BORRADOR — pendiente de revisión jurídica. No es una redacción final aprobada por asesoría legal.
Esta página legal se muestra en inglés. Los demás idiomas de la interfaz recurren al inglés hasta que se publique una traducción.
Privacy Policy
Versión 3.8.0 · En vigor desde 2026-08-01 · Última actualización 2026-08-18
Versiones anteriores
- 3.7.0 · 2026-08-01 — Privacy Policy TODO resolution guidelines 2026-08-18: §10 adopted retention schedule (payment/tax, consent, security logs, moderation, 35-day backups); remove six public TODO(ops); pseudonymisation wording for consent evidence.
- 3.6.0 · 2026-08-01 — External-service naming audit 2026-08-18: functional provider labels; EXT-01 auth attributes; Azure OpenAI once in §11.1; OpenAI Ireland Limited; remove GTM/Consent Mode/ACS/Key Vault product names.
- 3.5.0 · 2026-08-01 — Comparison audit 2026-08-14: Art. 9 incidental data; backup/deletion wording; remove EEA-reviewer claim; public vs unlisted; independent copies; under-16 analytics rule; hosting description.
- 3.4.0 · 2026-08-01 — Formal re-audit 2026-08-14 (R-03): remove optional Data Recipients page cross-ref; §7 self-contained.
- 3.3.0 · 2026-08-01 — Formal re-audit 2026-08-13-3 (M-02/M-04/M-05): transfer wording without unsupported EEA claim; ChatGPT under-16; Google partner-site cross-ref; retention criteria; AI Act counsel refs removed.
- 3.2.0 · 2026-08-01 — Formal legal re-audit draft (F-08/F-10): intentional special-category wording; layered deletion/retention; AI Act marking qualified.
- 3.1.0 · 2026-08-01 — Aug 2026 re-audit draft: MCP tools/scopes accuracy; App Request storage vs deck DB; AI Act path distinction; remove public env-var names; marketing cookies not offered.
- 3.0.0 · 2026-08-01 — Re-audit remediation: removed Art. 9(2)(e) for private uploads; corrected age-assurance bases (no Art. 8 as general collection duty); OpenAI app as controller-to-controller without DPA/SCC; concrete retention maxima; Azure regions via Evidence Checklist.
- 2.0.0 · 2026-08-01 — Restructured for audit; UODO address corrected; roles clarified; ACS email added; Azure OpenAI retention language updated; incidental special category; age basis; EU scope.
- 1.0.0 · 2026-07-25 — First published draft.
This Privacy Policy explains how CramDeck collects and uses personal data, what your rights are, and how to exercise them. It is addressed to users in the European Union and European Economic Area. The Polish-language version of this document is the binding version; this English text is a translation provided for convenience.
1. Who is responsible for your data
The controller of your personal data is:
JMS Sieracki sp. z o.o.
ul. ks. Pawła Pośpiecha 3A/7, 41-800 Zabrze, Poland
Registered with the National Court Register (KRS) under number 0001197364 by the District Court in
Gliwice, 10th Commercial Division of the National Court Register
NIP: PL6482767937 · REGON: 243188484 · Share capital: PLN 5,000.00
Email: hello@cramdeck.com
Phone: +48 604 550 335
For any privacy matter, write to hello@cramdeck.com or to the postal address above with the subject "Privacy". We have not appointed a Data Protection Officer, because we are not required to under Article 37 GDPR; the address above is the contact point for all data protection questions.
2. What this policy covers
This policy covers the CramDeck website and web application: browsing and studying decks, creating decks, public profiles, the AI deck wizard, payments, integrations (Personal Access Tokens and OAuth-connected agents such as ChatGPT), and our reporting and moderation processes.
It does not cover third-party websites you reach from links in user-created content. We do not control those sites.
3. What data we process, and where it comes from
3.1 Data you give us
| Category | Examples |
|---|---|
| Account | Email address, name |
| Age assurance | Year and month of birth only (not a full date of birth), collected at the age gate, and guardian-consent confirmation where required |
| Public profile | Username, display name, biography (up to 280 characters), avatar, visibility settings |
| Study content | Decks, cards, text and images you upload, deck descriptions, tags |
| Learning activity | Favourites, hidden cards, deck groups, study progress, recently viewed decks |
| AI inputs | Deck titles, topics and source text you submit to the AI deck wizard |
| Support and reports | The content of messages you send us, and reports you submit about other users' content |
| Preferences | Interface language, theme, card order and other learning settings |
3.2 Data we receive from others
When you sign in, Microsoft, as our authentication provider, gives us your account identifier, email address, display name and given name. We use these data to create and recognise your CramDeck account.
Stripe tells us that a payment succeeded, was refunded or was disputed, and gives us a customer identifier. Stripe does not give us your card number. Stripe also acts as an independent controller for its own fraud-prevention and compliance purposes under its own privacy policy.
3.3 Data generated by using the service
| Category | Examples |
|---|---|
| Authentication | Session token, sign-in timestamps, linked identity provider |
| Billing records | Stripe customer identifier, amounts, currency, purchased items, plan status, AI credit balance and ledger |
| Integrations | Personal Access Token name, public prefix, scopes and last-used time; OAuth client identifier, label, scopes and link time; ChatGPT App Request / App Response metadata and selected content you choose to exchange |
| Media metadata | File name, size, type, storage path, checksum, moderation status |
| Security and audit | Records of security-relevant events such as sign-in, policy acceptance, username change, token revocation, export and deletion |
| Consent records | Each consent choice you make, with its timestamp, the policy version and language you were shown, your IP address and browser user agent as proof under Article 7(1) GDPR |
We do not intentionally request payment card numbers, government identification numbers, or special-category data (Article 9 GDPR). You must not put such data into decks, media or AI prompts. Incidental receipt is handled under section 12 (minimisation, access restriction and deletion) and does not authorise unnecessary collection.
4. Why we process your data, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and running your account; providing study, creator, profile and feed features | Performance of a contract — Article 6(1)(b) GDPR |
| Authenticating you through our Microsoft authentication service | Performance of a contract — Article 6(1)(b) |
| Processing payments, subscriptions, credits and deck purchases | Performance of a contract — Article 6(1)(b) |
| Keeping accounting and tax records of those payments | Legal obligation — Article 6(1)(c), with the Polish Accounting Act and Tax Ordinance |
| Generating cards with the AI deck wizard when you ask us to | Performance of a contract — Article 6(1)(b) |
| Giving third-party agents you connect the access you granted them | Performance of a contract — Article 6(1)(b) |
| Age gate and eligibility for the service (including applying age-banded product rules) | Performance of a contract — Article 6(1)(b): determining whether we may offer the service and on what terms; where a documented legitimate-interests assessment so requires, also Article 6(1)(f). We do not rely on Article 8 GDPR as a general duty to collect age |
| Guardian confirmation for under-18 purchases and for processing personal data of users under 16 where the underlying activity relies on consent | Article 6(1)(b) for purchase capacity under Polish civil law; Article 6(1)(a) only where the underlying optional processing itself relies on consent (for example analytics cookies) and parental/guardian consent is required under Article 8 GDPR for that consent-based activity |
| Strictly necessary cookies (session, language, consent state) | Legitimate interests — Article 6(1)(f): delivering a service you asked for. Storage on your device is permitted without consent under Article 399(3) of the Polish Electronic Communications Law |
| Analytics cookies | Consent — Article 6(1)(a), and Article 399 of the Electronic Communications Law |
| Marketing cookies | Not used today. If we enable marketing tags later, we will name them in the Cookie Policy and rely on consent — Article 6(1)(a), and Articles 398–399 of the Electronic Communications Law |
| Reviewing AI-generated text for harmful content | Legitimate interests — Article 6(1)(f): keeping the service safe and lawful |
| Handling reports of illegal content and moderating content | Legal obligation — Article 6(1)(c), under Articles 16 and 17 of the Digital Services Act |
| Preventing abuse, fraud and unauthorised access; keeping security and audit logs | Legitimate interests — Article 6(1)(f): protecting the service, our users and ourselves |
| Answering your questions and handling complaints and rights requests | Legal obligation — Article 6(1)(c) — and performance of a contract — Article 6(1)(b) |
| Establishing, exercising or defending legal claims | Legitimate interests — Article 6(1)(f) |
| Sending purchase confirmations and service notifications by email | Performance of a contract — Article 6(1)(b) |
Where we rely on legitimate interests, we have weighed those interests against your rights and concluded they do not override them. You can object to that processing at any time — see section 9.
5. Whether you have to give us this data
Providing an email address and completing authentication is necessary to create an account; without it we cannot provide an account-based service, although free public decks remain readable without an account. Providing year and month of birth is necessary so we can determine contract eligibility and apply age-appropriate product rules (including guardian flows). Providing payment details to Stripe is necessary only if you choose to buy something. Everything else — a biography, an avatar, a public profile, AI prompts — is optional.
6. Automated decision-making
We do not make decisions producing legal or similarly significant effects about you by automated means, and we do not carry out profiling within the meaning of Article 22 GDPR.
Two automated processes affect content rather than people. Text produced by the AI deck wizard may be screened automatically for harmful content and withheld if it crosses a threshold, and reported content may be triaged automatically. In both cases you can ask a human to review the outcome by writing to hello@cramdeck.com.
7. Who we share data with
We share personal data with the service providers and recipients summarised below. For each category we state the role (processor or independent controller). Where processing may involve access from outside the EEA, the applicable transfer safeguards are described in section 8.
In summary:
- Microsoft acts as our processor and provides authentication, cloud hosting, databases and file storage, AI generation and email delivery.
- Stripe provides payment processing. It acts as our processor when processing payments on our instructions and as an independent controller for its fraud-prevention, compliance and financial-services purposes.
- Google, acting as a processor and only after you consent, provides Google Analytics.
- OpenAI Ireland Limited, if you connect CramDeck with ChatGPT, acts as an independent controller under the terms and privacy policy applicable to ChatGPT users. OpenAI is not a CramDeck processor or subprocessor for this public app relationship. Neither party processes personal data on behalf of the other under the OpenAI App Developer Terms. See section 11.2.
We may also disclose data to public authorities where the law requires it, and to professional advisers where necessary to establish or defend a legal claim. We do not sell personal data and we do not share it with data brokers.
Anything you set to public — a public Deck or a public profile — may be visible to anyone and may be indexed by search engines. Content set to unlisted (link-only) is available to people who have the link; it is not offered in the public feed or search in the same way as public content, but anyone with the link can open it and third parties could still index a shared URL. Private content is not published. Choose visibility carefully.
8. Transfers outside the European Economic Area
Microsoft provides our cloud hosting infrastructure. The hosting location follows the configuration for our account. Providers may access personal data from outside the EEA (including for support), and transfers or remote access outside the EEA may therefore occur. We do not claim that all processing remains inside the EEA.
Where such access or transfer occurs, the applicable safeguards are:
| Provider | Safeguard |
|---|---|
| Microsoft | EU Data Boundary commitments, plus the EU-US Data Privacy Framework and the Standard Contractual Clauses in the Microsoft Products and Services Data Protection Addendum |
| Stripe | EU-US Data Privacy Framework certification and Standard Contractual Clauses in the Stripe Data Processing Agreement applicable to our account |
| Google (Google Analytics only, with your consent) | EU-US Data Privacy Framework certification and Standard Contractual Clauses in the Google Ads Data Processing Terms applicable to Analytics |
| OpenAI Ireland Limited (only if you connect the ChatGPT integration; independent controller) | Controller-to-controller disclosure under OpenAI Ireland Limited's terms for ChatGPT users. Any onward transfer or access outside the EEA is performed by OpenAI under OpenAI's own transfer framework and privacy disclosures — not under a CramDeck–OpenAI processor DPA or SCCs for the public app |
The European Commission decided on 10 July 2023 that the United States provides an adequate level of protection for organisations certified under the Data Privacy Framework. That decision was upheld by the General Court of the European Union in September 2025 and an appeal is pending before the Court of Justice. For processor relationships where we rely on Microsoft, Stripe or Google, we also maintain the Standard Contractual Clauses as an independent safeguard. You can ask us for a copy of the clauses that apply to a particular processor transfer.
9. Your rights
Under the GDPR you have the right to:
- Access your data and obtain a copy of it
- Rectify data that is inaccurate or incomplete
- Erase your data, in the circumstances set out in Article 17
- Restrict processing, in the circumstances set out in Article 18
- Portability — receive the data you gave us in a structured, machine-readable format and have it transmitted to another controller where technically feasible
- Object to processing based on our legitimate interests, on grounds relating to your situation
- Withdraw consent at any time, without affecting the lawfulness of what we did before you withdrew it
You can exercise most of these yourself inside the product:
| Right | Where |
|---|---|
| Access and portability | Profile → Privacy & security → Export my data |
| Rectification | Profile → About, and Profile → Public profile |
| Erasure | Profile → Danger zone → Delete account (14-day grace period, then permanent deletion) |
| Withdraw cookie consent | Footer → Cookie preferences |
| Cut off a connected app | Profile → Integrations → Revoke or Unlink |
Otherwise write to hello@cramdeck.com. We respond within one month of receiving a request, and will tell you if we need to extend that by up to two further months because the request is complex. We may ask you to confirm your identity if we cannot otherwise be sure who is asking.
If you think we have handled your data unlawfully, you may lodge a complaint with the Polish supervisory authority:
Prezes Urzędu Ochrony Danych Osobowych (UODO)
ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland
uodo.gov.pl
You may also complain to the supervisory authority in the EU or EEA country where you live or work.
10. How long we keep data
Deletion and retention are layered. We distinguish between (i) deletion from active production systems, (ii) records retained because applicable law or the defence of legal claims requires their continued storage, and (iii) isolated backups that are automatically overwritten within the period stated below.
10.1 Live account and production systems
| Data | Retention |
|---|---|
| Account and profile | For as long as your account exists |
| Decks, cards and media | For as long as your account exists, unless you delete them sooner |
| Recently viewed decks | 90 days, then automatic expiry |
10.2 Soft-delete / recovery
| Data | Retention |
|---|---|
| Soft-deleted account | 14 days, during which you can restore it by signing in |
| After the 14 days (live systems) | Removal of the original account, profile, decks, cards, media, tokens and connections from production systems. An independent copy lawfully acquired by another user (for example a Deck purchased or exported while it was available) may remain where the contract and applicable law allow it |
10.3 Legally retained records
| Data | Retention |
|---|---|
| Payment, billing, tax and accounting records | Payment, billing, tax and accounting records are retained only for the periods required by applicable law. Records covered by the EU VAT One Stop Shop scheme are retained for 10 years from the end of the calendar year in which the transaction was carried out. Other accounting records are retained for five years from the beginning of the year following the financial year to which they relate, and tax records are retained until the relevant tax liability becomes time-barred, normally five years from the end of the calendar year in which the payment deadline expired. Relevant records are retained longer only where a statutory limitation period is suspended or interrupted or related proceedings remain pending |
| Fraud, security and dispute records needed for claims defence | Kept only as long as needed for that purpose; overlapping categories appear below |
10.4 Consent evidence
| Data | Retention |
|---|---|
| Consent records | Consent records consist of the user's choice, the timestamp, the applicable policy and consent-interface version, the language used and a pseudonymous subject identifier. They are retained while we rely on the consent and for three years after the consent is withdrawn, expires or is replaced. If a complaint, investigation or legal claim begins during that period, the relevant record is retained until the matter is finally resolved. Full IP addresses and browser user-agent strings are not retained as long-term consent evidence |
10.5 Moderation and security logs
| Data | Retention |
|---|---|
| Routine security and audit logs (including connected-app events) | Routine security and audit logs, including connected-app events, are retained for 12 months and are then deleted or irreversibly anonymised. Full IP addresses and browser user-agent strings are retained for no more than 90 days unless they are isolated as evidence relating to an identified security incident. Access tokens, full prompts, card content and full App Request or App Response payloads are not written to routine logs. Records isolated for an identified incident, complaint or legal claim are retained until the matter is finally resolved and for no more than three years afterwards |
| Content reports and moderation decisions | Reported content and supporting evidence are retained until the case is finally closed and for no more than 12 months afterwards. A minimised case record containing the notice, decision, reasons, relevant communications and outcome is retained for three years after final closure. If a complaint, authority request or court proceeding remains pending, the relevant material is retained until the matter is finally resolved |
| Cookies | See the Cookie Policy |
10.6 Isolated backups
Encrypted backups of application data are retained on a rolling basis for no more than 35 days and are then automatically overwritten or deleted. Data removed from active production systems may remain in an isolated backup until that backup expires. Backups are used only for disaster recovery. If a backup is restored, deletion records are reapplied before normal use resumes so that data previously deleted is not returned to active use. “Permanently deleted” in section 10.2 means removed from live production systems; it does not by itself describe backup expiry.
11. AI features
11.1 AI deck wizard (Microsoft — processor)
When you use the AI deck wizard inside CramDeck, the deck title, topic and any source text you provide are sent to Microsoft's Azure OpenAI service to generate card suggestions. When you ask the wizard to rewrite a card, the text of that card is sent too. Microsoft acts as our processor for this generation feature.
What you should know:
- Microsoft does not use your prompts or the generated output to train its foundation models.
- Microsoft screens prompts and output for abuse under its abuse-monitoring policy. Where content is flagged and human review is needed, data retention follows the terms of our Microsoft agreement and the configured abuse-monitoring settings.
- Generated text may also be screened by Microsoft's content-safety service and withheld if it scores above our thresholds for hate, self-harm, sexual or violent content.
- Cards created by the wizard are labelled as AI-generated in the interface as a product transparency measure. Machine-readable AI provenance markers may be preserved where the product records them.
- AI output can be wrong. Check it before you rely on it, and before you publish it.
Do not put personal data about other people into AI prompts.
11.2 ChatGPT integration (OpenAI — independent controller)
The ChatGPT integration is unavailable to a known user under 16. Guardian consent does not make it available. If you are 16 or over and connect ChatGPT to CramDeck through our OAuth integration (the public ChatGPT plugin / MCP connection):
- You (or ChatGPT acting for you) send App Requests to CramDeck. Typical request categories include: listing or reading decks and cards you own, creating a private deck, appending or updating cards, updating deck metadata, starting a review session, recording review answers, and completing a session. We validate and authorise every request on our servers. New decks created through the plugin are private.
- We return App Responses, which may include only the decks, cards, review-session identifiers and statistics, or capacity information for that exchange — not an unlimited dump of your private library, billing data, or unrelated account settings. Capacity responses report neutral counts only (for example current decks versus limit) and do not promote plans, prices or upgrades.
- Storage of content versus logs. Decks and cards you choose to save through the plugin are stored in your CramDeck library — the same authoritative deck database as the website. We do not keep a separate archive of full App Request / App Response transcripts for ordinary operation. Separately, we retain CramDeck identifiers, connection metadata and security / service logs needed to operate the integration, detect abuse and honour revocation. Those logs exclude access tokens and minimise card or prompt content; retention follows section 10.
- Content generated by ChatGPT and then saved to CramDeck is not generated by the in-product AI deck wizard (section 11.1). ChatGPT's own interface disclosures apply on OpenAI's side. Where CramDeck can attribute cards to the plugin path, we may record AI provenance on the stored card as a product transparency measure.
- OpenAI Ireland Limited (with affiliated entities as described in OpenAI's disclosures) processes data under the terms and privacy policy that apply to the ChatGPT user. OpenAI determines its own purposes and means; we do not instruct OpenAI as a processor for this public app.
- Any later processing or access outside the EEA is performed by OpenAI under OpenAI's own transfer framework. We do not rely on an OpenAI processor DPA or SCCs for this relationship.
- You can disconnect or revoke the integration at any time (Profile → Integrations). Disconnecting revokes connection credentials only. It does not delete your CramDeck account, decks, cards, or review history. Deleting your CramDeck account (or using a separate erasure request) removes our copy of connection and account data after the retention rules in section 10; OpenAI's retention of data it holds as controller is governed by OpenAI.
A user-facing description of tools, scopes and limits is at /docs/chatgpt-plugin. This ChatGPT path is separate from the in-product AI deck wizard (section 11.1), which remains a Microsoft processor relationship for in-product card generation. The public ChatGPT plugin does not sell subscriptions, AI credits, or paid decks, and it does not start checkout.
12. Data you must not upload
Do not intentionally submit special-category data under Article 9 GDPR (including health, biometric, genetic, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, or data concerning a person's sex life or sexual orientation), payment card numbers, government identifiers such as PESEL or passport numbers, login credentials for any service, or any sensitive data about another person.
Educational material that does not identify a real person — a textbook case description, an anonymised clinical scenario — is fine. Anything that identifies a real patient or another living person's special-category attributes is not.
If we incidentally receive special-category or other prohibited data (for example because it appears inside an upload or prompt without our requesting it), we do not rely on Article 9(2)(e) GDPR ("manifestly made public") for private uploads, and we do not treat another user's upload as that data subject's public disclosure. We minimise further processing, restrict access where appropriate, and delete or anonymise the data once we detect it, unless a specific Article 9(2) condition applies — notably Article 9(2)(f) where retention is genuinely necessary to establish, exercise or defend legal claims. A DSA moderation case is not, by itself, an Article 9 GDPR condition.
13. Security
We protect your data with encryption in transit and at rest, access control on all administrative systems, managed secret storage, hashed storage of integration tokens, and audit logging of security-relevant events. Files in storage are private and reachable only through short-lived signed links.
If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the President of the Personal Data Protection Office within 72 hours of becoming aware of it, and we will notify you directly where the risk is high.
14. Cookies
We use strictly necessary cookies to keep you signed in, remember your language and store your consent choices. Analytics cookies (Google Analytics) are used only if you agree. We do not currently use marketing cookies; if that changes, the Cookie Policy will name them before they go live and they will require consent. You can change your mind about analytics at any time. Full details, including every cookie name and how long it lasts, are in the Cookie Policy. Information on how Google uses data from sites and apps that use Google services is available in Google's partner-site information.
15. If you are under 18
You need to be at least 13 to use CramDeck.
At sign-up we ask only for year and month of birth, so we can place you in the correct age band.
If you are 13, 14 or 15, you can use CramDeck only with the agreement of a parent or guardian, and we ask for their confirmation when you sign up. We do not use analytics cookies for a user known to be under 16, and we do not show that age band a consent choice for analytics. (We also do not use marketing cookies for anyone while none are configured.) The ChatGPT / OpenAI integration is unavailable to you; guardian consent does not unlock it. You cannot buy anything without a parent or guardian agreeing.
If you are 16 or 17, you can make your own choices about cookies, and you may connect the ChatGPT integration if you choose. You still need a parent or guardian to agree before you buy a subscription, credits or a deck, because under Polish law people under 18 cannot enter into that kind of contract on their own. The in-product AI deck wizard remains available under the service contract; the separate ChatGPT connection remains optional and under OpenAI's own terms once connected.
In plain words: we keep the things you need to run your account, like your email and the decks you make. We show other people only what you choose to make public — and your profile starts out private. We never sell your information. If you want your account and everything in it gone, you can delete it in your profile settings. After the 14-day grace period we remove the original account, profile and CramDeck-controlled publication from live systems; isolated backups are overwritten on their rolling cycle (section 10.6). An independent copy of a Deck that another user lawfully acquired while it was available may remain where the contract and applicable law allow it. If you are not sure about something here, ask a parent, guardian or teacher to read it with you, or write to us at hello@cramdeck.com and we will explain it.
If you are a parent or guardian and you believe a child has given us data without your agreement, write to hello@cramdeck.com and we will delete it.
16. Changes to this policy
We will publish any new version here with a new version number and effective date, and keep a list of previous versions at the top of this page. If a change materially affects you, we will tell you in the application or by email before it takes effect, and where the law requires it we will ask you to accept the new version.
17. Contact
JMS Sieracki sp. z o.o.
ul. ks. Pawła Pośpiecha 3A/7, 41-800 Zabrze, Poland
Email: hello@cramdeck.com
Phone: +48 604 550 335
KRS 0001197364 · NIP PL6482767937 · REGON 243188484