Privacy Policy

Last updated: 13 October 2026.

This notice explains how ByteGrad handles personal data when you browse bytegrad.com, purchase or use our courses, or contact us. It provides information; visiting our website or reading this notice does not give consent to marketing or optional tracking.

Who is responsible for your data

ByteGrad Sp. z o.o., Świętego Filipa 23/3, 31-150 Kraków, Poland (NIP PL6762676561; REGON 529579105) is the controller of the personal data we process to run our website and deliver courses. Contact us at support@bytegrad.com or at the postal address above.

What we use data for

Accounts and course access. We use your email address, a password hash, purchased-course information and learning progress to create and secure your account, provide your courses and remember where you stopped watching. This processing is necessary to perform our contract with you (Article 6(1)(b) GDPR). We do not need marketing consent to provide the course you purchased.

Purchases, refunds and administration. We receive order references, product details and customer contact information from our payment provider to deliver purchases and handle support. Contract performance (Article 6(1)(b)), applicable accounting and tax obligations (Article 6(1)(c)), and our legitimate interests in preventing fraud and establishing or defending legal claims (Article 6(1)(f)) apply to the relevant activities. We do not receive or store your full card number.

Support and service emails. We process the information you provide in messages, together with relevant account and technical information, to answer questions and resolve problems. Contract performance applies to support for your course; our legitimate interest in responding to enquiries applies to other support. Necessary course, account-security and purchase messages are separate from promotional emails.

Website delivery and security. Hosting and content-delivery systems process technical information such as IP address, request time, browser information and requested resources to deliver and protect the service. Our legitimate interests are reliable operation, fraud prevention, troubleshooting and account security (Article 6(1)(f)). To display regional offers, we use country information from our delivery infrastructure or send an IP address to ipapi.is for a country lookup. We use the country result and do not store the provider’s detailed location response in our visitor database. We do not build advertising profiles from sales-page visits.

Newsletters and promotions. Where you choose to subscribe or otherwise give the required permission, we use your email address to send the communications you requested, on the basis of consent (Article 6(1)(a)). You can withdraw consent using the unsubscribe link or by contacting support. Withdrawal does not affect earlier lawful processing or your access to purchased courses. A purchase alone is not a marketing subscription.

Cookies, browser storage and external services

Cookies and similar browser storage support specific functions described below. We do not use advertising pixels or optional advertising analytics in the website code. Authentication, requested chat and payment-security functions are distinguished from optional tracking. You can manage stored data in your browser; blocking necessary storage may prevent the related function from working.

Your account. A first-party session cookie keeps you logged in. It is set when an authenticated session is established, is inaccessible to page JavaScript, and lasts up to 30 days. Logout clears the login cookie. Password changes invalidate older authenticated sessions. This storage is necessary for the account service you request.

Chat with Crisp. Crisp IM SAS provides the chat function. Our website loads its chat software only when you select “Chat with us”. Opening chat sends technical information to Crisp and allows it to store necessary crisp-client/… session cookies so your conversation works across pages. We configure the conversation session cookie to expire after 30 days, renewed when the chat loads again; Crisp also uses a shorter socket cookie (observed at two days) and browser storage for chat continuity. Messages and related technical records are retained separately from the cookie. See Crisp's cookie explanation and privacy notice. You may email us instead of using chat.

Video previews with Wistia. Wistia software loads on pages with a video preview when you press its play button. We configure the player with viewer tracking disabled and Privacy Mode enabled. Wistia receives technical information needed to deliver the video and may process anonymised viewing statistics and functional storage. Purchased-course videos use our video delivery providers. See Wistia's player privacy explanation.

Checkout with Paddle. The checkout software loads when you choose to buy a course. Paddle acts as merchant of record and an independent controller for its checkout, billing, tax and payment-security processing. Its checkout and payment partners may use cookies and browser storage to operate and secure payments. Their behaviour depends on your payment method, country and browser. See Paddle's privacy notice. A legacy Stripe payment return can also load Stripe to verify that payment; see Stripe's privacy notice and cookie information.

Other resources. Fonts, images and course media are delivered through providers including Google Fonts, Cloudinary and Bunny.net. Requests to these providers disclose the technical information necessary to retrieve the resource. An external resource request is not necessarily a cookie or advertising tracker.

Who receives information

We use providers for hosting and data storage, content delivery, transactional email, support and payments. These include Heroku/Salesforce and our database hosting provider, Cloudinary and Bunny.net for resources, Resend for account and course emails, Crisp for requested chat, Wistia for previews, and Paddle and relevant payment partners for checkout. Kit (formerly ConvertKit) processes subscriber data when you sign up through our newsletter site, email.bytegrad.com. Its hosted landing page also uses built-in visitor counting and browser storage, including a persistent visitor identifier; optional third-party advertising and analytics integrations are not enabled there. See Kit’s privacy notice. Providers receive the data necessary for their function. Some act on our behalf; payment providers also process data for their own legal, payment-security and regulatory responsibilities.

We may disclose relevant information to professional advisers and competent authorities when necessary to meet legal duties or establish, exercise or defend legal claims. We do not sell account data or upload customer email lists to advertising platforms.

International processing

Some providers operate internationally and may process data outside the European Economic Area. The transfer arrangements depend on the provider, destination and service, including applicable adequacy decisions or other safeguards such as standard contractual clauses where required. Contact us for information about the arrangements relevant to your data and how to obtain a copy of applicable safeguards.

How long information is kept

Account and course-progress information is retained while needed to provide your purchased access. When you close your account or request erasure, we assess which information can be removed and which limited records must remain for legal obligations, fraud prevention or legal claims. Purchase, refund and accounting records are retained for the periods required by applicable tax and accounting law, counted from the relevant statutory starting date. Records needed for a dispute may remain until the matter and the applicable claims period have ended.

Support correspondence is retained while needed to resolve the enquiry, manage follow-up and evidence the resolution or relevant claims. Security and operational records are retained for the troubleshooting or security purpose concerned, with relevant records preserved where needed to investigate an incident. Subscriber data is used until you unsubscribe or the subscription ends; limited suppression and consent records may remain to respect your choice and demonstrate compliance. Cookie expiry does not itself delete messages, billing records or other server-side data.

Your choices and rights

Depending on the processing and applicable conditions, you may request access, correction, erasure, restriction or portability of your data, and object to processing based on legitimate interests. You can object to direct marketing at any time. Where processing relies on consent, you may withdraw it at any time without affecting prior lawful processing.

Contact support@bytegrad.com to exercise your rights. We may request proportionate information to verify identity and protect your account. We normally respond within one month; the GDPR permits an extension in certain cases, which we will explain. Erasure and other rights are subject to legal conditions, including necessary retention for legal obligations or claims. You may complain to Poland's President of the Personal Data Protection Office (UODO) or another competent supervisory authority.

Providing information

An email address and login credentials are needed to provide an account and course access. Without the necessary purchase or account information, we may be unable to deliver or support the service. Subscribing to marketing and using chat are optional. We do not make decisions producing legal or similarly significant effects about you solely through automated processing.

Security and changes

We use technical and organisational measures to protect personal data, including password hashing, access controls and secure connections. No online service can guarantee absolute security. We may revise this notice to reflect changes in the service or legal requirements and will make the current version available here. Where a change requires consent, updating this notice does not replace obtaining it.