Privacy
Version 1.1 · effective 18 September 2026.
Controller: SERO, UAB (company code 307592372), Uolės g. 14, Dovainonių k., LT-56341 Kaišiadorių r., Lithuania. Contact: info@sero.lt.
Stripe and its affiliate Sold through Link, LLC, which run checkout, decide for themselves how they handle payment data and are separate controllers for that; their own privacy notices apply there.
Personal data we process
| Data | Why | Legal basis | Kept |
|---|---|---|---|
| Your email address | It is your account, and where sign-in codes and course emails go | Performance of contract | Until your account is deleted |
| An opaque buyer code: a random reference, never your email | To refer to an account in support and when investigating shared lesson links | Legitimate interest in protecting the course | Until your account is deleted |
| Purchases: edition, Stripe payment identifier and order date, amount and currency, refund status, the immediate-access consent you gave (wording version, language, time), and the time of any online withdrawal request | To give or remove access, confirm the contract, apply the upgrade credit, and evidence your withdrawal choices | Performance of contract; legal obligation | Until your account is deleted |
| Purchase and refund events received from Stripe, including email address, product, order identifier and transaction status | To open or close access and resolve payment problems | Performance of contract | Event content removed by a daily job after 90 days, normally within about 24 hours of that point; the event identifier and status are kept so a repeated event is not processed twice |
| Sign-in codes (stored only as a hash) | To let you in | Performance of contract | Valid 10 minutes; expired records removed by a daily job, normally within about 24 hours after expiry |
| Sessions: a hash of the session token, times, network prefix (/24 or /48) and a hashed browser string | To keep you signed in, let you sign out everywhere, and secure the account | Performance of contract; legitimate interest in security | Removed by a daily job after 90 days, normally within about 24 hours of that point |
| Abuse and rate-limit counters keyed to a hash of your network address, email address or internal account identifier | To limit how many sign-in codes, consent signatures and video links can be requested | Legitimate interest in security | Deleted automatically within about two hours of last use |
| Which lessons you opened, and when | To show your progress and offer to continue where you left off | Performance of contract | Until your account is deleted |
| Playback records: lesson, time, network prefix and hashed browser string | To spot an account being shared at scale | Legitimate interest in protecting the course | Removed by a daily job after 90 days, normally within about 24 hours of that point |
| Email sending records: which message, when we submitted it, and whether our email provider accepted it | To make sure access and contract emails arrive, and not send them twice | Performance of contract | Until your account is deleted |
| Campaign link clicks: campaign, time, network prefix, hashed browser string and referring site. Not linked to an account | To measure which campaigns bring visitors | Legitimate interest | Removed by a daily job after 90 days |
| Administrative records: which staff member granted access or changed a campaign, when, and why | Accountability for changes to your access | Legitimate interest; legal obligation | Removed by a daily job after 365 days |
We do not store your full IP address and we do not fingerprint your device. Deletions above are carried out by scheduled jobs that run daily or more often.
Cookies and browser storage
The site stores your language preference in your browser's local storage and sets one session cookie after you sign in. They are used only to remember your language and to provide the signed-in service you asked for, so no consent banner is shown. There are no advertising pixels and no analytics that follow you. We send no newsletter unless you ask for one.
Who receives your data
We do not sell personal data or disclose it for advertising. We disclose it only to the recipients below, for the purposes stated.
| Recipient and role | For | Where, and transfer safeguard |
|---|---|---|
| Stripe (Stripe, LLC and its affiliates, including Sold through Link, LLC and Stripe Technology Europe, Limited): controllers for the processing they decide themselves, and processors when they carry your order and consent data on our instructions | Checkout, payment, tax, invoicing, payment support and refunds, and carrying your immediate-access consent record to us | United States and Ireland. You give your payment details to Stripe and Link directly, under their own privacy notices |
| Supabase Pte. Ltd.: processor | The database holding the data above | Stored in the European Union; Standard Contractual Clauses in Supabase's data processing addendum for any access from outside the EEA |
| Cloudflare, Inc.: processor | Hosting and serving the site and the lesson videos (the video files contain no personal data), security and rate limits | Global network; company in the United States, certified under the EU–US Data Privacy Framework, with Standard Contractual Clauses as fallback |
| Postmark (AC PM LLC): processor | Sign-in codes, access, contract-confirmation and withdrawal emails, support and operational emails. Not payment or VAT receipts, which Link (Stripe) sends | United States; certified under the EU–US Data Privacy Framework, with Standard Contractual Clauses as fallback |
Email info@sero.lt for a copy or description of these safeguards.
Where your data comes from
You give us your email address when you sign in. If you buy, Stripe sends us your email address, the product, order identifier, amount, currency and transaction status, so we can create and run your course account. We tell you this in the confirmation email as well.
Your rights
You may request access to your data, correction, erasure, restriction of processing and portability, and you may object to processing based on legitimate interests. We do not use automated decision-making that produces legal or similarly significant effects. Email info@sero.lt; we respond without undue delay and within one month. You may also complain to the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), vdai.lrv.lt, or the authority in your country.
Deleting your account removes your account, purchases record, entitlements, sessions, progress, playback records and email delivery records. Stripe keeps payment records for as long as tax law requires; that is a legal obligation, not a choice. Providing your email address is necessary to buy and use the course; without it we cannot give you access.