Privacy

If you email us or book a call, we obviously end up with whatever you put in that email or booking. If you pay or sign up for updates, the sections below say exactly what we keep. Nothing else about you is captured.

What the site stores is kept in a Neon Postgres database in Neon’s EU region in Frankfurt. The site itself runs on a server we rent in the EU. Neon and the server’s hosting provider act as processors on our instructions. Neon is a US provider, so your data may be transferred outside the EEA under its standard contractual clauses.

Access is limited to the people who run the house. We do not sell your data, we do not rent it, and we do not hand it to sponsors, partners, or anyone else for their own marketing.

If you become a member or a patron, the checkout is hosted by Stripe. Stripe collects your name, email, billing address, and card details; the card number never reaches us. Stripe is an independent controller for the payment itself, under its own privacy policy. What we receive from Stripe, and keep in the Neon Postgres database, is your name, email, Stripe customer and subscription ids, subscription status, and a record of each invoice paid (amount, currency, date). We use it to know who is a member, to let you in, and to keep the books.

The legal basis is performance of the membership contract, and for the payment records our legal obligation to keep accounting documents. Payment records are kept for five years after the end of the tax year in which the payment was made, as Polish tax law requires, even if you ask us to delete the rest.

If you sign up for updates on the homepage, we keep your name, your email, your phone number if you gave one, the wording of the box you ticked, and when you ticked it, in the Neon Postgres database. We use it only to email you about events and news from the space, and we never share the list. Emails are sent through Resend, which processes your email address on our instructions.

The legal basis is your consent. You can withdraw it at any time by replying to any of our emails or writing to [email protected], and we delete your entry.

You wrote to us. Under the GDPR, that’s our legitimate interest in answering an email or booking you sent us — nothing more. Writing to us does not put you on the updates list, and we won’t send you unrelated broadcasts.

There is no analytics on this site. No Google Analytics, no Plausible, no PostHog, no pixels, no advertising tags, and no cookie banner, because we don’t set cookies to track you. Fonts and event images are served from our own domain rather than fetched from someone else’s, so loading a page here doesn’t announce you to a third party. Links you click through to — the event calendar, the booking link, our social profiles — run under their own privacy policies, not ours.

Our hosting provider keeps standard server logs (IP address, page requested, timestamp) for operational and security reasons, the way every web server does.

Until you ask us to delete it, or until you withdraw your consent for the updates list. Payment records are the exception: they are kept as long as tax law requires (see Payments).

You can ask for a copy of what we hold on you, ask us to correct it, ask us to delete it, or object to us holding it at all. Email [email protected]from the address you used with us — or tell us which address to look for — and we'll handle it within 30 days. No form, no fee, no argument.

If we get it wrong, you can complain to your local data protection authority; in Poland that is the President of the Personal Data Protection Office (UODO). We’d rather you told us first.

Questions about any of this go to the same address as everything else: [email protected].