Privacy Policy

1. Data Controller

2. What data we collect

* Collected only after explicit consent.

3. Purposes and legal bases

• Performance of the HTG Session contract (including session recording as part of the service) — Art. 6(1)(b) GDPR
• Publication of sessions on HTG channels (HTG Recording Library, HTG YouTube channel, htgcyou.com, translations) — Art. 6(1)(b) GDPR + Art. 81(2)(2) of the Polish Copyright Act (remuneration for participation in the recording)
• Special category data disclosed during the session (health, beliefs, personal life) — Art. 9(2)(a) GDPR (explicit consent)
• Additional publication consents (Z2 — social media, Z3 — informational materials) — Art. 6(1)(a) GDPR (voluntary, withdrawable consent)
• Accounting obligations — Art. 6(1)(c) GDPR
• Protection of legal claims (legitimate interest) — Art. 6(1)(f) GDPR
• Marketing — Art. 6(1)(a) GDPR (only with consent)

4. Recipients of data

Your data may be shared with the following parties:

• Vercel — application hosting
• Cloudflare — DNS, CDN, DDoS protection
• Supabase — database and authentication
• Stripe — payment processing
• Bunny.net — recording storage and streaming
• LiveKit Cloud — video session transmission (WebRTC)
• Resend — transactional email delivery
• Translators cooperating with the HTG Team — limited to sessions in which they participate and recordings forwarded for translation
• Legal and accounting firms — legal and financial services

Some of our providers (Vercel, Cloudflare, Stripe, LiveKit, Resend) may process data outside the European Economic Area, based on standard contractual clauses of the European Commission and/or under the EU-US Data Privacy Framework certification.

5. Retention periods

You may at any time request earlier deletion of the original recording from your client panel by writing to htg@htg.cyou — we will honour the request within 30 days. Deleting a recording from the client panel does not affect recordings already published on HTG channels.

Upon account deletion, original recordings are erased, except for: (a) accounting data (up to 5 years), (b) data necessary for legal defence (until time-barred), (c) recordings and excerpts published under section 8 of the Terms — these remain in the HTG archive.

6. Your rights

Under the GDPR, you have the following rights:

You may withdraw consent to the processing of sensitive data and the additional publication consents (Z2 — social media, Z3 — informational materials) at any time in your client panel or by writing to htg@htg.cyou. Withdrawal does not affect the lawfulness of processing carried out beforehand and does not affect publication on HTG channels, which is part of the contract.

You have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO, Poland).

7. Cookies

We use technical cookies (authentication, language and theme preferences), analytical, and marketing cookies. A consent banner is shown on your first visit — you can adjust your preferences at any time.

Providing data is voluntary, but necessary to book an HTG Session. Data will not be used for automated decision-making or profiling.

8. Session monitoring

To keep your recordings safe and out of unauthorised hands, the system monitors:

• Number of active authentication sessions — limit of 3 devices per account
• Number of simultaneous playbacks — limit of 1 device per account