Privacy Policy

1. Who is responsible for the data

This Privacy Policy describes how the Akademia application (the “App”), used to sell and run online courses in stores on the Shopify platform, processes personal data.

The App is operated by Rafał Konieczny, ul. Krzycka 6c/6, 53-020 Wrocław, Poland, tax ID (NIP) 8992557720, EU VAT number PL8992557720 (the “Operator”). Contact for personal data matters: support@akademia.studio.

The Operator acts in two roles:

• as the controller of Merchants’ data (store owners and people using the App in the store admin) — to the extent described in section 2A;
• as the processor of Learners’ data (store customers) — on behalf of the Merchant, who is their controller (section 8). For matters concerning this data, a Learner should first contact the store where they bought the course; the Operator helps the Merchant handle such requests.

2. What data we process and why

A. Merchant data (Shopify store owner):

• Store domain (e.g. your-store.myshopify.com) and account identifier,
• E-mail address, first and last name of the person using the App in the store admin, provided through Shopify authorisation,
• Subscription and billing data processed solely by Shopify (Shopify App Pricing app subscription); the App reads the subscription status, plan and fee for the period, never card data,
• Content of messages sent to support.

Purpose: providing the service described in the Terms of Service, billing through Shopify, support and service security.

B. Learner data (store customers):

• Customer identifier in Shopify (shopifyCustomerId),
• First name, last name and e-mail address used when buying a course in the store,
• Identifier and name of the order confirming the purchase of course access,
• Learning progress: completed lessons and the last video player position,
• Video playback telemetry counted per subscription billing period, to prevent abuse and control the bandwidth limit.

Purpose: granting and maintaining access to purchased courses and tracking learning progress — on behalf of the Merchant.

3. Legal bases (Merchant data)

• Art. 6(1)(b) GDPR — performance of a contract, i.e. providing the service under the Terms of Service, including handling support requests;
• Art. 6(1)(c) GDPR — the Operator’s legal obligations, in particular tax and accounting;
• Art. 6(1)(f) GDPR — the Operator’s legitimate interest: service security, abuse prevention and the establishment, exercise or defence of legal claims.

The legal basis for processing Learners’ data is determined by the Merchant as their controller; the Operator processes it solely under the data processing agreement (section 8).

4. Processors and data location

The Operator uses the following providers:

• Shopify (Shopify International Limited, Ireland; Shopify Inc., Canada) — store platform, authorisation, order webhooks and app subscription billing.
• Fly.io, Inc. (USA) — App servers and database, running in a data centre in Frankfurt (Germany).
• BunnyWay d.o.o. (bunny.net, Slovenia) — storage of video materials in a data centre in Europe and their delivery; playback runs through a global content delivery network (CDN) with signed, expiring URLs.

Where a provider is established outside the European Economic Area, data is transferred on the basis of the mechanisms in Chapter V GDPR — a European Commission adequacy decision (Canada) or standard contractual clauses.

If a Merchant embeds a YouTube video in a lesson, the Learner’s browser connects to Google’s servers (in privacy-enhanced mode, youtube-nocookie.com). Such embedding is the Merchant’s decision.

5. How long we keep data

• For as long as the store uses the App.
• After the App is uninstalled, sessions and tokens are deleted immediately, and the remaining store and Learner data and videos after 48 hours.
• If the subscription expires without the App being uninstalled, the service is suspended for 30 days to allow resumption or data export; the data is then deleted.
• When a store deletes a customer’s data in Shopify (for example at the customer’s request), Shopify sends the App a deletion request (customers/redact), and the App deletes that Learner’s data automatically — without undue delay and no later than the deadline required by Shopify (30 days).
• Technical logs are usually kept for up to 30 days, and database backups for up to 30 days of rotation. Minimal proof that a deletion was carried out (operation identifier, dates, result — without content or e-mail addresses) is kept for 12 months.
• We keep data longer only where the law requires it (e.g. tax law) or where it is needed to establish, exercise or defend legal claims — and only for as long as that need lasts.

6. Rights of data subjects

Everyone has the right to access their data, to rectification, erasure, restriction of processing, data portability, and the right to object to processing based on legitimate interest. Requests can be sent to support@akademia.studio; a Learner may also submit them to the store where they bought the course.

You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw).

The App supports Shopify’s mandatory privacy webhooks:

• Right of access (customers/data_request): the App records the request and makes a complete export of the Learner’s stored data (profile, access, purchases, refunds, progress, history) available to the store administrator in the admin, who passes it to the entitled person within 30 days; the export is not published at a public address.
• Right to be forgotten (customers/redact): the Learner’s data, enrolments and progress history are permanently deleted from the database.
• Store data deletion (shop/redact): all data of the store and its Learners is permanently deleted.

7. Data security

Connections between Shopify, the user’s browser and the App servers are encrypted (HTTPS / TLS). Every Shopify webhook is verified with an HMAC SHA256 signature.

The database is stored on disks encrypted by the infrastructure provider (AES encryption). Video playback URLs are generated dynamically, with limited validity and a cryptographic signature.

8. Data processing agreement (DPA)

By installing the App in a Shopify store, the Merchant entrusts the Operator with processing Learners’ data under Art. 28 GDPR. The Operator processes this data solely on behalf of and on documented instructions from the Merchant, to provide the course platform functions, and uses only the providers listed in section 4. Full text: Data Processing Agreement.

9. No sale of data and no profiling

The Operator does not sell, rent or share personal data with third parties for marketing or commercial purposes.

The App does not use automated decision-making or profiling that would produce legal effects or similarly significantly affect customers. The only automated action is the technical granting of access to educational materials based on a paid order.

10. Changes to this policy

We announce material changes to this Policy on this page, with a new date and version. Merchants are informed in advance of any change to the list of processors.