Invesaro
Invesaro

Privacy policy

What data Invesaro processes, why, for how long, and what your rights are.

Last changed: 2026-09-02

1. Who processes your data

The controller of your personal data is the operator of invesaro.com ("Invesaro", "we"). For anything about your data, write to alerts@invesaro.com.

2. What we collect and why

  • Account. Your email address, a hash of your password (never the password itself), and if you sign in with Google, your Google account id and name where Google provides it. Also the language you use the site in and the date of your last sign-in. Basis: performance of the account contract (Art. 6(1)(b) GDPR).
  • Newsletter. Email address, language and the date of confirmation. We send new theses and verdicts. Basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw with one click in every message or in your account settings.
  • Alerts on followed theses. Which theses you follow and whether you want email about them. Basis: contract. Switch them off in settings or through the link in every mail.
  • Payments. A customer id and subscription status in Stripe. Card details go to Stripe only; we never see them. Basis: contract and accounting obligations (Art. 6(1)(c) GDPR).
  • Visit statistics. Google Analytics 4 with IP anonymisation, loaded only after you agree in the banner. Basis: consent. Without it the Google script is not loaded at all.
  • Server logs. IP address, browser and requested address, kept briefly for security and troubleshooting. Basis: our legitimate interest (Art. 6(1)(f) GDPR).

3. Who we share it with

We do not sell data. We use processors that handle it on our behalf: Stripe (payments), Google (sign-in and, with consent, statistics), Brevo (email delivery) and the provider hosting the server the site runs on. Some of them may process data outside the European Economic Area under standard contractual clauses or an adequacy decision.

4. For how long

Account data: until you delete the account, which you can do yourself in settings. Newsletter: until you unsubscribe. Accounting records of payments: as long as tax law requires. Google Analytics: according to Google's retention setting, no longer than 14 months.

5. Your rights

You have the right to access, rectify, erase, restrict, port and object to the processing of your data. You can withdraw consent at any time without affecting the lawfulness of earlier processing. You can lodge a complaint with your supervisory authority; in Poland that is the President of the Personal Data Protection Office (uodo.gov.pl). Delete your account yourself in settings; for everything else, write to the address above.

6. Cookies and browser storage

  • lang: a cookie remembering your language, valid one year. Strictly necessary.
  • Session token in your browser's local storage, which keeps you signed in. Strictly necessary.
  • Your analytics choice in local storage, so the banner does not ask again. Strictly necessary.
  • Google Analytics cookies: only after consent. To change your choice, clear the site's data in your browser and the banner will appear again.

7. Changes

When this policy changes, the date at the top changes with it. Signed-in users are told about material changes by email.