Privacy.
What is collected when you buy, who processes it, and how to have it removed.
1. Who is responsible
Effata Core Filip Gajko is the controller of the personal data described here. Questions about anything on this page, or any request listed in section 7, go to t.me/payoutvault.2. What is collected
Six things, and nothing else:- Your account. When you create a Payout Vault account, Firebase Authentication stores your email address and either a hash of your password or the fact that you signed in with Google. Never the password itself, which this site never sees. Legal basis: performance of the contract, because the account is how your access is delivered.
- Your profile. A single Firestore document holding your email, display name, plan and role. It is what decides which parts of the library open for you. Legal basis: performance of the contract.
- Your email address. It comes from Stripe when you complete a purchase. It is used to unlock your downloads on the access page and to send you the email containing your access link. Legal basis: performance of the contract you entered when buying.
- Your purchase record. Which tier you bought, which files it unlocks, and the date of purchase. Stored against your email address so the access page can recognise you later. Legal basis: performance of the contract.
- Your IP address, briefly. When you submit your email on the access page, your IP is used as a counter to limit how many attempts can be made per minute, so nobody can script through a list of addresses to find out who bought. The counter is deleted automatically 60 seconds after it is created. Legal basis: legitimate interest in protecting buyers from having their purchases enumerated.
- An anonymous page view, only if you agree. If you press Accept on the banner, Vercel Web Analytics counts which pages are visited, which country the visit came from, and which site linked here. It sets no cookie and builds no profile: it cannot tell that two visits came from the same person on different days, and none of it is connected to your email or your purchase. Press Decline and nothing is loaded or counted at all. Legal basis: your consent, which you can withdraw at any time using the Cookie settings link in the footer.
3. What is not collected
Your card details never reach this site. Payment is handled entirely by Stripe on Stripe’s own systems. There is no advertising pixel, no tracking cookie, no cross-site tracking, and no profiling of any kind on this site. The analytics described in section 2 count pages, not people. Your data is not sold, rented, or shared for marketing.4. Who processes it
These services handle data on my behalf so the product can be sold and delivered. Each is bound by its own data processing terms.Stripe takes the payment and collects your email at checkout. Google (Firebase Authentication and Cloud Firestore, operated by Google Ireland Limited) holds your sign-in credentials and your profile document. Resend sends the email containing your access link. Upstash stores your email and purchase record. Vercel hosts the site, serves the product files, and, only once you have accepted, provides the page view counts through Vercel Web Analytics.
This site also loads its fonts from Google Fonts, which means Google receives your IP address when a page loads. That happens on every page, whether or not you buy anything.
5. Storage on your device
No cookies are set, including by the analytics. When you are signed in, Firebase Authentication keeps your session token in your browser’s IndexedDB so you are not asked to log in on every page; signing out deletes it. The access page keeps the email and code you type in your browser’s session storage so you do not have to retype them while moving around the page, and it is cleared when you close the tab. Your answer to the banner is stored in local storage, which is the only way the site can remember not to ask you again. None of this is used to identify you, follow you, or send anything anywhere.6. How long it is kept
Your account, your profile document, your email and your purchase record are kept for as long as your access lasts. Because the product is sold as lifetime access, that means they are kept until you ask for them to be deleted, at which point you also lose the ability to unlock your downloads again. Rate limiting counters are deleted after 60 seconds. Records that Stripe must keep for accounting and tax purposes are governed by Stripe and by the retention periods Polish law requires of invoices.7. Your rights
Under the GDPR you can ask for a copy of the data held about you, ask for it to be corrected, ask for it to be deleted, ask for processing to be restricted, ask to receive it in a portable format, and object to processing carried out on the basis of legitimate interest.Deleting your account removes the Firebase Authentication record and the Firestore profile together, and with them your ability to sign in. Message the Telegram contact in section 1 and it will be handled within one month. If you are not satisfied with how it was handled, you can complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa.