This notice describes how we process personal data on the platform at [[FILL IN: the platform's web address, e.g. https://platform.example.org/]] (the "platform"). It gives the information required by Articles 13 and 14 of Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and Article 399 of the Polish Act of 12 July 2024 – Electronic Communications Law (Prawo komunikacji elektronicznej).
In short
- Controller: [[FILL IN: the controller's name]]. Contact for personal data matters: [[FILL IN: e-mail address for personal data matters]].
- We process your account and profile data, your content and technical data (IP address, browser, time of actions) to run your membership and provide the platform's features (contract), to protect accounts and the platform and be able to show who did what (our legitimate interest), and to handle your rights (legal obligation).
- Signed-in members see your profile, and your e-mail address and phone only if you allow it; the platform team has wider access (section 11).
- We do not sell data and use no advertising or analytics, and apart from the map's tiles, which come from OpenStreetMap (section 7), the platform's pages fetch nothing from outside servers; how we send mail and who provides our server is said in sections 9 and 12.
- We keep account data for as long as the account exists; audit trail records — the register of important actions (with IP addresses) — for as long as the platform operates, also after an account is erased; backups — as section 10 says.
- You have the right of access, rectification, erasure, restriction of processing and portability, the right to object and the right to complain to the President of the Polish Personal Data Protection Office (Prezes UODO); you download a copy of your data, and ask for your account's erasure, on your profile, in the "Your data" tab.
1. The controller
The controller of your personal data is [[FILL IN: the controller's full name, registered address, registration numbers — KRS, NIP, REGON as applicable]] ("we", "us").
On any matter concerning personal data — also if you have no account on the platform — write to us at [[FILL IN: e-mail address for personal data matters]] or to the postal address above. [[FILL IN: the data protection officer's contact details, or the sentence: We have not appointed a data protection officer.]]
The people to whom we have given staff or superuser rights on the platform are called the platform team below.
2. Whom this notice concerns, and where the data comes from
This notice concerns people visiting the platform (section 3), people invited to it (section 4), members of the platform (sections 5–14) and people whose data reaches the platform from others (below).
The platform is closed: there is no self-service sign-up and no sign-in with Google or Facebook. An account comes into being only when a person accepts an invitation issued by the platform team (section 4), or is created directly by the platform team at the server's console. Without signing in, only these can be reached: the welcome page, sign-in, password reset, the page of an invitation, choosing the language, this notice (with its earlier versions), avatars, logos and pictures attached to community news (at their addresses), and technical addresses: the maintenance page, the admin panel's sign-in page and an address that only reports that the server is running.
Most data comes from you or arises as you use the platform; some comes from others:
- from the platform team — the invitation made out to you: your e-mail address, the community and a note saying who it is for (section 4);
- from a person who accepted an invitation you issued — that their account was made with it, which makes you their patron (section 4);
- from the platform team — an account it creates (username, e-mail address), communities and your role in them, clearances, your patron, availability periods and the profile fields only it fills in (sections 5 and 7);
- from other members — content that mentions you, and invitations to events (section 7);
- from people who typed your username or e-mail address when trying to sign in (section 3).
3. Visiting the platform
When you open a page of the platform, our server records in its log: your IP address, the time, the kind of request, the page address without parameters (the part after "?") and with the secret parts of invitation and password-reset links replaced by a marker, the response code, the bytes sent, the address of the page you came from (without parameters), your browser's identifier (User-Agent), for a request that carries HTTP Basic authentication, the name it gives, and, for a connection through a proxy, the IP addresses the proxy passes on. Requests for static and media files (such as avatars) are not in this log. The server's error log records only the server's own serious faults (such as a full disk); such an entry may hold the full page address, parameters included.
The platform's application log records the account's identifier at every sign-in and sign-out, and a failed sign-in without the name typed. The logs have no fixed retention period: each service keeps at most about 30 MB of log, and new entries replace the oldest — the faster, the busier the platform.
We record every sign-in and every failed sign-in attempt in the audit trail (section 8) with the IP address and browser, and a failed attempt also with the name typed (a username or an e-mail address); the member whose account the name typed points to — by its username or e-mail address, and only when it points to a single account — also sees, for 30 days, the time of the attempt and the IP address and browser of whoever made it (section 8). If you type your password into the name field by mistake, it is recorded as the name typed — change your password then. While sign-in is delayed or paused, the attempts refused for that reason are recorded at most once a minute for the same name and IP address (for the address alone when the whole IP address is paused). We count failed attempts in the server's cache — for the pair "name (as a hash) and IP address" and for the IP address alone — for 15 minutes after the last attempt: after 5, further attempts are delayed (up to 60 seconds), and after 10 for the pair or 50 from one address, sign-in is paused for 15 minutes; the account itself is never locked. Requests for a password-reset link are counted in the same cache for an hour, by the e-mail address typed and by the IP address: beyond 3 for one e-mail address or 10 from one IP address, a request is not carried out.
If you ask for a file's download address without signing in, the file is not handed out — you are sent to the sign-in page — and we record the attempt in the audit trail together with your IP address and browser.
The platform stores in your browser a cookie that protects forms and — once you sign in, or when it must remember a pause after a failed attempt or a password-reset link you opened — a session cookie, and, if you choose a language in the page header, a cookie that remembers it (section 19).
Legal basis: Article 6(1)(f) GDPR — our legitimate interest in keeping the platform working and secure, detecting break-in attempts and abuse, and investigating incidents. How long: logs — as above; audit trail records — for as long as the platform operates (section 8); failed-attempt counters — 15 minutes; password-reset counters — an hour.
4. The invitation
Nobody registers on the platform by themselves. Someone from the platform team issues an invitation for one community: a link that works once, for 72 hours. The link is shown once to the person who issued it and, when an e-mail address was given for the invitation, it is also sent to that address (section 9). The invitation holds: the e-mail address it is made out to (if one was given), the community, a note saying who it is for (for the platform team's list; the invitation's page does not show it), who issued it, when it was issued and when it expires, and later when it was accepted and which account was made with it, or when it was revoked. Of the link's secret part we keep only a cryptographic hash.
On the invitation's page you choose a username (you will sign in with it), a display name and a password, give an e-mail address — if the invitation names one, that address is your account's and cannot be changed there; otherwise giving one is optional — and tick the box "I have read the privacy notice and accept it". We ask for nothing else. By ticking the box you only confirm that you have read this notice — you are not consenting to processing or entering into a contract; we record the version number of this notice and the time, with your profile. Openings of an invitation link that is not open (a wrong, used, revoked or expired one) are counted in the server's cache by IP address for an hour: after 20 the page asks you to wait. Sendings of an open invitation's form are counted too, for each invitation: after 20 in an hour its page asks you to wait.
When you send the form we make your account at once and sign you in. We create your profile with the display name you gave (and the account's e-mail address, if it has one), add you to the invitation's community, record the member who issued the invitation as your patron, if that member has a profile (other members see who your patron is, as section 6 says), record your acceptance of this notice and mark the invitation as used.
Issuing, revoking and accepting an invitation, and your acceptance of this notice, are recorded in the audit trail (section 8) with the invitation's number and the community — and whether an address was given, never the address itself — and a step taken through the site also with the IP address and browser. The making of your account and your first sign-in are recorded there too, with your username, and your joining the community with your display name and profile address.
Legal basis: Article 6(1)(b) GDPR — steps taken at your request before entering into the membership contract, made on the terms on which members use the platform ([[FILL IN: the terms of service or other agreement under which members use the platform, and its address]]); an invitation made out to a person who has not accepted it, and the record of who issued an invitation — Article 6(1)(f) GDPR (our interest: admitting new members at the invitation of the platform team, and knowing who invited whom); the audit trail records — Article 6(1)(f) GDPR (section 8).
How long:
- An invitation's link works once, for 72 hours; after that, or once the invitation is revoked, its page says only that the invitation is not open.
- An invitation — used, expired or revoked alike — is deleted in the nightly housekeeping 30 days after its link expired.
- The invitations that are yours — the one your account was made with and any made out to your e-mail address — are deleted earlier if your account is erased (section 13); until then they are in the copy of your data (section 14).
- After an invitation is deleted, the audit trail records remain (section 8); your account, your acceptance of this notice and your membership of the community do not depend on it.
5. Your account and profile
Account data: username, e-mail address, password (we keep only a cryptographic hash of it), the dates the account was created and last signed in, and whether the account is active and has staff or superuser rights; first and last name — only if someone from the platform team enters them.
Profile: display name (required), "About you", avatar, phone, e-mail address (copied from the account when the profile is made), the "Member since" date, a profile address, preferred language, time zone, communities and your role in them, clearances, and your patron — the member who invited you. The profile address is made once, from the display name the profile had when created (the one you gave on the invitation's page), and never changes. Clearances are trust levels that only superusers give: they decide which files you may read (section 7).
An address is optional, on the "Edit profile" tab of your profile: it is text you type, as you would write it on an envelope. We keep it exactly as you typed it — nothing is looked up from it. You decide whether other members see the address, with a switch beside it (off by default). You can change or clear it yourself at any time. On the Team plan you can also mark where you live on the map, in the "Where you live" section of your profile: it is a point and — if you use the address look-up — also the street, building number, locality, region and country (section 7). You decide who sees it: "Not shown to anyone" (the default), "Approximate area only" (the point rounded to about 1.1 km, and the locality only) or "Exact address". You can move the point or hide it, but you cannot delete it yourself — write to us for that.
An avatar may be a JPEG, PNG, GIF or WebP picture of up to 2 MB; before storing it we make a new picture file from it, which removes metadata such as the GPS position and camera details, and we store it under a random name. The profile also has fields that only the platform team can fill in, such as a date of birth; they are not shown to other members.
On your profile you can change your display name, "About you", avatar and phone, whether other members see your e-mail address and phone, and your home address with its visibility; in its "Account" tab, your time zone and language. You change your e-mail address in the same tab, through a confirmation link sent to the new address (section 9). Your username, communities, clearances and patron you cannot change yourself — write to us about them. In the "Security" tab you can also create a "Key store" protected by a passphrase that we do not store: if you forget it, nobody — we included — can open what the store holds. Its creation is recorded with the IP address and browser in the audit trail and in the cryptographic operations log (section 13). Only you see the "Account", "Security" and "Your data" tabs of your profile.
Legal basis: Article 6(1)(b) GDPR — performance of the membership contract (section 4) and providing the platform's features; data entered by the platform team (such as communities, clearances, the patron) is processed on the same basis. How long: for as long as your account exists — also if you stop using it or it is deactivated; we do not delete accounts automatically for inactivity. Once you change your profile data, the platform does not keep the previous values (such as the previous avatar) — except in earlier audit trail records (for example of joining a community), which keep the display name of the moment they were made; the record of the change itself holds the names of the fields changed, without their previous values. Previous values may also remain in backups (section 10).
6. What other members see
All signed-in members — from any community — see on your profile and in the member list: your display name, profile address (made from the display name you first gave), avatar, "About you", "Member since" date and your patron, and your e-mail address and phone only if you allow them to be shown (they are hidden by default). Communities are private: who is in a community — its member list and its org chart, on which your patron is also shown — is seen only by that community's members, its head and the platform team, and your profile names to another member only the communities you share with them; how many members a community has is shown to everyone signed in. Your profile also shows the upcoming events you organise or whose invitation you have accepted (title, time and place) — each viewer only those they may see themselves (section 7). Members whom the platform team adds to the data_mesh group can also read the member list, the communities and their org charts as data, and events with the invitations to them, through the platform's programming interface (API) — with the e-mail addresses and phone numbers members show to others, never the hidden ones.
Other members see your address only if you switch it on — on your profile; switching it off takes effect at once. While it is off, only you and the platform team see it. Your home on the map other members see only if you switch its sharing on, and only those who have the map (the Team plan) — on your profile and on the "People near a place" map in Locations, and if you choose "Exact address", also among the addresses on the shared Locations map and in the lists a place is chosen from; switching it off takes effect at once. While sharing is off, we show your point to other members nowhere on the platform — with one exception: if someone else on the platform lives at the same address and shares it as an "Exact address", that address shows among the addresses on the shared Locations map, without the name of anyone who lives there.
The platform keeps notifications for you only about the buckets you own: that another member uploaded a file there, replaced it, moved it to the Trash or restored it. A notification holds the file's name, the bucket's name and who did it; each is kept until you read it and for 30 days after, then deleted. In the same way, when you do one of these things in a bucket somebody else owns, its owner is told, with your display name. Nobody is told when you sign in, sign out or join a community, and there is no list of who is online.
Visible only to you and the platform team are your clearances (you see them in the copy of your data, section 14). The avatar file is available without signing in at a random address — anyone who knows that address can fetch it, and browsers and intermediate caches may keep it for up to 7 days.
Legal basis: Article 6(1)(b) GDPR — a shared member directory, in which members see one another, is part of the membership service, and showing your e-mail address, phone and home address are settings you choose.
7. Your content and the platform's features
Storage (files): we keep the files you upload, with their name, notes, size, type, upload time, owner, bucket and folder, and their saved versions with author and time (up to the 20 latest unnamed versions; named versions and copies kept after a saving conflict for as long as the file exists). The platform team can keep a bucket in an outside S3-compatible file storage service; the files in such a bucket are kept by that service's provider.
Files are private by default: they are opened by the file's owner, the bucket's owner and people given access to the folder, and a file marked public by every signed-in member — never by anyone who is not signed in. A file is public when it was uploaded through an upload point that the platform team has set to make files public, when the platform team marks it so, or after you decrypt it on the website; encrypting a file makes it private again. Files in a bucket kept by clearances are opened only by people holding one of that bucket's clearances — without one, not even their owner can open them. Superusers can open every file.
The platform does not encrypt files unless you protect a file with a password. Encrypting a file, and removing its encryption, that you ask for on the website is always done by the server's background worker, never while the page waits for an answer: the password reaches the worker with the task, through the server's own queue, and is not stored — neither with the file nor in the task's record. For a file larger than 50 MB the task is a workflow run, which the platform team sees on the Workflows page — with who asked, the file's number, the times and the outcome, never the password — and which has no automatic deletion date; for a smaller file the task's state (who asked, which file, the outcome) is kept in the server's cache for an hour. When you download an encrypted file by giving its password, the server decrypts it for that download only. In the audit trail (section 8) we record, with the account, IP address and browser, operations on files in Storage (such as uploading, moving, renaming, deleting, restoring and encrypting) and every download of a file — a refused attempt too.
A deleted file goes to the Trash for 30 days (before that you can restore it or delete it for good); after that the nightly housekeeping deletes it for good, with its versions. The platform does not check the content of the files you upload or save: it keeps them as they are and hands them back as downloads, never as a page of its own.
Markdown pages (.md files): they are ordinary files in Storage, kept in buckets, and the rules for files above apply to them — who may open them, their versions, bucket clearances, the Trash and the audit trail.
Community news (title, text, topics, author) is written by the platform team and authorised members (such as those who lead the community). Pictures attached to it are stored under a random name, without their metadata (such as the GPS position); anyone who knows their address can fetch them without signing in, browsers and intermediate caches may keep them for up to 7 days, and on our server they stay even after the news item is deleted.
Usage limits: the platform team can limit how much each member uploads in a period (the number and size of files) and how much is downloaded. Whether or not a limit is set, we keep usage records — the kind of action, the quantity, the time, the account and what it concerned (such as a file's identifier); a download counts against the file's owner. Nothing on the platform costs money, so we process no payment data.
Mana: uploading a file and running a workflow spend mana, a number on your account. There is one kind of it. It refills every hour — from the aura of a community you belong to (the fastest, where there are several) and from each sigil a superuser has assigned to you — up to the aura's cap, and a superuser may grant you more; it is not bought and has no value in money. We keep your mana balance, every change to it (the time, the amount, the balance after it and its kind: regeneration, the first balance, a spend, a refund or a grant; what a spend was for, such as a file's identifier; for a grant, the reason given and who granted it), and, for each sigil you hold or held, when it was assigned to you and when it was revoked, and by whom.
Plans: which pages you may open follows the plan you hold (Free, Team or, for superusers, Superuser). Your communities set the ceiling: when you first join one that offers a higher plan you are put on it, you may then choose any plan your communities offer on the plans page, and leaving a community whose plan you hold puts you on the best of what is left; plans cost nothing. We keep your subscription (the plan, its state, the dates it started and changed, and the reason it lapsed, if it did) and a row for each month it was held (always settled with zero units, since nothing is charged); the plans page shows which community your plan comes through.
History of files and buckets: for every file we keep a history of who created it, who edited it (its content changed), who opened it and who downloaded it, and when; opening or downloading the same file again within ten minutes is one entry. The history of a file is read by whoever may read the file, so other members who may read a file of yours, or a file you opened or downloaded, see that you did, with your username. For every bucket we keep, besides, that a file in it was renamed, moved, encrypted or decrypted, made public or private, moved to the Trash, restored or deleted, and that the bucket was made or changed, that files were copied out of it or into it, or that its clearances changed; a bucket's history is read by its owner and by superusers. Each entry holds the time and the account that did it, never the IP address or the browser. The history has no automatic deletion date and goes with its bucket; your name is removed from it with your account.
Events: we keep the title, description, time, category, owner, organisers, place and capacity, and for invitations to events the invited person, their answer, a note and the time of the answer. Events are public by default and every signed-in member sees them; private ones are seen by the owner, the organisers and the invitees. Availability periods (such as busy or out of office), with a reason, are entered by the platform team; when an event is being planned, its owner and organisers can see the periods of the people invited to it at the event's time — their kind and time, and the reason only once the person has accepted the invitation — and every other member sees only their own.
Locations (on the Team plan): members add addresses and routes with notes to a shared map; the platform team adds territories, zones and map layers, and can group map items into map domains. Every member with access to Locations sees them, unless they belong to a map domain kept by clearances. An event can be tied to one of the addresses as its place, and a community to one as its seat: whoever has the map and may see that address sees it on the event's page, and on a map on the community's page.
Searching for a place and finding the address of a point on the map (including in the "Where you live" section) is done by our server: it sends the text typed, or the point's coordinates, to the Nominatim service (nominatim.openstreetmap.org) For a route search our server sends the coordinates of its start and end to routing.openstreetmap.de. The request identifies only our platform — we do not send your IP address or account data. The answer to a place search or an address look-up is kept in the server's cache for 24 hours under a hash of the query; usage records note only the kind of look-up — never the text or the coordinates. A route search is not kept in the cache.
Map tiles are fetched by your browser directly from the tile.openstreetmap.org servers, which receive your IP address, your browser's details, our site's address (without the page's path) and which part of the map you are viewing. Maps are drawn only for signed-in members whose plan includes the map (the Team plan; administrators have it too). The tile.openstreetmap.org and nominatim.openstreetmap.org services are run by the OpenStreetMap Foundation (United Kingdom), and routing.openstreetmap.de by FOSSGIS e.V. (Germany); they process this data as separate controllers, under the rules set out in their own privacy policies.
Events (with the place typed for them), invitations to events, availability periods, addresses, routes, news, usage records and mana records have no automatic deletion date; usage records and mana records are deleted with your account (section 13). Your data that other members put on the platform (for example a mention in a file or in community news, or an invitation to an event) comes from them; we keep it for as long as the content that holds it.
Legal basis: Article 6(1)(b) GDPR — providing the features you use; the audit trail records — Article 6(1)(f) GDPR (our interest: accountability and the integrity of the records); the usage limits and records, and mana with its records — Article 6(1)(f) GDPR (our interest: sharing the server's capacity fairly among members); your data in other members' content — Article 6(1)(f) GDPR (our interest: enabling members to communicate and work together); your browser fetching map tiles from the OpenStreetMap servers — Article 6(1)(f) GDPR (our interest: showing maps without running our own map server).
8. Security of accounts and of the platform
Every sign-in creates a session record: IP address, browser (User-Agent), kind of session, the time of sign-in and of last activity. You see the list of sessions on your profile, in the "Security" tab, in the "Sessions" section, where you can end a chosen session or choose "Sign out everywhere else". Changing your password or e-mail address ends your other sessions, and a password reset ends all of them. A session expires 2 weeks after it last changed (for example at sign-in) or at sign-out; its record is deleted then, when the session is ended, or in the nightly housekeeping.
To recognise a sign-in from a new device, we keep cryptographic hashes of the "browser and IP address" pairs you sign in from (one unused for 90 days is deleted at your next sign-in, and all of them with the account); a sign-in from a pair not seen for 90 days sends you a "new sign-in" e-mail with the time, IP address and browser — except for an account's very first sign-in.
On your profile, in the "Security" tab, in the "Recent sign-ins" section, you see for 30 days your sign-in events with IP addresses and browsers, including failed attempts at your account — with your username or e-mail address, when the name typed points to your account alone (section 3) — with the IP address and browser of whoever typed it; when an action concerning your account was taken from another account (for example someone from the platform team), that person's IP address and browser are hidden.
The audit trail is a register of important actions on the platform: each record is sealed to the one before it (by a cryptographic hash), and the platform does not let records be changed or deleted. A record holds the time, the acting account and username, the kind of action, what it concerned and a description of the changes, and for actions taken through the site also the kind of request, the page address (without parameters), the IP address and the browser. Passwords, keys and tokens are replaced in the records by a marker (such as [REDACTED] or [token]) — except a password typed by mistake into the name field at sign-in (section 3).
We record in particular:
- sign-ins, sign-outs, failed sign-ins (with the name typed) and sign-in pauses;
- password and e-mail changes (with the addresses partly masked) and ended sessions;
- account creation and changes of rights;
- invitations issued, revoked and accepted, with the acceptance of this notice (section 4);
- profile changes (the names of the fields changed), and changes of community membership and clearances;
- requests for a copy of data and for erasure, and erasures;
- operations on files in Storage, downloads included (section 7).
The audit trail is viewed by the platform team (section 11); you see your sign-in events of the last 30 days, and the other records about you in the copy of your data (section 14). How long: for as long as the platform operates — records are not deleted when an account is erased (they stay under the username) nor when an invitation is deleted (they stay with the invitation's number, without the e-mail address).
After a server error the platform may e-mail a report to the people who maintain it: a description of the error, the page address, the signed-in username and the request's headers with the IP address and browser. Cookie values, form data and values that look like passwords or keys are masked in the report. Reports are deleted from the mailboxes once the error has been explained.
Legal basis: Article 6(1)(f) GDPR — our legitimate interest in the security of accounts and of the platform, detecting abuse and account take-over attempts, investigating incidents and errors, being able to show who did what and when, and establishing, exercising or defending legal claims.
9. E-mails
We send only messages about membership, your account and security — no newsletters or advertising:
- the invitation's link, to the address the invitation is made out to (valid for 72 hours, section 4);
- a link to set a new password (valid for 24 hours) after "Forgot password?" — the message also names your username;
- a "your password was changed" notice, when you change your password on your profile — with the time, the IP address it was changed from and the number of sessions ended;
- a "new sign-in" notice — with the time, IP address and browser (section 8);
- a link confirming a new e-mail address (to the new address, valid for 24 hours) and a notice of the change (to the previous address, with the new address partly masked and the IP address the change was made from).
Notices are written in your language, with times in your time zone; the message with an invitation's link is written in the platform's default language. A notice may wait in a queue on our server for up to about an hour; after that only the delivery outcome remains (status, attempts, kind of error, a hash of the address), without the content or the address. An unused request to change the e-mail address (the new and the previous address and a hash of the link) is kept until it is used, replaced by a new one, or its link is opened after it expired, or until the account is erased. [[FILL IN: how mail leaves the server — the outside e-mail (SMTP) provider, where it is established and has its servers, and that the connection is encrypted (TLS); until one is set up, the platform writes every message, links included, into its application log instead of sending it]]
Legal basis: Article 6(1)(b) GDPR — messages needed for running your account (password reset, change of address); Article 6(1)(f) GDPR — the message with an invitation's link (our interest: admitting new members at the invitation of the platform team), and notices of a password change, an address change and a new sign-in (our interest: protecting your account from take-over).
10. Backups
[[FILL IN: what is backed up — the database (with accounts, profiles, content and the audit trail), the files in Storage, the avatars — how often, where the copies are kept and for how long]]
Deleting data from the platform, account erasure included, does not reach copies already made — the data disappears from them when the copies expire.
Legal basis: Article 6(1)(f) GDPR — our legitimate interest in being able to restore data after a failure, an error or an attack (see also Article 32 GDPR).
11. What the platform team sees
The platform team has wider access than members:
- staff with the relevant permissions, and superusers — in the admin panel they view and change, among other things, account and profile data (including fields hidden from members), files, events, news and usage records, view the audit trail with IP addresses and browsers, and deactivate accounts — accounts are made only with an invitation (section 4) or at the server's console;
- staff who hold the Team plan, and superusers — issue and revoke invitations and see the list of those issued (each with its address, community and note, who issued it, its times and the account made with it), view the audit trail on the Audit page, see the usage limits and usage records, and can use automation tasks that read people's data, contact details included, and can send it to outside services (below);
- superusers — open every file, give clearances, grant mana, make, assign and revoke sigils, set each community's aura, and see every member's mana balance with its changes, every member's Trash and the erasure requests.
The automation tasks the platform team builds can read data on the platform and send it to outside services through their APIs — under Article 6(1)(f) GDPR (our interest: automating work); nothing is sent until the team builds such a task.
Changes made in the admin panel are recorded in its log: who changed which object (recorded under the object's name, such as a display name or username) and which fields, and when; these entries are kept — only the entries of someone from the platform team whose own account is erased disappear. Members' accounts are erased only by a command at the server's console (section 13). The platform team uses this wider access only for the purposes in sections 3–10 and to handle members' reports and requests, investigate breaches and security incidents, and moderate content — under Article 6(1)(f) GDPR (our interest: the security and good order of the platform, and establishing, exercising or defending legal claims).
12. Recipients, and transfers outside the European Economic Area (EEA)
Your data may be received by:
- other members of the platform — as described in sections 3, 4, 6 and 7;
- anyone who knows the address of your avatar or of a picture in news — also without signing in (sections 6 and 7);
- the platform team — section 11;
- [[FILL IN: the provider of the server the platform runs on, and where the server is]] — on whose server all data and logs are stored;
- the e-mail provider through which we send messages, once one is set up (section 9);
- [[FILL IN: who keeps the backups, or the sentence: Backups are kept on our own equipment.]] (section 10);
- the provider of an outside file storage service in which the platform team keeps a bucket — if there is one (section 7);
- the OpenStreetMap Foundation and FOSSGIS e.V. — for maps and search (section 7);
- outside services that an automation task of the platform team sends data to — if there is one (section 11).
The server, mail, backup and outside file storage providers process data on our behalf and on our instructions. We do not sell data and use no advertising or analytics tools; nor do we use artificial intelligence services, payment providers or outside text-recognition or virus-scanning services. Apart from maps, the platform's pages fetch nothing from outside servers — fonts, scripts, styles and pictures come from our server, and pictures from other websites that members put in their content are not loaded by your browser.
What goes to the OpenStreetMap Foundation in the United Kingdom (map tiles and place search, section 7) leaves the EEA — under the European Commission's decision finding that the United Kingdom ensures an adequate level of data protection (Article 45 GDPR). [[FILL IN: any other transfer of personal data outside the European Economic Area (EEA) and its legal basis, or the sentence: We transfer no other personal data outside the European Economic Area (EEA).]]
13. Erasing your account
You ask for your account's erasure on your profile, in the "Your data" tab: in the "Erase my account" section choose "Ask to erase my account" and file the request. Filing the request erases nothing yet: a person with access to the server's console carries it out, and until then the account works as before; if the request is declined, you see the reason — with the information that you may complain to the President of UODO (section 16) and go to court — in the same tab. We carry out the request without undue delay and within one month at the latest. Before filing the request you can download a copy of your data (section 14).
We erase:
- the account and profile, your community and clearance memberships, acceptances of this notice and sessions;
- your files with their versions (including copies made by "Download my data") and the avatar file;
- your usage records;
- the invitations to events made out to you, and your availability periods;
- your home on the map (the point — unless someone else lives there) and the addresses you added that nothing else uses;
- the notifications kept for you, and the ones kept for others about what you did;
- your mana balance, its changes and your sigil history (a sigil you held goes back to the superusers, who may assign it again);
- your subscription and its monthly rows;
- the invitations that are yours: the one your account was made with and any made out to your e-mail address;
- the key store and other data that exists only because of your account.
What remains, no longer linked to you:
- events added from your account, and community news you wrote;
- routes and map layers added from your account, and the addresses other content still uses;
- the history of files and buckets, without you as the one who acted;
- workflows you started, and buckets that were yours, with other people's files (your personal bucket renamed, without your username);
- invitations you issued, without you as their issuer (until they are deleted, section 4);
- mana you granted to others and sigils you made, assigned or revoked, without you as the one who did so;
- the record of creating your key store in the cryptographic operations log (time, IP address, browser).
Also remaining:
- the audit trail records under your username, with IP addresses and browsers (section 8);
- the admin panel's log entries (section 11);
- the record of your erasure request (with your username, dates and status) — without a set time limit;
- copies of your files that other members hold as their own files (for example downloaded and uploaded again);
- your files kept in a bucket at an outside file storage service, if there were any: their entries are erased here, and we delete the files at that service separately, by hand;
- backups — until they expire (section 10).
Legal basis for keeping these data: Article 6(1)(f) GDPR — the accountability and integrity of the audit trail and the cryptographic operations log, the continuity of other members' content, and establishing, exercising or defending legal claims; the record of the request — Article 6(1)(c) GDPR in connection with Articles 12 and 17 GDPR (section 14).
14. Your rights
You have the right of access to your data and to a copy of it (Article 15 GDPR), and to its rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and portability (Article 20), the right to object (Article 21, section 15) and the right to lodge a complaint with a supervisory authority (section 16).
How to use them:
- Copy of your data: on your profile, in the "Your data" tab, choose "Download my data". We prepare the copy in the background (you can ask for a new one once a day): a zip of CSV and JSON files (a format suitable for portability) with a README goes to your personal bucket; only the latest copy is kept — the previous one is deleted. If you cannot use the button, we will prepare the same copy at your request.
- Rectification: you correct most profile data yourself on your profile and in its "Account" tab (section 5); ask us for any other correction.
- Erasure: of your account — through the request in the "Your data" tab of your profile (section 13); of other data, such as an invitation made out to you when you have no account — write to us.
- Restriction of processing, objection and anything else: write to [[FILL IN: e-mail address for personal data matters]].
The copy of your data holds, among other things:
- your account and profile (with the avatar and the address you typed);
- your communities and clearances;
- events, invitations to events and availability periods;
- your home on the map with what you share of it, the addresses you added and the routes you saved;
- the history rows of what you did to files and buckets;
- your plan and its monthly rows;
- the notifications kept for you, and when you read each;
- your mana balance, every change to it, the sigils you hold and your sigil history;
- the invitations made out to your e-mail address or accepted by your account (without the hash of the link and without who issued them), and acceptances of this notice;
- sessions;
- audit trail records of your actions and of other people's actions concerning you (without those people's IP addresses and browsers);
- your files (encrypted files appear only in the index).
It holds no password hash, keys, tokens or encrypted content. For data it does not hold (such as usage records), ask us.
We answer without undue delay and within one month at the latest; for complex or numerous requests we may extend this by two further months — we will then tell you so within the first month, with the reasons. If we do not act on a request, within that time we will give you the reasons and tell you of your right to complain to the President of UODO and to go to court. Exercising your rights is free of charge. If we have reasonable doubts about your identity, we may ask for additional information.
We do not process your data on the basis of consent, so there is no consent to withdraw; you can switch off showing your e-mail address, phone and home address at any time. Data connected with handling your requests (the records of requests for a copy and for erasure, and our correspondence about them) is processed under Article 6(1)(c) GDPR in connection with Articles 12–22 GDPR. Records of requests for a copy are deleted with the account, the record of an erasure request is kept without a set time limit (section 13), and the correspondence for [[FILL IN: how long correspondence about requests is kept, e.g. 3 years after the matter is closed]].
15. Your right to object
You have the right to object at any time — on grounds relating to your particular situation — to the processing of your data based on our legitimate interest (Article 6(1)(f) GDPR). This applies in particular to logs, the audit trail and other security records, security notices, error reports, backups, the fetching of map tiles, the usage limits and records, the platform team's access (section 11), an invitation you have not accepted and the record of who issued an invitation, your data in other members' content, and data kept after an account is erased.
Once we receive an objection we will stop processing those data, unless we show compelling legitimate grounds that override your interests, rights and freedoms, or grounds for establishing, exercising or defending legal claims. Send your objection to [[FILL IN: e-mail address for personal data matters]]. We do not process your data for marketing.
16. Complaint to a supervisory authority
If you think we process your data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland, https://uodo.gov.pl) or with the supervisory authority of the European Union country where you live or work or where the infringement took place.
17. Do you have to give your data?
Choosing a username, a display name and a password on the invitation's page, and ticking the box, are voluntary, but without them we cannot make your account. An e-mail address is needed to reset a forgotten password and to receive notices; when the invitation names none you may leave it out, and we show it to other members only if you allow it. The avatar, "About you", phone, home address, time zone and language are optional — you can still use the platform without them. You create content as you choose, and your browser sends the IP address and browser details automatically — the site cannot be used without them.
18. Automated decisions and profiling
We make no decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, and we do not profile you. The platform team decides whom to invite, superusers give clearances, and a person erases members' accounts.
The platform does apply simple, predefined rules:
- pausing sign-in after failed attempts (section 3);
- an invitation's link expiring after 72 hours, its page asking you to wait after 20 tries in an hour (openings of a link that is not open, from one IP address; sendings of one invitation's form), and the invitation being deleted 30 days after the link expired (section 4);
- refusing an upload or a download once a usage limit is reached — the refusal names the limit, and no data is deleted (section 7);
- refusing an upload or a workflow run while your mana does not cover it — the refusal says how much is needed, how much you have and when regeneration will have made up the difference, and no data is deleted (section 7).
If you think one of these rules worked wrongly in your case, write to us — a person will look into it.
19. Cookies and browser storage
As required by Article 399 of the Electronic Communications Law, we tell you what information the platform stores on your device and reads from it. We use only what is necessary for the platform to work or to remember a setting you choose yourself; we use no analytics, advertising or tracking cookies, so we do not ask for consent.
Cookies:
- sessionid — keeps you signed in and holds the session (it contains only its identifier; the session's data stays on the server); set at sign-in (also when your account is made on an invitation's page) and, for someone not signed in, when the platform must remember a pause after a failed sign-in or a password-reset link that was opened; valid for 2 weeks from the session's last change, or until sign-out; not readable by the page's scripts, sent only over HTTPS; necessary;
- csrftoken — protects forms against CSRF attacks (another site sending a form in your name); set on your first visit; valid for about a year; sent only over HTTPS; necessary;
- messages — carries a one-off message (such as "saved") to the next page; exists only while a message is waiting, at most until the browser is closed; necessary;
- django_language — remembers the language chosen in the page header, also by someone not signed in; until the browser is closed; a setting you chose.
Browser storage (localStorage unless stated otherwise; the data stays until you delete it, and is not sent to the server):
- darkMode — light or dark mode, stored when you click the switch in the header;
- vault_view_mode, clearances_view — the chosen view of the file list and the layout of the clearances page;
- in the admin panel (the platform team only) — the menu state, theme and list filters (filters until the tab is closed).
Apart from the items listed, we store nothing else in your browser. You can delete these data or block them in your browser's settings; without the sessionid and csrftoken cookies, however, you cannot sign in or send a form.
20. Special categories of data
We do not collect special categories of data (such as data about health, opinions, religion, ethnic origin, sexual orientation or trade union membership), and we do not analyse pictures to recognise people. Such data may still follow from what you write yourself (for example in "About you"), or from the nature of a community you belong to — and community membership is visible to all signed-in members. Think before you share such data.
21. Changes to this notice
Every change to this notice is published as a new, numbered version; earlier versions are never changed and stay available, each at its own address, ending in /socialhub/privacy/v1/, /socialhub/privacy/v2/ and so on. The number of the version you accepted on the invitation's page is recorded with your profile. If we intend to process data for a new purpose, we will tell you before we start.