver the page and protect it from abuse. We do not keep access logs. Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).

To decide whether we have to ask for your consent before analytics, the website asks our content delivery network which country your connection comes from. The country is derived from your IP address at that moment and is not stored. Legal basis: our legal obligation to ask for consent where the law requires it (Art. 6(1)(c) GDPR).

Analytics

We use Google Analytics to see which pages, tools and exams people use, so we know what to improve and build next. It records the pages you visit, your actions in our tools (for example running a converter or copying a result), your approximate location, device, browser and the site that referred you, linked to a random identifier stored in a cookie. According to Google, Google Analytics 4 does not store IP addresses. We do not use Google Analytics for advertising and never sell your data.

• In the European Economic Area, the United Kingdom and Switzerland, Google Analytics runs only after you click "Accept and help". Legal basis: your consent (Art. 6(1)(a) GDPR and the Polish Electronic Communications Law).
• Elsewhere it runs from your first visit. Legal basis: our legitimate interest in understanding how the service is used (Art. 6(1)(f) GDPR).

You can change your choice at any time: on blowstack.com through Cookie settings (also in the page footer), in the app through Account → Preferences → Analytics cookies. Withdrawing consent stops analytics and deletes its cookies; it does not affect what was collected before. Google Analytics keeps the data for 14 months.

Your account

To create an account you sign up with your email address and a password, or with Google, Facebook, LinkedIn or Amazon. From those providers we receive your email address and, where available, your name. Sign-in is handled by Amazon Cognito; we never see your password. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR). Without an email address we cannot create an account.

Your learning data

While you learn we store your answers, practice exam sessions and results, course progress, selected certification and study plan, linked to your account. They are the service itself: we use them to show your progress, readiness and daily plan. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

We keep your account and learning data until you ask us to delete your account. We then delete them within 30 days, except the payment records described below.

Payments

Premium is sold through Link, the merchant of record service of Stripe, which sells it to you. Your payment details, name, billing address and email address go directly to Stripe, which processes them as a separate controller to take the payment, calculate taxes and send you receipts, under the Stripe Privacy Policy; they never reach us. We store which plan you bought, its price, the Stripe payment identifier and the dates of your access. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR) and our accounting and tax obligations (Art. 6(1)(c) GDPR). We keep payment records for 5 years from the end of the year of the payment, as Polish tax law requires.

Contact form

When you write to us through the contact form we store your name, email address, topic and message to answer you. Legal basis: our legitimate interest in answering your inquiry (Art. 6(1)(f) GDPR). We keep inquiries for 2 years from your last message.

Support chat

The support chat in the app is off by default. It is loaded only after you turn it on in Account → Preferences → Chat, and is provided by Zoho SalesIQ, which then sets its own cookies and processes your chat messages. Legal basis: your request for support (Art. 6(1)(b) GDPR). We keep chat conversations for up to 2 years.

3. Cookies and browser storage

Cookies and browser storage that are necessary for the service work without consent. Everything else needs your consent where the law requires it, as described above.

You can also delete cookies and browser storage at any time in your browser settings.

4. Who receives your data

We do not sell your data and do not share it for advertising. It is processed by:

• Amazon Web Services - hosting, database, content delivery and sign-in (Amazon Cognito);
• Google - Google Analytics;
• Stripe - payments, as a separate controller (see "Payments" above);
• Zoho - the support chat, only if you turn it on.

Except for Stripe, they process the data on our behalf and under our instructions. If you sign in with Google, Facebook, LinkedIn or Amazon, that provider processes your sign-in under its own privacy policy. We disclose data to public authorities only when the law requires it.

5. Transfers outside the European Economic Area

BlowStack runs in the Amazon Web Services region in the United States, and Google, Stripe and Zoho may process data there as well. These transfers rely on the EU-U.S. Data Privacy Framework, in which these companies participate, and, where it does not apply, on the European Commission's standard contractual clauses. You can ask us for more information about these safeguards.

6. Your rights

Under the GDPR you have the right to:

• access your data and get a copy of it;
• have it corrected or deleted;
• restrict its processing;
• receive the data you gave us in a machine-readable format (data portability);
• object to processing based on our legitimate interest;
• withdraw your consent at any time, without affecting processing before the withdrawal.

To use any of them, write to info@blowstack.com. We answer within one month. You can also lodge a complaint with a data protection authority - in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or the authority in your country.

If you live in California or another US state with a privacy law, the same applies to you: we do not sell or share your personal information, and you can ask us to access or delete it at the address above.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

7. Children

BlowStack is intended for people aged 16 and over. We do not knowingly collect data from younger children; if you believe a child has given us their data, contact us and we will delete it.

8. Security

All connections use HTTPS, access to our systems is limited and protected, and passwords are handled by Amazon Cognito, not stored by us. No system is completely secure, but we work to protect your data and will inform you and the authorities of a breach where the law requires it.

9. Changes to this policy

When we change this policy we update the date at the top. We will tell registered users about significant changes by email or a notice in the app before they take effect.