Privacy Policy

1. Who is responsible

Kristián Mensa (Mr. Kriss), Malá Strana 46, 252 41 Dolní Břežany, Czech Republic, business identification number (IČO) 08069671, is the controller of the personal data used to run Mr. Kriss Essentials. Contact: kriss@mrkriss.com.

2. Data we use

Account data: your name, email address, authentication information and a securely hashed password. Order data: course, amount, currency, purchase and expiry dates, payment status and Stripe transaction references. Stripe receives the payment and billing information you enter; we do not receive your full card number.

Agreement records: the time and version of the Terms accepted and Privacy Policy acknowledged at registration; for checkout, the exact purchase agreement and immediate-access acknowledgement, the Terms snapshot and the linked order reference.

Course and security data: lesson progress and completion, browser/device identifiers and labels, approximate country, access decisions and limited technical logs. Hosting, video and payment providers necessarily receive connection information such as IP address and browser information to deliver their services. Approximate country is used to select checkout currency.

Email, support and voluntary progress-sharing data: course-email preferences, message type, order reference, sending attempts, status and provider message identifier; message content while queued or awaiting investigation; and any message or externally hosted video link you choose to send us for course feedback, support, complaints or withdrawal. The Site does not upload or host the linked video.

3. Purposes and legal bases

We use the data needed to create your account, take payment, deliver access, save progress and send essential account and purchase messages to perform the contract or take steps you request before a contract (GDPR Article 6(1)(b)). Required transaction records and handling statutory consumer rights are processed to comply with legal obligations (Article 6(1)(c)).

If you voluntarily share a progress message or video link, we use it to respond to your request for course feedback. Sharing progress is optional and is not required to use the Course.

We use proportionate security and access records to protect accounts, enforce the device limit and prevent fraud, and retain necessary evidence to establish or defend legal claims, on the basis of legitimate interests (Article 6(1)(f)). We balance these interests against your rights.

Optional reminders about your purchased course, completion thank-you messages and access-expiry reminders support your use of that course, on the basis of our legitimate interest in providing customer support. You can object and stop these messages in Account → Course emails or by emailing us. They are not a subscription to advertising or offers for other products.

Acknowledging this notice is not blanket consent to processing. Where processing is based on consent, you can withdraw it without affecting processing already lawfully carried out. The immediate-access acknowledgement at checkout concerns consumer withdrawal rights, not permission for marketing.

4. Providers and other recipients

Supabase provides account authentication and the database; Stripe processes payments; Mux delivers video; Vercel hosts the website; Resend sends account and course emails. We disclose only data needed for the relevant service. We may also share necessary records with our accountant or advisers and with authorities when required by law.

Providers act as processors where they handle data on our instructions. Some, including Stripe for fraud prevention and legal compliance, also act as independent controllers for their own purposes under their privacy notices. We do not sell customer data or share it for advertising.

Some providers operate internationally, including in the United States. Transfers outside the EEA must have an applicable legal safeguard, such as an adequacy decision (including the EU–US Data Privacy Framework for certified recipients) or Standard Contractual Clauses with any necessary supplementary measures. Contact us to request information about the safeguards applicable to your data.

5. Cookies, storage and video

The Site uses necessary authentication cookies and a device identifier to keep you signed in, manage sessions and enforce the access limit. Clearing cookies or changing browsers can require a new device registration. Your browser lets you manage cookies, but blocking necessary storage may prevent sign-in or playback.

We do not load Vercel Web Analytics or advertising pixels. We do use Vercel Speed Insights, which samples anonymous page-performance measurements such as loading and responsiveness times. It sets no cookies, assigns no identifier and does not profile you or follow you across sites. Optional Mux player tracking and its analytics cookies are disabled. Video delivery and hosting still require connection and technical data. Stripe Checkout has its own payment, security and any optional-service storage, explained in Stripe’s privacy information.

6. Retention and deletion

Account, progress, device and preference records are kept while your account exists and removed when you delete it. Local video-access decision logs are automatically removed after 90 days. Course-email records are removed when the account is deleted; message payloads are cleared after successful sending or cancellation, while unresolved messages retain the payload needed to investigate safely. Voluntary progress messages and links may remain in the monitored mailbox only as long as needed to respond and manage the correspondence.

Transaction records, linked purchase agreements and complaint or withdrawal evidence may be retained after account deletion where necessary for tax/accounting obligations or legal claims. The retention period is determined by the legal record category and the applicable statutory retention or limitation period, extended only where an ongoing proceeding or legal obligation requires it. These records are restricted to those purposes. Unlinked, abandoned checkout agreement records are kept for no longer than 30 days.

Deleting your account removes its direct link from retained purchase and agreement records, but payment references can still relate to records held by Stripe. Deleting an account does not automatically delete financial records from payment providers or require erasure of records that law requires us or them to retain. Ask us for the retention criteria applicable to a particular record.

7. Your rights

Subject to the GDPR conditions, you can request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. Contact kriss@mrkriss.com. We normally respond within one month; if an extension is permitted and needed, we explain it within that month. We may ask for proportionate verification of your identity.

You can manage optional course emails and delete your account in Account. Account deletion ends your ability to use the account; it does not itself constitute a refund request or remove your statutory consumer rights. You can contact us for support or withdrawal without deleting your account.

You may complain to your local data-protection authority. In the Czech Republic this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), https://uoou.gov.cz/.

8. Required data and automated checks

Account and payment details are necessary to provide paid access; without them we cannot complete the purchase or provide the account. Optional course emails are not required. We use automated access checks for payment status, expiry, lesson progress and device limits. These do not make decisions with legal or similarly significant effects within Article 22 GDPR. Contact us if an access check incorrectly prevents you from using the Course.

9. Security and younger users

We restrict access to personal data, hash passwords, use encrypted connections and protect video access with expiring tokens. No online system is perfectly secure. The Course is intended for adults; a parent or guardian must authorise a purchase or participation by a person under 18. Contact us if a child’s data was provided without appropriate authorisation.

10. Updates

The date above identifies this notice. We will communicate material changes as required. Posting an updated notice does not create consent to new purposes or retroactively change a purchase agreement.