Privacy Policy — Brief-S

1. Data Controller

The controller of personal data collected through Brief-S (brief-s.com) is Łukasz Ogorzałek, conducting unregistered business activity (działalność nierejestrowana), correspondence address: ul. Kołłątaja 12/1, 71-600 Świnoujście, Poland, publisher of Brief-S under the brand name Arcan Schalier (“Publisher” / “Controller”). “Arcan Schalier” is a brand name only, not a separate legal entity. For data protection inquiries: [email protected].

2. What Data We Process

User account: email address, display name, encrypted password hash. Via Google sign-in: email and basic profile from Google.
Membership & billing data: chosen tier and billing cycle, Membership status and history, and — handled by our payment processor Stripe — the data required to take payment. Brief-S stores a Stripe customer/subscription reference and the record of each charge; Brief-S does not store full card numbers.
Purchase consents: the record that you accepted the Terms/Privacy Policy and acknowledged losing the right of withdrawal, with timestamps and the document version.
“Your Book” portfolio data (optional, Inner Circle): if you use the portfolio tool, the positions, entry prices, quantities and notes you enter. This is self-entered data used only to display your own book back to you; it is not shared.
Newsletter “The Short”: email address provided at sign-up.
Reading data: article reading progress linked to your account (“continue reading”).
Technical data: standard server logs and essential cookies required to maintain your logged-in session.

3. Purposes and Legal Bases

Account management and content access — Art. 6(1)(b) GDPR (performance of a contract).
Processing payments and managing paid Memberships — Art. 6(1)(b) GDPR (performance of the Membership contract).
Issuing invoices and meeting accounting/tax obligations — Art. 6(1)(c) GDPR (legal obligation).
“Your Book” portfolio tool — Art. 6(1)(b) GDPR (providing the feature you requested).
Newsletter “The Short” — Art. 6(1)(a) GDPR (consent), withdrawable at any time.
Security and proper functioning of the website — Art. 6(1)(f) GDPR (legitimate interest).

4. Retention Period

Account and portfolio data: for the lifetime of the account and until its deletion.
Membership and payment records: for the duration of the Membership and afterwards as required.
Invoices and accounting data: retained for the period required by tax law (in Poland, 5 years from the end of the accounting year).
Newsletter data: until consent is withdrawn (unsubscribe).
Technical data and logs: for the period necessary for security, then deleted or anonymised.

5. Recipients and Processors

Data may be entrusted to trusted providers acting on the Controller’s behalf, in particular: the hosting infrastructure provider; the email delivery provider; Stripe Payments Europe, Ltd. as payment processor; and — for Google sign-in — Google as an authentication provider. These entities process data only within the scope and purpose specified by the Controller.

Market-data providers (Finnhub, Alpha Vantage): the terminal and the “Your Book” tool display market quotes and indicators obtained from third-party market-data providers. Requests to these providers are made server-side and contain only instrument identifiers (e.g. ticker symbols) needed to retrieve the data. No personal data about you — no account identifier, email, or your portfolio holdings — is sent to these providers.

6. Your Rights

You have the right to: access and a copy; rectification; erasure; restriction; portability; objection; withdraw consent at any time (without affecting prior lawful processing); and to lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland. To exercise these rights: [email protected].

7. Cookies

The website uses only essential cookies necessary to maintain the logged-in session and remember language preferences. We do not use marketing tracking cookies or third-party analytics. Should analytics be implemented in the future, this policy will be updated and consent requested.

8. Changes to This Policy

The Controller may update this Policy. The current version is always available here, with the date of the last update.