Privacy Policy

1. Who is responsible

The controller of personal data used to operate Backend Certs is:

This notice covers our website and study space under the EU General Data Protection Regulation (GDPR). You can contact us by email without creating an account.

2. Information we use and why

• Your account: GitHub supplies your account identifier, name, email address and profile image when you sign in. We store the connection, authentication credentials, account role and session details to create and secure your account. The legal basis is providing the service you request (Article 6(1)(b) GDPR).
• Your study activity: selected answers, attempts, results, material interactions, study plans, progress and preferences let us deliver practice, save your work and show your history. The legal basis is performance of our contract (Article 6(1)(b)).
• Purchases and access: order references, amounts, currency, payment status and access dates connect a verified purchase to your account. We use these for contract performance (Article 6(1)(b)), applicable accounting obligations (Article 6(1)(c)) and resolving payment disputes (Article 6(1)(f)). We do not collect card numbers or card security codes in the study space.
• Support and feedback: messages, question reports, related question or attempt references, and our replies help us resolve requests and correct content. We use contract performance for account support, legal obligations for rights requests, and our legitimate interest in maintaining accurate study materials for feedback (Articles 6(1)(b), (c) and (f)). Avoid including sensitive information in messages.
• Optional language interest: a programming-language preference linked to your account helps us decide which course variant to develop. We rely on our legitimate interest in planning the product (Article 6(1)(f)). You can remove this preference in the same form. Recording interest does not subscribe you to marketing emails.
• Optional study reminders: when you turn them on, we use your account email, reminder time and study progress to send your next study step. You can turn reminders off in your account or from any reminder email. We record your choice and delivery attempts to avoid duplicate messages and handle failures.
• Security and operations: IP addresses, browser information, request metadata, authentication events and audit records help us prevent abuse, investigate faults and protect accounts. The legal basis is our legitimate interest in secure and reliable operation (Article 6(1)(f)).

Account and access information is needed to provide authenticated study and paid access. Without it, those features cannot work. Feedback and language interest are optional. We do not sell personal data or use your study results for advertising. Practice scores are learning feedback; we do not use them to make automated decisions with legal or similarly significant effects on you.

3. Who receives information

• GitHub: provides sign-in and manages your GitHub identity under its privacy statement.
• Google Cloud and Firebase: provide application hosting, delivery and operational infrastructure. Support emails sent to our Gmail address are also handled by Google. See Google’s privacy policy.
• Neon: hosts the database containing account, study and access records. See Neon’s privacy policy.
• Resend: sends the study reminders you enable. It receives your email address and the reminder content, including your next study step and remaining time estimate. See Resend’s privacy policy.
• Lemon Squeezy: operates checkout as merchant of record. It receives the information you enter at checkout and order-linking references from us; it supplies payment and refund information so we can manage access. Its own payment, tax and fraud processing is described in its privacy policy.
• Authorised support staff and professional advisers: may access relevant information to resolve requests, meet legal duties or handle disputes. Authorities may receive information where the law requires it.

These providers operate internationally, so processing or support access may take place outside the European Economic Area, including in the United States. GDPR requires a valid transfer mechanism, such as an applicable adequacy decision or standard contractual clauses, for restricted international transfers. Contact tomas.svojanovsk11@gmail.com for information about the safeguards relevant to your data and how to obtain a copy.

4. How long information is kept

Account and study records are kept while your account provides access to the service or your study history. Expiry of paid access does not delete your account or completed results. You can request deletion at any time.

Support and security records are retained for the time needed to resolve the relevant issue, investigate abuse or establish, exercise or defend legal claims, taking account of the applicable limitation periods. Order and accounting records may need to remain for the statutory retention period that applies to the particular record. These exceptions do not justify keeping unrelated study data indefinitely.

Deletion requests are reviewed manually. Records that must be retained for a legal obligation or an ongoing dispute are restricted to those purposes. Backup copies may remain until the relevant backup expires. Contact us for the retention criteria and status of a particular record.

5. Cookies and browser storage

The study space uses authentication cookies to keep you signed in and protect the sign-in process. A sign-in session lasts up to seven days and can be renewed when you use the service. Short-lived sign-in state is used while connecting to GitHub.

Browser session storage keeps temporary study actions and checkout retry references, normally until the tab is closed. Local storage keeps study preferences and, for content editors, recoverable working copies until they are replaced, removed or you clear browser storage. These features support the service you request.

We do not currently add advertising pixels or optional analytics cookies to the study space. There is no optional tracking consent to give here. GitHub and Lemon Squeezy manage cookies on their own sign-in and checkout pages. Blocking necessary cookies can prevent sign-in; clearing browser storage can remove local preferences or unsaved work.

6. Your GDPR rights

You can request access to and a copy of your personal data, correction, deletion, restriction, and portability where applicable. You may object to processing based on legitimate interests on grounds relating to your situation. If processing relies on consent, you can withdraw that consent without affecting processing already lawfully carried out.

Use Your data in account settings for the available export and deletion-request tools, or email tomas.svojanovsk11@gmail.com for any rights request. A self-service export is not a limit on your right of access. You can email us even if you cannot sign in or an active exam temporarily prevents a self-service export.

We respond without undue delay and normally within one month of receiving your request. If the GDPR permits an extension for a complex or numerous request, we will explain the reason within that month. We may ask for information reasonably necessary to verify your identity.

You can complain to the Czech supervisory authority, Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, or to the supervisory authority in your country of habitual residence, work or the alleged infringement.

7. Changes to this notice

We will update this notice when our processing changes and provide additional notice of material changes where required. The date above identifies this version.