Privacy notice

The controller is Dzmitry Zhur, operating Respubliko from Poland. There is no legal entity behind the service; it is a pilot funded by an Eastern Partnership Civil Society Fellowship.

No data protection officer has been appointed. We assessed this as not required at pilot scale — there is no large-scale systematic monitoring and no large-scale special-category processing. That assessment is a judgement rather than a formality, and it is being re-examined as part of the data protection impact assessment, because special-category data and vulnerable data subjects are both present here.

Your problem description, and any recording or document you upload — to classify the matter, identify the competent office and draft your letter. Legal basis: your consent, Art. 6(1)(a). The text may reveal health, ethnic origin, religion, political opinion or immigration circumstances, which are special categories under Art. 9; for those the basis is explicit consent, Art. 9(2)(a), which is why the consent line next to each button asks in those terms. Processing is refused without it, before anything is sent anywhere.

An account, if you create one — an identity key from our authentication provider (which holds your email), and whether you want reminders. Legal basis: Art. 6(1)(b), performing the account you asked for. The cases you track have their own basis, below.

Cases you choose to track — the kind of case, optionally a region, a reminder date you set. Legal basis: consent, Art. 6(1)(a). This can imply immigration status, so the same Art. 9(2)(a) basis applies.

Your IP address — as a rate-limit key, to stop one caller exhausting a grant-funded budget. From it, our hosting provider tells us the country you connect from, which picks the language of the page when your browser does not say. Legal basis: Art. 6(1)(f), our legitimate interest in keeping a free service available to the people it is for. It is never stored against a letter, a case type or a person. The limiter keeps only a keyed hash of it, made with a random value that is deleted, with the hash, every day.

Your problem description, letters, recordings, transcripts and uploaded documents are not kept at all. They exist in memory for the duration of one request and are discarded with the response. There is no database table that could hold them, and our build fails if one appears.

This is not a retention period; it is the absence of storage. The honest answer to an erasure request about your letter is that the data ceased to exist when the response was returned.

An account and any cases you track are kept until you delete them, which you can do yourself at any time. Aggregate counters — how many letters were generated, how many visits — contain no identifier and are kept indefinitely for reporting to the funder.

"We don't keep it" is not "nobody else sees it", and this is the part to read carefully.

Your text, recording or document is sent to Google (Gemini API) to be transcribed, classified and turned into a letter. Google is a US company and the endpoint is not region-pinned, so the text may be processed outside the European Economic Area.

Other processors handle infrastructure rather than your text: Convex (database and server functions, EU region), Vercel (hosting), Clerk (accounts, only if you create one), Resend (reminder emails, only if you opt in). All are US-incorporated even where the infrastructure sits in the EU.

PostHog (EU cloud) receives product analytics: a fixed list of fifteen events recording that a step happened — a letter was generated, a problem could not be classified — with a closed set of properties. It never receives your text, your letter, a case reference, a date, or your region, and no profile of you is created: there is no cookie or stored identifier, so two visits by the same person cannot be linked. What it does see, unavoidably, is that a request reached it from your connection.

Backups. Once a week a job on GitHub (Actions) copies the database and stores the copy with Cloudflare (R2). It holds accounts and tracked cases, never what you write or your letters, which we do not keep at all. Both are US companies.

Safeguard, stated honestly: the data processing agreements with these providers are not yet signed (they are tracked as an open task). Until they are, transfers rest on the providers' standard terms rather than on agreements we have executed. We think you should know that before you type something sensitive, which is why it is here rather than omitted.

We do not sell data, we do not advertise, and nothing you write is used to train models under the paid terms we operate on.

You have the right to access your data, to have it corrected, erased, or its processing restricted, to object to processing based on legitimate interest, and to portability — receiving what you gave us in a machine-readable form.

Where you have an account, all of these are buttons rather than a procedure. Export and deletion are one click each at the account page; deletion removes our record and the sign-in identity together. A right that requires composing an email and waiting is a right in name only.

Where you have no account, most of these rights have nothing to attach to, because we hold nothing about you.

You may withdraw consent at any time, and withdrawal does not affect processing already carried out — in practice, since we keep nothing, there is nothing left to withdraw it from. Simply not using the service withdraws it going forward.

We deliberately cannot show who consented. A consent log would be a record of who used this service, which is precisely the store this platform is designed not to create. What we can demonstrate is that processing is impossible without consent, because the endpoint refuses before the text goes anywhere.

If you think we have handled your data unlawfully, tell us — and you have the right to lodge a complaint with the Polish supervisory authority regardless of whether you do:

Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

You may also complain to the supervisory authority of the EU country where you live or work.

Nothing here is a statutory or contractual requirement. You are never obliged to give us anything. Describing your problem is necessary in order to produce a letter about it — that is a practical consequence, not an obligation — and you may leave out your name, address, case number and any medical or family details. Whatever you leave out, the letter leaves blank for you to complete.

No decision about you is made automatically, and there is no profiling. The system classifies a problem into a case type in order to choose a template and a set of legal provisions; it does not evaluate, score or make any decision affecting you. The output is a draft document that you read, edit and file yourself.