LuzakPolski

Luzak Privacy Policy

Effective date: 6 September 2026

1. Controller and contact

The controller of personal data processed in connection with the Luzak browser extension and Luzak website is Daniel Rogowski (the “Controller”).

For privacy matters, contact the Controller at support@luzak.top.

2. Scope of this Policy

This Policy explains how we process data connected with the Luzak website, user account, browser extension, and its features, including AI assistance with questions in Testportal and Moodle, user contexts, and credit accounting.

3. Data we may process

Depending on the features you use, we may process:

  • account and authentication data, such as a user identifier, email address, profile name, and information received when signing in through an identity provider;
  • technical data needed to operate the service, such as session identifiers, IP address, request information, and security logs;
  • content voluntarily sent to AI features: questions, answers, question or answer images, and files and contexts uploaded by you;
  • service-use information, in particular the selected available model, balance, and credit-accounting history needed to operate the account;
  • transaction data and payment identifiers provided by the payment processor. We do not intend to store full payment-card details.

Please do not submit special-category data or third-party personal data unless it is necessary and you have an appropriate legal basis to do so.

4. Data received from Google

If you choose to sign in with Google, we receive from Google only the data covered by the permissions you approve: your email address, profile name, and unique Google account identifier. We use this data only to create and secure your Luzak account, authenticate you on later visits, and contact you about your account where necessary.

We do not request access to Gmail, Google Drive, contacts, calendars, or other Google-service data. We do not sell data received from Google, use it for advertising, or disclose it to other parties except the providers listed in section 6 that help us provide the service.

5. Purposes and legal bases

We process data where necessary to:

  • enter into and perform the agreement relating to your account and Luzak features (Article 6(1)(b) GDPR);
  • comply with legal obligations, including accounting and tax obligations where applicable (Article 6(1)(c) GDPR);
  • prevent abuse, maintain security, establish, exercise, or defend claims, and maintain the service, which are our legitimate interests (Article 6(1)(f) GDPR);
  • handle an enquiry sent to our contact address, based on our legitimate interest in responding to it (Article 6(1)(f) GDPR).

If we request consent in a particular situation, processing is based on that consent (Article 6(1)(a) GDPR). You may withdraw consent for the future.

6. Recipients and transfers

We disclose data only as needed to operate the relevant feature to the following categories of providers:

  • Amazon Web Services (AWS) - hosts the API, account data, context files, and technical logs, and provides sign-in through Amazon Cognito;
  • Google - only when you sign in with Google, to confirm your identity;
  • OpenAI - receives question and answer content, images, and any context or files actively used, but only when you ask for an AI response;
  • Stripe - receives data necessary to process a credit purchase. Card details are entered directly with Stripe and are not stored by Luzak.

Providers act as recipients or processors to the extent necessary to provide their services. Data may be transferred outside the European Economic Area where a selected provider operates outside the EEA. In that case, we will use transfer mechanisms required by law, including appropriate safeguards.

We do not sell personal data.

7. Retention

We retain account and accounting data for the time you use the service and afterwards for the period needed for accounting, claims protection, and legal obligations. We retain text context until you replace or delete it. We delete context files when you delete them or no later than 14 days after upload. We use question or answer content sent to AI to handle that request and do not store it as a conversation history in Luzak, subject to technical backups and legal obligations. We retain correspondence data for the period needed to handle the matter and protect against claims.

8. Your rights

Subject to the conditions in the GDPR, you have the right to access, rectify, erase, restrict processing of, and port your data, and to object to processing based on legitimate interests. You may also withdraw consent where processing is based on consent. To exercise your rights, email support@luzak.top.

You have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), or another competent supervisory authority.

9. Automated decisions

We do not make decisions about users that produce legal effects or similarly significant effects solely by automated means.

10. Security

We use reasonable technical and organisational measures intended to reduce the risk of unauthorised access, loss, or misuse of data. No transmission or storage method can guarantee complete security.

11. Changes to this Policy

We may update this Policy when the service or legal requirements change. We will publish the current version on this page with its effective date.