Privacy Policy

Who is responsible

The controller for the data described here is Vincoria, operated by Edmond Ivanov, Belgium. For anything about your data, including the requests below, write to privacy@vincoria.com.

What we collect

Account data: email and name. Learning data: lesson progress and quiz scores. Billing data is handled by Polar (merchant of record); we never see full card numbers. Analytics events (pages viewed, features used) are collected only after cookie consent.

Launch list: if you enter your address on the pre-launch page, we store that address, the date, and nothing else. No name, no IP address, no tracking pixel in the email.

Why we collect it

To operate your account and progress (contract), to send transactional email such as verification and receipts (contract), to improve the product via consented analytics (consent), and to meet accounting obligations (legal obligation).

The launch list runs on consent, and on nothing else. We use the address to tell you when Vincoria opens, and for no other purpose: it is not profiled, not enriched, not shared, and never sold. Every message carries a one-click link that deletes the address, and using it costs you nothing and requires no explanation. If the launch does not happen, the list is deleted.

Processors

Vercel (hosting, USA/EU edge), Neon (database, EU), Polar (payments, merchant of record), Resend (transactional email), PostHog (product analytics, EU cloud), Sentry (error monitoring). Each processes only what its function requires.

Data leaving the EU

Your data is stored in the EU: the database is hosted in the EU, and analytics runs on PostHog's EU cloud. Two processors are US companies. Vercel serves the site, and Polar handles payments as merchant of record; both are engaged under the European Commission's standard contractual clauses, which is the safeguard required by Chapter V of the GDPR for transfers outside the EEA. You can ask us for a copy of the arrangements at privacy@vincoria.com.

Retention and deletion

Account and progress data are kept while the account exists. To delete your account, write to privacy@vincoria.com from your account address; personal data is removed within 30 days, except invoices retained for statutory accounting periods.

Launch list addresses are kept until the launch announcement has been sent, or until you leave the list, whichever comes first. Leaving deletes the row outright: we do not keep a record of who unsubscribed, because that would mean holding an address for the sole purpose of remembering that its owner asked us not to.

Your rights

Access, rectification, erasure, portability, restriction and objection, per the GDPR. Where we rely on consent you can withdraw it at any time, and withdrawing is as easy as giving it was: the cookie banner reopens from the footer, and the launch list has a one-click link in every email. Withdrawing does not undo processing that already happened lawfully.

Write to privacy@vincoria.com; we answer within 30 days, free of charge. If you are not satisfied you may complain to the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels, autoriteprotectiondonnees.be.