Privacy and cookies

Effective 11 October 2026. · 2026-10-15.1

Certificates and verification

After you save your full name during account registration and complete the plan, we issue a certificate and email its PDF. A random link and QR code allow verification of the name, programme, date, ID and document status. The registry has no public people search and is not indexed. Certificate records are retained for verification until deletion is requested; erasing learning history also removes certificates and disables their verification.

Support tickets and internal learning reports

The help form stores ticket type, content, question or material reference, author, timestamps, status and support reply. You see your own tickets; an authorised platform operator handles them. Resolved tickets are removed 365 days after their last update. Unresolved tickets are kept until handling is complete; erasure requests are considered with applicable obligations and claims. Account export includes tickets; erasing learning history does not erase correspondence. Internal aggregate reports assess service use based on saved practice, exam and study-plan records. These records are not sent to Google or used for automated decisions about learners.

Controller and contact

The controller for annarobotycka.com is Mobberry sp. z o.o., ul. Józefa Piusa Dziekońskiego 1, 00-728 Warsaw, Poland, tax ID 5272674258, KRS 0000413131. Privacy and support contact: anna@annarobotycka.com. This notice covers visitors, learners with access and people contacting us.

Currently available features

The service provides information pages, demo exercises and learning for people granted access, including an AI trainer according to their access rights. Purchase availability is shown with each offer. Newsletter sign-up is available only for languages with completed confirmation settings. The payment test environment is separate from real purchases.

Data, purposes and legal bases

Infrastructure processes IP addresses, request times and browser data to deliver and secure the site — GDPR Article 6(1)(f), our legitimate interest in secure operation. During sign-in, we receive a user identifier, email address and, where available, display name from the authentication provider. We use these data to identify the learner and assign learning access. Learning track, settings, answers, results and conversations provide the requested learning service — Article 6(1)(b). General correspondence relies on Article 6(1)(f); pre-contract enquiries on Article 6(1)(b). Legal duties, including data-subject rights and tax records, rely on Article 6(1)(c). Minimum evidence needed to establish or defend claims relies on Article 6(1)(f).

Launch notifications and team enquiries

Mobberry handles requests for launch notifications and team-package enquiries. We store your email, programme, language, optional exam month and request confirmation; business enquiries also include company, tax ID, name, participant count and preferred payment. Launch notifications use your consent, withdrawable using the email link or by contacting us. Enquiry details are used to answer and prepare an offer at your request. Unconfirmed requests are deleted after 7 days and confirmed requests within 180 days of confirmation, or earlier on withdrawal. Brevo delivers confirmation messages and replies; request details are available only to operators. Launch notification requests do not subscribe you to the newsletter. An optional newsletter requires separate consent and confirmation. The form does not create an order, reserve a price or initiate payment.

Sign-up is optional and independent of purchases and learning access. Based on consent — GDPR Article 6(1)(a) — Mobberry sends Anna Robotycka’s marketing and AI materials and information about training and offers. Brevo receives the email address, selected language, brand identifier, consent version and sign-up request time. Submitting the form sends a confirmation link; only clicking it adds the address to the newsletter list. A welcome email follows confirmation. Withdraw consent at any time using the link in each newsletter or by emailing anna@annarobotycka.com. Withdrawal does not affect the lawfulness of earlier processing or learning access. An address stays on the active list until unsubscribe; thereafter newsletter delivery stops and only information necessary to respect unsubscribe and demonstrate consent and withdrawal is retained for the applicable claims period. To protect the form, the site stores counters based on HMAC hashes of email and IP, without their raw values, for up to one hour.

Payments and orders

At purchase, Stripe handles payment and collects payment and billing details, including address and, if provided, a company tax identifier. The site does not receive the full card number or CVC. We record order and payment identifiers, programme, period and amount, payment status, access dates, accepted terms version and time, and the immediate-access request. These data fulfil the contract — GDPR Article 6(1)(b) — and legally required documentation — Article 6(1)(c). Brevo receives the checkout email and the order confirmation including accepted terms. Buying does not automatically subscribe you to the newsletter. Billing records follow the statutory retention periods below.

Company account

Company accounts store the company name, programme, access period, email addresses, roles and seat status. Company administrators can see these details for their team, but cannot see individual answers, results or AI conversations. Invitations are bound to the specified email address. Removing a seat ends company access without erasing learning history. History deletion and full account closure are described in the self-service data section.

Email sign-in

We store an email address, account identifier and participant name entered once during registration. This name is also used on certificates; corrections are handled by support. Deleting learning history does not delete account registration details. A one-time link expires after 15 minutes; sessions and essential session/sign-out cookies expire after 30 days. The database stores token hashes, not raw tokens. Abuse-prevention counters use email and IP hashes and expire within an hour. Expired tokens, sessions and counters are removed during maintenance or later login requests. Account details remain until account closure is requested through support. Brevo delivers sign-in links. An existing signed-in session may be linked to its verified email to preserve access and history.

Voluntary provision and data scope

Providing data is voluntary, but an account identifier is necessary to save learning and a message is necessary to answer a trainer or support enquiry. Public demo exercises work without sign-in. Do not enter passwords, health data, confidential company information or other people’s data into conversations.

AI trainer and data sent to the model

The AI trainer currently uses OpenAI’s GPT-4.1 mini model through Vercel AI Gateway. To generate a response we send the message, necessary conversation history, selected learning settings and results, and material excerpts. We do not add the account email or name to the model prompt; information entered in a message may nevertheless be transmitted. Vercel selects the model operator from its providers supporting that model. Responses are saved in learning history. The trainer is an AI system that may make mistakes and serves educational purposes. It does not make decisions producing legal or similarly significant effects; exercise scores are not certification.

Recipients and infrastructure

Access is limited to authorised Mobberry personnel and providers to the extent required to deliver the service: OpenAI (hosting platform and user authentication), Cloudflare infrastructure (hosting and D1 storage), Vercel Inc. (AI Gateway), and AI model operators listed in Vercel’s documentation. Where the authentication provider processes data for its own purposes, its privacy notice linked below also applies. Correspondence is handled by the contact mailbox provider. Competent authorities may receive data where required by law; authorised accounting or legal advisers may receive the minimum necessary data for accounting or disputes. Brevo handles transactional emails and the newsletter as described above. Stripe handles payments and billing documents.

Processing outside the EEA

Provider infrastructure may process data outside the European Economic Area, including the United States. OpenAI and Vercel contractual documentation provides for European Commission Standard Contractual Clauses and, where applicable, adequacy decisions. We do not claim that all data stays in the EU. Safeguards and how to obtain copies are described in the provider documents linked below; you may also contact us. Provider technical and account data retention follows their separate purposes and documentation.

Retention within the service

Read-material markers and named plan confirmations follow the same rules as learning history and can be erased in the dashboard. AI allowance accounting is retained until 90 days after access expiry; erasing history does not reset the allowance. Learning settings, answers, results and exams are retained for the access period and up to 365 days after the later of the last granted access expiry or the record’s creation/update. Trainer messages use the same rule with a 30-day period, and technical model usage records with 90 days. Where no access has been granted, the period runs from recording. This enables returning to learning after a break. Automated maintenance removes expired records; you can erase history earlier in your dashboard. A two-minute write block after erasure prevents an in-flight AI response from restoring history.

Correspondence, backups and exceptions

Ordinary correspondence is retained for up to 12 months after closure. Data needed for a specific legal duty or dispute is limited to what is necessary and retained until the applicable statutory period or final resolution and settlement. Tax records follow statutory periods, generally five years from the end of the year in which tax was due, subject to suspension, interruption and separate KSeF rules. Erasure from the working database does not instantly erase every infrastructure backup: Cloudflare documents a D1 recovery window of up to 30 days. Backups support disaster recovery; completed erasure requests must be reapplied after restoration. Requests concerning other provider systems are handled as applicable.

Cookies and device storage

Essential mechanisms support sign-in, security and operation. ar_privacy_v1 in localStorage remembers separate analytics and ads measurement choices for 180 days. Essential only, analytics only, and analytics with ads measurement are separate options. Previous analytics choices do not enable ads measurement. Google Analytics and GTM-PDHS33MG load after analytics consent. With JavaScript disabled, the browser loads an invisible GTM fallback frame (noscript); consent controls require JavaScript. Withdraw consent using the footer cookie settings. Withdrawal stops the relevant measurement and removes this site's _ga/_ga_* or _gcl_* cookies. An ar_event_v1 entry expiring within 180 days limits repeat counting of a confirmed purchase and demo start, only after analytics consent. The essential HttpOnly __Host-anna_purchase_receipt cookie carries a payment confirmation within this service for one hour and is not sent to Google. Meta Pixel and ads personalisation remain disabled. Device storage can be erased in your browser.

Google Analytics 4 and Google ads measurement

With optional consent, GA4 (G-X9T2ZJW5M1) measures visits, scrolling, selected clicks, programme/access period, demo use and newsletter and launch/team form requests/confirmations. The HttpOnly __Host-anna_lead_receipt cookie lets the site verify email confirmation for 10 minutes; its token is not sent to Google. Form submission is separate from confirmation: Brevo membership is verified using an encrypted one-time identifier valid for seven days. After a verified real payment we may measure the product, net value, tax, currency and pseudonymous transaction identifier. Test purchases are excluded. Sign-in, dashboard, learning and raw Stripe return URLs are excluded; checkout stages use sanitised URLs. We do not send emails, billing details, selected answers, learning scores or trainer conversations to Google. URL parameters are omitted apart from limited campaign UTM labels and, only with separate ads measurement consent, Google gclid/gbraid/wbraid click IDs. Referrers are limited to their domain. Ads measurement consent allows Google campaign attribution after Analytics and Ads accounts are linked. Analytics-only consent leaves ad_storage and ad_user_data denied. Google Signals and ad_personalization are disabled in both options. Google also receives analytics identifiers and browser/device information; our code sets _ga/_ga_* cookies to 180 days without renewing on each view. Processing may take place outside the EEA under the provider documents below. Consent is not required for access or purchase.

Your rights and erasure

You may request access and copies, correction, erasure, restriction and portability where provided by GDPR. You may object to legitimate-interest processing and withdraw consent where it is the basis for processing. Email anna@annarobotycka.com. We respond without undue delay and within one month; where a lawful extension of up to two further months is needed, we explain it within the first month. Identity verification is proportionate; ID copies are not routinely required. You may complain to the Polish UODO (uodo.gov.pl) or your competent supervisory authority.

Self-service data controls

After signing in, the dashboard lets you download learning data as JSON and erase answers, progress, exams and conversations for all programmes. Active learning access is not required. This operation concerns learning history on annarobotycka.com. It does not delete accounting records or separate provider accounts and does not automatically cancel granted access. Request full access closure or actions involving other systems by email. Unsubscribing from the newsletter is independent of learning access.

Practice test and study emails

The free practice test does not require an account or email. Answers and the result are processed to grade the set and are not stored in a profile. If you separately request three study and programme emails, we record your email, language, selected track, consent wording and time, and address confirmation. After confirmation we send messages immediately, after 2 days and after 5 days. If sales were not open when you signed up, we may send one additional launch message. You can withdraw using the link in each message; withdrawal deletes the request and stops further delivery. Unconfirmed requests are deleted after 7 days, and confirmed requests within 180 days or earlier at your request. Brevo delivers these emails. This sequence is separate from the newsletter and does not subscribe you to it.

Provider documents

Open your data controls · Service terms