Privacy policy

Effective date: 25 September 2026. This notice explains how hustinct. handles personal data across the public website, checkout, member area, course and Insider Club.

1. Controller and contact

The controller is suminnovations s. r. o., Company ID 57 435 677 (full company details are in the Terms of service). All privacy requests can be sent to info@hustinct.com. The brand name “hustinct.” is used throughout the rest of this notice.

2. Data we process

We process identifiers and contact details; account and authentication records; product, subscription and entitlement information; lesson progress; support communications; security and audit logs; checkout and refund references; recorded checkout consents; contact-form and live-chat messages (name, email, messages and the page they were sent from); withdrawal statements submitted through the online withdrawal function; and, with consent where required, device, analytics and advertising-attribution data. Stripe processes full payment-card details independently for payment security.

3. Purposes and legal bases

• Contract: account creation, course delivery, subscriptions, support and billing administration.
• Legal obligation: accounting, tax, consumer-rights and authority requests.
• Legitimate interests: service security, fraud prevention, essential operational measurement and legal-claim defence, balanced against individual rights.
• Consent: optional analytics, advertising pixels and marketing communications where consent is required. Consent can be withdrawn at any time.

4. Recipients and processors

Core providers include Supabase (authentication, database and storage), Vercel (hosting and delivery), Stripe (payments and subscriptions), Brevo (transactional and permitted marketing email delivery), Cloudflare Turnstile (protection of forms and sign-in against bots), ImprovMX and our email hosting provider (customer correspondence) and GitHub (source code and encrypted database backups kept for 30 days). Only after you consent in the cookie banner, Google (Analytics 4 and Google Ads), Meta (Pixel and Conversions API), Microsoft Clarity and Vercel Analytics receive analytics and advertising data; for purchases made with marketing consent we may send Meta a hashed (SHA-256) email address to measure ad conversions. We may also disclose data to professional advisers and authorities where legally necessary.

5. International transfers

Some providers may process data outside the EEA. Where required, we rely on an adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism and appropriate supplementary safeguards.

6. Retention

Account and entitlement data is kept while the account or promised access remains active. Transaction and accounting records are generally retained for the statutory period, commonly up to 10 years in Slovakia. Support and security records are retained only as long as needed for the relevant purpose or legal claims. Contact and live-chat messages are normally reviewed for deletion after 24 months. Checkout consent records may be retained with the associated transaction for the applicable limitation and record-keeping period. Withdrawal statements are kept as evidence of the consumer-rights process for the applicable limitation period. Consent-based analytics follows the configured platform retention period. Marketing contacts are kept until consent is withdrawn, continued inactivity justifies deletion, or another retention rule applies. Data is deleted or anonymised when no longer needed, unless law requires continued retention.

7. Your rights

Subject to applicable conditions, you may request access, correction, deletion, restriction, portability, or object to legitimate-interest processing. You may withdraw consent without affecting prior lawful processing. We normally respond to rights requests within one month, subject to the extensions and conditions permitted by law. You may complain to the Office for Personal Data Protection of the Slovak Republic or your local supervisory authority.

8. Required data and automated decisions

Checkout email and account data are required to conclude and perform the contract; without them we cannot supply access. We do not make decisions producing legal or similarly significant effects solely by automated processing. Security systems may automatically flag suspicious activity for review.

9. Security and children

We use encrypted transport, role-based access, row-level security, signed media URLs, audit controls and vetted providers. No system is absolutely secure. hustinct. is not directed to or available to anyone under 18.

10. Updates

We will update this notice when processing materially changes and notify affected users where required.

Questions? Contact hustinct. support.