Privacy policy

Updated · 6 November 2026

This policy describes use of Czytivo, customer accounts and purchase processing. Providing data is voluntary; we cannot deliver a service without the information it requires. We do not make decisions producing legal effects solely through automated processing.

1. Data controller

For personal-data enquiries, email info@czytivo.pl or write to the address above.

2. Using the shop and customer accounts

Your browser remembers cart items and delivery choices. A customer account is optional, including for FORM ZERO ACADEMY workshops. Creating one requires your name, email address and password.

The hosting platform serves the website and controls access. Infrastructure providers may process technical connection data, such as IP addresses and request information, under their terms. Details of providers and transfers outside the European Economic Area appear below.

3. Data needed to process orders

An order requires an email address and buyer details; invoices require appropriate billing details. Printed publications also require delivery details, which are passed to the selected carrier to the necessary extent. Orders containing only e-books or workshops do not require a delivery address or phone number; invoice data have a separate section.

• Contract performance, delivery and enquiries: Article 6(1)(b) GDPR.
• Tax, accounting and consumer-law obligations: Article 6(1)(c) GDPR.
• Establishing, pursuing and defending claims and ensuring security: Article 6(1)(f) GDPR. The controller’s legitimate interest is protecting the shop from abuse and pursuing or defending claims.

Marketing consent is not required to purchase. With separate, voluntary consent, ELSYNOR sp. z o.o. may email information about FORM ZERO ACADEMY workshops, news and offers. The legal basis is Article 6(1)(a) GDPR. We record the wording, version and time of consent and its withdrawal. You can withdraw through your account or by emailing info@czytivo.pl; purchase processing is unaffected. Marketing data are processed until withdrawal, while necessary evidence of consent and its withdrawal is retained until relevant claim-limitation periods expire. Organisational workshop messages are sent to perform the contract, independently of marketing consent. We will identify the meeting platform and explain its data processing before the meeting.

4. Recipients and retention

Draft orders and account data are stored in the shop’s database on Sites (OpenAI) and Cloudflare infrastructure. Czytivo accounts store names, email addresses, secured password hashes, session data and the accepted terms version. Passwords are not stored in plain text. Parcel-locker searches send only search criteria to InPost. An external map opens only when its link is selected.

Request deletion of a draft or account at info@czytivo.pl. Drafts older than 30 days are deleted during subsequent shop cleanup operations. Statutory duties may require retention of paid-order data. Resend handles registration, email verification and password-reset messages, receiving the recipient address and message content, including the relevant link. Open and click tracking is disabled. Resend (Plus Five Five, Inc.) acts as the controller’s email delivery provider. Transactional messages also contain order information and confirmation of contract terms.

PayPro S.A. (Przelewy24) receives data necessary for payment processing. InPost receives recipient details for printed deliveries. Billing documents may be disclosed to the seller’s accountants and authorised public bodies. Data are not sold. Account data are processed while the account exists and afterwards only as necessary for legal duties or defence of claims. Billing records are retained for the period required by tax law, generally five years from the end of the year in which tax payment fell due; statutory extensions may apply. Claims-related data are retained until the relevant limitation period expires. Contact data are processed until an enquiry is resolved and afterwards only where there is a basis for retention.

Processing outside the European Economic Area

OpenAI, Cloudflare and email provider Resend may process data outside the EEA, including in the United States. Resend stores message content and logs there even when the sending region is European. The provider identifies European Commission standard contractual clauses and the EU–US Data Privacy Framework as transfer safeguards. Provider terms and safeguards: Resend, Cloudflare and OpenAI. For information about safeguards affecting your data or a copy, contact info@czytivo.pl.

5. Your rights

Depending on the processing basis and purpose, you have rights of access, rectification, erasure, restriction, portability and objection. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. You may complain to the President of Poland’s Personal Data Protection Office (UODO).

6. Cookies and browser storage

Optional Meta advertising measurement runs only after consent to advertising cookies. Refusal does not affect purchasing. The “czytivo-cart-v2” localStorage entry keeps selected products for your next visit in the same browser; it contains no name, email address or payment details. “czytivo-delivery” sessionStorage remembers the delivery method and chosen parcel locker. The essential “czytivo_guest” cookie protects access to guest drafts and orders in this browser for 30 days. Opening an emailed order link may set an order-specific access cookie, also for up to 30 days. You can delete it by clearing site data; removing cart items updates the cart record.

After consent, the Meta pixel (Meta Platforms Ireland Limited) and server-side Conversions API record product views, cart additions, checkout starts and confirmed purchases with the transaction amount and currency (PLN or USD). Server-side measurement sends confirmed purchase information, amount and currency, product and order identifiers, _fbp and _fbc advertising identifiers, IP address, browser details and a SHA-256 hash of the email address to match a purchase to an advertisement. Hashing is not anonymisation. Click identifiers are retained after consent for up to 90 days. Withdrawing consent in cookie settings stops future transmissions from this browser and associated pending orders. Measurement evaluates Czytivo campaigns and tailors advertising. We use the 2S2S pixel supporting Elsynor shop advertising. Event parameters do not include names, plain-text email addresses, telephone numbers, delivery addresses or payment details. Meta may process browser identifiers, IP addresses and device information, link activity to a Meta account under its privacy policy, and transfer data outside the EEA using the safeguards it describes.

The basis for optional measurement is consent, withdrawable through “Cookie settings” on every page. Meta’s _fbp and _fbc cookies may last up to 90 days. We remember the consent choice (“czytivo-marketing-consent-v1”) for up to 180 days. After advertising consent, we also retain visit-source labels, such as campaign and ad, the referring domain and whether a Meta click identifier was present, for up to 90 days. These labels are saved with new orders to assess sales sources. We do not save the full page URL or the click identifier value for this purpose. Withdrawing consent removes the local source record. A local “czytivo-purchase” marker prevents duplicate reporting of the same purchase and can be removed through browser settings.

The essential “__Host-czytivo_session” cookie maintains sign-in for up to seven days; signing out invalidates the session. Changing or resetting a password invalidates other sessions. A password-reset link is single-use and valid for 30 minutes. The shop also stores email-verification time and a secured hash of the verification link, valid for 24 hours. The hosting platform may independently use sign-in and security mechanisms. The shop does not use these mechanisms for advertising profiling.