Privacy Policy

1. Who is responsible for your data

The controller of your personal data is Tomáš Urban (“we”). For anything related to your personal data, write to info@neospace.pro.

2. What we collect

Depending on how you use the site, we process:

• Account data — your e-mail address, a password (stored only as a secure hash, never in readable form), and optionally your name, date of birth, and profile photo.
• Preferences — interface language and theme, stored in your browser and on your account, and your time zone, which we detect from your browser (or you can pick it in your profile) so that scheduled e-mails, such as a birthday wish, arrive in your morning.
• Purchase records — if you buy something, payment is handled by Stripe; we never see or store your card number. We keep a record of what you purchased and its status.
• Security records — IP address and browser identification in sign-in protection and administrative audit logs.
• Notifications addressed to your account inside the app.
• Email interaction: whether a message we sent you was opened and which links in it you followed. We record this with an invisible image and by routing links through our own address. You can ask us to stop at any time, and we do not use it for advertising or profiling.

3. Why we process it

Each purpose has its legal basis under the GDPR; how long we keep the data for each purpose is listed in section 6.

• Providing the service you signed up for — accounts, sign-in, purchased content. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Keeping accounts and content secure and preventing abuse — sign-in protection and the administrative audit log. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
• Meeting legal obligations, such as accounting records for purchases. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
• Sending you email news and updates — only while your news preference is switched on. Legal basis: our legitimate interest in direct marketing to registered users (Art. 6(1)(f) GDPR, recital 47); you can switch it off at any time.
• Anything we explicitly ask your consent for. Legal basis: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

4. Cookies

We use only cookies and browser storage that the service needs to work, or that keep a choice you made yourself:

We use no advertising cookies and no third-party analytics. Because everything listed below is strictly necessary (technical) or stores your own preference, no cookie consent banner is required — that is why you don't see one.

• auth_access — signs you in; httpOnly (inaccessible to scripts on the page), technical, expires after 15 minutes.
• auth_refresh — keeps you signed in between visits; httpOnly, technical, expires after 30 days.
• to-locale and NEXT_LOCALE — remember the language you chose; technical preference, kept for 1 year.
• localStorage to-theme-color, to-theme-mode, to-left-menu-type and to-content-type — interface preferences (theme and layout), stored in your browser until you clear them.

5. Who we share data with

We never sell or rent your personal data. It is shared only with providers we need to run the service:

• Our hosting provider (server operations).
• Stripe (payment processing) — see stripe.com/privacy.
• A transactional e-mail provider (verification and account e-mails only).
• Some of these providers may process data outside the EU (typically in the USA). Such transfers are covered by the European Commission's standard contractual clauses or an adequacy decision (such as the EU–US Data Privacy Framework).

6. How long we keep it

How long we keep data depends on its purpose:

• Account data — for as long as your account exists; ask us to delete the account and it goes with it (except records we must keep by law, such as purchase and tax records).
• Sign-in protection records — expire automatically within days.
• Administrative audit log — kept long-term so that security-relevant actions remain traceable.
• Encrypted backups — rotate out after 30 days.
• Sent emails and their open and click records: 12 months, then deleted automatically.

7. Your rights

Under the GDPR you can at any time:

• Ask what data we hold about you and get a copy (access, portability).
• Have incorrect data fixed (rectification).
• Have your data deleted or its processing restricted.
• Object to processing based on legitimate interest. For news emails the objection is unconditional: use the unsubscribe link in any of them or the switch in your profile, and no further news will be sent.
• Withdraw any consent you have given, at any time, with effect for the future.
• Complain to a supervisory authority — in the Czech Republic the Office for Personal Data Protection (uoou.gov.cz), or the authority in your country.

8. How we protect it

All traffic is encrypted (TLS). Passwords are stored only as strong hashes. Administrative actions are recorded in an audit log, and access to production data is restricted.

9. Changes to this policy

If this policy changes, the new version will be published here with an updated date. Substantial changes will be announced to registered users.