Privacy Policy & Terms

1. Who we are

Myth vs Machine is an interactive online course available at mythvsmachine.com.

The data controller (administrator danych) is Cezary Pastor, ul. Kredytowa 8/43, 00-062 Warszawa, Poland. For any data-related requests, contact hello@mythvsmachine.com.

2. What data we collect

• Account data: email address and display name, collected only when you register. Required to save your progress and issue access to paid content.
• Purchase data: processed by Stripe, Inc. We do not store card numbers. We receive a Stripe customer ID and payment confirmation.
• Usage data: which steps you completed, your progress through playgrounds, and timestamps. Used to restore your session and display progress.
• Technical data: IP address, browser type, and anonymised access logs retained for up to 30 days for security purposes.
• Aggregated analytics: page views and custom events (e.g. checkout started, purchase completed) via Plausible Analytics — aggregated statistics without cross-site tracking or advertising profiles (see section 5).

3. Why we use your data (legal basis)

• Contract performance: to provide the course you purchased.
• Legitimate interest: to keep the service secure, prevent abuse, and understand aggregated traffic to improve the product.
• Legal obligation: to keep purchase records as required by tax law.

We do not sell your data to third parties.

4. Third-party processors

• Supabase: database and authentication (EU region).
• Stripe: payment processing.
• OpenAI / API providers: live sandbox prompts are sent to the model API to generate responses. Prompts are not stored by us after the response is returned.
• Vercel: hosting and edge network.
• Plausible Insights OÜ ([Plausible Analytics](https://plausible.io/)): privacy-oriented web analytics. Traffic data is processed on EU-owned infrastructure; Plausible does not use cookies for analytics and does not build individual advertising profiles. See Plausible's privacy policy and data policy.

6. How long we keep data

• Account and progress data. For as long as your account is active, or up to 3 years after your last login.
• Purchase records. 5 years as required by Polish tax law (art. 74 ustawy o rachunkowości).
• Technical logs. 30 days.
• Plausible analytics. Retention follows our Plausible plan settings (see Plausible dashboard).

7. Your rights (RODO / GDPR)

Under the GDPR (Regulation 2016/679) you have the right to:

• Access: request a copy of your personal data.
• Rectification: correct inaccurate data.
• Erasure: delete your account from Account or ask us by email.
• Restriction: limit how we process your data.
• Portability: receive your data in a machine-readable format.
• Objection: object to processing based on legitimate interests (including aggregated analytics).

To exercise any right, email hello@mythvsmachine.com with subject line “GDPR request”. We will respond within 30 days.

You also have the right to lodge a complaint with your national supervisory authority. In Poland: UODO (Urząd Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

8. Terms of use

• The course content is for personal, non-commercial use only.
• You may not share your account or redistribute course materials.
• The sandbox runs real AI model calls. Do not submit personal data, illegal content, or content that violates the model provider's terms of service.
• We reserve the right to suspend accounts that abuse the sandbox allowance.
• The course is provided “as is”. We are not liable for decisions made based on course content.

9. Refund policy

We offer a full refund within 30 days of purchase if you have not completed a substantial part of the course (self-serve: at most 2 paid playgrounds completed). Each account may use self-serve refund once. Request it from your account when eligible, or email hello@mythvsmachine.com.

10. Changes to this policy

We may update this page. The “Last updated” date at the top will reflect any changes. Continued use of the service after a change constitutes acceptance.