Privacy Policy

Istvan Izsak, trading as The Unscripted Stack, Romania. Contact for anything privacy-related: [email protected].

Legal basis: GDPR art. 4(7) and 13(1)(a).

• Account data: your name, email address and a securely hashed password (we never see or store your password in plain text).
• Purchase data: the plan you bought (Self-Paced or Cohort), the amount paid, the date, the Stripe payment reference and the time you accepted the Terms and the refund waiver. Card details are handled by Stripe and never reach our servers.
• Learning data: which lessons you have completed.
• Technical data: server logs (IP address, browser type, timestamps) kept for security and troubleshooting.
• Q&A subscription and call requests: the plan, renewal date, call length, your preferred time slot and the topic you describe.

We only collect what is needed for these purposes (data minimisation).

Legal basis: GDPR art. 5(1)(c) (data minimisation) and art. 13(1)(c).

• To provide the course you signed up for (account, access, progress, live Q&A for Cohort students) — performance of a contract, Art. 6(1)(b) GDPR.
• To keep payment and invoicing records — legal obligation, Art. 6(1)(c) GDPR.
• To keep the platform secure and prevent abuse (logs, protecting paid videos from sharing) — legitimate interest, Art. 6(1)(f) GDPR.

We do not sell your data, we do not use advertising trackers, and we do not use analytics cookies.

Legal basis: GDPR art. 6(1)(b), 6(1)(c), 6(1)(f); record-keeping obligations under Romanian Accounting Law 82/1991 and the Fiscal Code (Law 227/2015).

• Abacus.AI — application hosting and database.
• Amazon Web Services (AWS) — private storage of course videos and downloadable files.
• Stripe — payment processing. Stripe is an independent controller for the card data you give it.

Some of these providers are based in the United States. Transfers are protected by the EU-US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.

Legal basis: Processors bound by contract — GDPR art. 28; international transfers — GDPR art. 45–46 (Commission Implementing Decision (EU) 2023/1795 on the EU-US Data Privacy Framework; Decision (EU) 2021/914 on Standard Contractual Clauses).

We only use strictly necessary cookies to keep you signed in and to protect forms against forgery. These are required for the service to work, so no consent banner is needed. There are no analytics, advertising or social-media cookies. Fonts are hosted on our own server, so your browser does not contact Google or any other font provider.

Legal basis: Directive 2002/58/EC (ePrivacy) art. 5(3); Romanian Law 506/2004 art. 4(6) — strictly necessary cookies are exempt from consent.

• Account and learning data: until you delete your account.
• Payment and invoicing records: 10 years, as required by Romanian accounting law (these may be kept after account deletion, limited to what the law requires).
• Server logs: up to 90 days.

Legal basis: Storage limitation — GDPR art. 5(1)(e); 10-year retention of accounting documents — Romanian Law 82/1991 art. 25.

You have the right to access, rectify, erase, restrict or object to the processing of your data, and the right to data portability. Two of these are self-service in your dashboard under Your data:

• Download my data — a machine-readable JSON copy of everything linked to your account.
• Delete my account — permanently removes your account, enrollment and progress. Deleting your account does not trigger a refund.

For any other request, email us. We answer within one month.

Legal basis: GDPR art. 12(3) and 15–21.

You can complain to the Romanian supervisory authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), www.dataprotection.ro, or to the authority in your own EU country.

Legal basis: GDPR art. 77; Romanian Law 102/2005 on ANSPDCP.