Privacy

Privacy policy

Last updated: 24 July 2026

Effective date: 26 July 2026. This notice explains how Hustinct handles personal data across the public website, checkout, member area, course and Insider Club.

1. Controller and contact

The controller is suminnovations s. r. o., Ražná 1202/18, 040 01 Košice – Vyšné Opátske, Slovak Republic, Company ID 57 435 677. All privacy requests can be sent to info@hustinct.com. The brand name “Hustinct” is used throughout the rest of this notice.

2. Data we process

We process identifiers and contact details; account and authentication records; product, subscription and entitlement information; lesson progress; support communications; security and audit logs; checkout and refund references; recorded checkout consents; contact-form messages; and, with consent where required, device, analytics and advertising-attribution data. Stripe processes full payment-card details independently for payment security.

3. Purposes and legal bases

4. Recipients and processors

Core providers include Supabase (authentication, database and storage), Vercel (hosting and delivery), Stripe (payments and subscriptions) and Brevo (transactional and permitted marketing email delivery), ImprovMX (inbound email forwarding) and Google Gmail (customer correspondence). Analytics or advertising platforms receive data only after their identifiers are configured and the required consent is obtained. We may also disclose data to professional advisers and authorities where legally necessary.

5. International transfers

Some providers may process data outside the EEA. Where required, we rely on an adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism and appropriate supplementary safeguards.

6. Retention

Account and entitlement data is kept while the account or promised access remains active. Transaction and accounting records are generally retained for the statutory period, commonly up to 10 years in Slovakia. Support and security records are retained only as long as needed for the relevant purpose or legal claims. Contact messages are normally reviewed for deletion after 24 months. Checkout consent records may be retained with the associated transaction for the applicable limitation and record-keeping period. Consent-based analytics follows the configured platform retention period. Marketing contacts are kept until consent is withdrawn, continued inactivity justifies deletion, or another retention rule applies. Data is deleted or anonymised when no longer needed, unless law requires continued retention.

7. Your rights

Subject to applicable conditions, you may request access, correction, deletion, restriction, portability, or object to legitimate-interest processing. You may withdraw consent without affecting prior lawful processing. We normally respond to rights requests within one month, subject to the extensions and conditions permitted by law. You may complain to the Office for Personal Data Protection of the Slovak Republic or your local supervisory authority.

8. Required data and automated decisions

Checkout email and account data are required to conclude and perform the contract; without them we cannot supply access. We do not make decisions producing legal or similarly significant effects solely by automated processing. Security systems may automatically flag suspicious activity for review.

9. Security and children

We use encrypted transport, role-based access, row-level security, signed media URLs, audit controls and vetted providers. No system is absolutely secure. Hustinct is not directed to or available to anyone under 18.

10. Updates

We will update this notice when processing materially changes and notify affected users where required.

Questions? Contact Hustinct support.