Privacy Policy

Last updated: 26 September 2026

1. Data controller

The controller of your personal data is Bartłomiej Filipiuk Devins (the Devince brand), ul. Stacyjna 1, 53-613 Wrocław, Poland, Tax ID (NIP): 596 158 99 01 (the "Controller"). Contact for data matters: bartek@devince.dev. The Controller has not appointed a Data Protection Officer.

2. Purposes and legal bases (GDPR)

3. Recipients (processors)

Data may be entrusted to the following processors, with whom the Controller has data processing agreements (Art. 28 GDPR):

• Stripe (Stripe Payments Europe, Ltd., Ireland) — payment processing; processes payment and identification data. Stripe may transfer data to the USA under the EU–US Data Privacy Framework (DPF) and Standard Contractual Clauses (SCCs). Stripe acts as a processor and, for fraud prevention and regulatory duties, as a separate controller.
• Brevo (Sendinblue SAS, Paris, France) — sending e-mails (transactional and marketing); an EU-based processor, data processed in the EU.
• Hetzner Online GmbH (Germany) — hosting/infrastructure; an EU-based processor (servers in Germany).
• Discord (Discord Inc., USA) — (a) the Controller's internal channel that receives operational order notifications containing only the order ID, product name and amount (no buyer e-mail address); (b) community and support channels for Customers (see the "Discord" section). The transfer to the USA is based on Standard Contractual Clauses (SCCs) and, where applicable, the EU–US Data Privacy Framework.
• Scanye — an accounting-document tool; processes data contained in invoices (e.g. company name, tax ID, address).
• GitHub (GitHub Inc., USA) — where access to materials or a repository is provided via GitHub, your GitHub username and related data are processed. Transfer to the USA — based on the DPF and SCCs.
• The online meeting (video-conferencing) provider — for live sessions; the tool is named in the meeting invitation. Where the provider processes data outside the EEA, this is based on the DPF or SCCs.
• AI tool providers (language models) — where correspondence is processed with them (see the "AI tools" section); transfers outside the EEA — based on the DPF or SCCs.

Analytics (Umami)

For traffic statistics the Controller uses self-hosted Umami (at stats.67projects.app). Umami runs without cookies and without cross-site tracking identifiers; it collects only anonymous, aggregate data (e.g. page views, country, device type, buy-button clicks). We do not use third-party analytics (e.g. Google Analytics) or advertising tools. Because the analytics is cookieless and anonymous, no cookie-consent banner is required.

Live sessions and recordings

Live sessions (e.g. as part of a workshop or course) may be recorded. Only the host's screen and voice are recorded; if you speak (e.g. ask a question), your voice may appear in the recording. Participants' cameras are not recorded. If you do not want your voice in the recording, you can ask your question in the chat or on Discord. Recordings are made available only to participants of the given edition and are kept for 12 months from the session, then deleted.

Discord

On Discord channels we process your username, avatar and the content of the messages you post. Messages are visible to other channel participants. Discord Inc. also processes your account data as a separate controller under its own privacy policy. Do not post sensitive data, passwords or access keys on Discord.

AI tools

Correspondence with the Controller (e-mail, Discord, complaints) may be processed using AI tools (e.g. to draft a reply or summarise a case). The legal basis is the Controller's legitimate interest (Art. 6(1)(f) GDPR) — handling enquiries efficiently. Replies and decisions in your case (e.g. resolving a complaint) are made by a human. You may object to such processing by writing to bartek@devince.dev.

Embedded videos (YouTube)

Course pages and lessons may embed videos from YouTube (Google Ireland Ltd. / Google LLC). Videos are embedded in privacy-enhanced mode (youtube-nocookie.com): loading the page sets no tracking cookies, but your browser connects to Google's servers (IP address, device data). Once you play a video, Google may read and store data in your browser — under Google's privacy policy, as a separate controller. Data may be transferred to the USA (based on the DPF).

Newsletter and marketing (consent, double opt-in)

If you subscribe to the newsletter — at checkout by ticking the separate, optional "I want to receive the newsletter" box (independent of the purchase consent), via the signup form, or by giving your e-mail in exchange for free content (a lead-magnet — a free app or course) — your e-mail address is added to a mailing list operated by Brevo (Sendinblue SAS). We use double opt-in: after subscribing you receive an e-mail with a confirmation link, and your address is added to the list only after you click it. Brevo keeps an auditable record of that consent. Alongside the address we store attributes used solely for sending-segmentation: the subscription source (purchase or lead-magnet), the product identifier (slug), and the surface (apps/courses). The legal basis is consent (Art. 6(1)(a) GDPR). For a lead-magnet, joining the list and unlocking the free content happen with the same confirmation click. You may withdraw consent at any time — using the "unsubscribe" link in the footer of every message, or by writing to bartek@devince.dev — without affecting the lawfulness of processing before withdrawal.

4. International transfers

As a rule, data is processed within the European Economic Area. Transfers outside the EEA may concern: the payment provider Stripe (USA) — based on the DPF and SCCs; Discord (USA) — order notifications (without e-mail address) and community channels — based on SCCs or the DPF; GitHub (USA), the online meeting provider, AI tool providers and YouTube/Google (USA) — based on the DPF or SCCs. These mechanisms ensure an adequate level of protection.

5. Retention periods

• Accounting documents (invoices): 5 years, counted from the end of the calendar year in which the tax payment deadline fell.
• Order and account data: for the duration of the contract/account, then until the limitation periods for mutual claims expire.
• Newsletter data: until consent is withdrawn.
• Course progress data: for the duration of access, then deleted or anonymised.
• Live-session recordings: 12 months from the session.
• Correspondence: as long as needed to handle the matter, then until the limitation periods for claims expire.
• Discord messages: until deleted by you or the Controller, or until the channel is closed.
• Session/login cookie: until you log out or the session expires.

6. Your rights

You have the right to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21) — in particular to processing based on legitimate interest and to marketing — and the right to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal). Exercise your rights by contacting bartek@devince.dev.

7. Complaint to the supervisory authority

You have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland, if you consider that the processing of your data infringes the GDPR.

8. Whether providing data is required

Providing data is voluntary but necessary to conclude and perform the contract (e.g. to deliver the file, issue an invoice). Not providing it makes order fulfilment impossible.

9. Cookies

The Store itself sets only an essential cookie: a session/login cookie (for Courses), valid until you log out or the session expires. The theme preference (light/dark) is stored in the browser's local storage (localStorage) and is not sent to the server. Essential cookies do not require consent; we inform you about them in this Policy. During payment, Stripe may set its own essential cookies (e.g. for fraud prevention). The Controller does not use analytics or marketing cookies — the analytics in use (Umami, see the "Analytics" section) is cookieless and sets no cookies. Third-party cookies may be set by embedded YouTube videos (see the "Embedded videos" section). Cookies can be managed in your browser settings.

10. Automated decision-making

The Controller does not make decisions about you based solely on automated processing (including profiling) that produce legal effects or similarly significantly affect you. The payment provider Stripe may apply its own fraud-risk scoring.

11. Changes to this Policy

This Policy may be updated; it is effective from 26 September 2026.