# Privacy Policy **Effective Date:** September 17, 2026 **Last Updated:** September 17, 2026 Welcome to **Esencja** ("we", "our", or "us"). We provide an intellectual synthesis platform offering human-curated editorial summaries, structured concept knowledge graphs, and companion audio experiences via our web platform ([esencja.app](https://esencja.app)) and native mobile applications. We take your personal data privacy seriously and are committed to processing all personal data in strict compliance with the **Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation / GDPR / RODO)**, Directive 2002/58/EC (ePrivacy Directive), the Polish Personal Data Protection Act of 10 May 2018, and other applicable data protection laws. --- ## 1. Data Controller Identification The controller of your personal data is: * **Entity:** Esencja / Zordon Hub Operations * **Registered Address:** Warsaw, Poland (European Union) * **Designated Privacy & Data Protection Contact:** `privacy@esencja.app` * **Official Website:** `https://esencja.app` For any questions, data subject requests, or inquiries regarding this Privacy Policy, please contact our Privacy Representative at `privacy@esencja.app`. --- ## 2. Fundamental Data Protection Principles We process personal data adhering to the core tenets of Article 5 GDPR: 1. **Lawfulness, fairness, and transparency:** Data is processed only under valid legal bases with absolute clarity. 2. **Purpose limitation:** Collected solely for specified, explicit, and legitimate purposes. 3. **Data minimization:** Restricted strictly to what is adequate and necessary. We deliberately store reading state locally on your device rather than harvesting it on centralized tracking databases. 4. **Accuracy:** Kept up to date where relevant. 5. **Storage limitation:** Retained only for as long as necessary. 6. **Integrity and confidentiality:** Protected using robust technical and organizational measures (HTTPS TLS 1.3 encryption, edge isolation, zero untrusted third-party trackers). --- ## 3. Categories of Data Collected & Processing Methods We categorize data into three distinct streams: ### A. Technical & Server Log Data (Automatically Collected) When you navigate the Esencja web platform, our infrastructure (hosted via Vercel edge networks and Cloudflare CDN) automatically processes standard HTTP/HTTPS request headers: * Internet Protocol (IP) address (anonymized or truncated where feasible) * Date, time, and timezone of the request * Requested URL, file path, and HTTP status code * Browser type, rendering engine, and operating system version (User-Agent string) * Referrer URL (the previous webpage from which you navigated) ### B. Client-Side Functional Storage Data (Browser LocalStorage) To deliver an offline-resilient, lightning-fast user experience without requiring an obligatory user account for public reading, Esencja persists application state directly inside your browser’s `localStorage`: * **Reading Progress:** Percentage completed per book summary and finished status. * **Audio Playback Coordinates:** Current timestamp (in seconds) of streamed book chapters to enable seamless resume functionality. * **Reading Streak:** Local calculation of consecutive active days and an 84-tile 12-week focus grid. * **Playlists & Queue:** Saved reading lists and custom audio queue order. * **Visual & Language Preferences:** Dark/Light mode theme state and selected interface language (PL/EN). * **Privacy Consent Record:** Your explicit choices regarding cookie and storage preferences. *Note: This data is stored strictly in your browser client. It is not transmitted to our servers or correlated with your personal identity.* ### C. Inquiries and Direct Communications If you communicate with us via email (e.g., support requests, copyright inquiries, feedback), we collect: * Your email address, name, and any information provided in the correspondence. --- ## 4. Purposes and Legal Bases for Processing (Article 6 GDPR) | Processing Activity | Categories of Data | Legal Basis under GDPR | |---|---|---| | **Platform Delivery & Core Navigation** | Server logs, IP address, requested URIs | **Art. 6(1)(b) GDPR** — Performance of contract / steps to provide the requested digital service | | **Infrastructure Security & Fraud Prevention** | IP addresses, request rate, diagnostic logs | **Art. 6(1)(f) GDPR** — Legitimate interests in protecting network integrity and stopping DDoS attacks | | **Functional Reading Persistence** | Client-side `localStorage` (streaks, timestamps, bookmarks) | **Art. 6(1)(a) GDPR** & Art. 5(3) ePrivacy Directive — User consent & request for functional state | | **Performance & Infrastructure Optimization** | Anonymized aggregated telemetry (audio CDN latency) | **Art. 6(1)(a) GDPR** — Freely given consent (opt-in) | | **Legal Inquiries & Rights Defense** | Communication records, IP notices | **Art. 6(1)(c) GDPR** (compliance with statutory duties) & **Art. 6(1)(f) GDPR** (legal defense) | --- ## 5. Cookies and Terminal Equipment Storage In accordance with the ePrivacy Directive and Article 173 of the Polish Telecommunications Law: * We deploy **Strictly Necessary Storage** essential for core operations, security, and rendering. * We do **NOT** install cross-site advertising trackers, pixel beacons, or invasive third-party surveillance scripts. * Any optional functional or performance storage is subject to your prior, granular, freely given consent via our **Cookie & Storage Preferences Banner**. * You have the unconditional right to modify or withdraw consent at any time through our interactive **Cookie Settings** link in the platform footer. --- ## 6. Data Processors and International Transfers To ensure sub-second latency and high-availability audio delivery, we partner with specialized infrastructure sub-processors: 1. **Cloudflare, Inc. (USA / Global):** Content Delivery Network (CDN) and Cloudflare R2 object storage for streaming audio files. Transfers are governed by the EU-U.S. Data Privacy Framework and Standard Contractual Clauses (SCCs) pursuant to Article 46 GDPR. 2. **Vercel, Inc. (USA / Global):** Static site generation edge hosting and serverless infrastructure, bound by SCCs and enterprise Data Processing Agreements (DPAs). We do **not** sell, rent, lease, or monetize your personal data to data brokers or advertising exchanges. --- ## 7. Data Retention Schedule * **Server Logs:** Retained for a maximum of 30 days for cybersecurity and diagnostic analysis, after which they are permanently deleted or fully anonymized. * **Client LocalStorage:** Remains under your direct control in your browser until manually cleared by you, overwritten, or reset via the Cookie Settings modal. * **Correspondence:** Retained for the duration necessary to resolve your request, plus the applicable statutory limitation period for legal claims (up to 3 years under Polish civil law). --- ## 8. Your Data Subject Rights (Articles 15–22 GDPR) As an individual located in the European Economic Area (EEA) or protected under applicable privacy legislation, you possess the following enforceable rights: 1. **Right of Access (Art. 15 GDPR):** Request confirmation as to whether your personal data is being processed and obtain a copy of such data. 2. **Right to Rectification (Art. 16 GDPR):** Request correction of inaccurate or incomplete personal data. 3. **Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR):** Request permanent deletion of your data when it is no longer necessary or when legal grounds expire. 4. **Right to Restriction of Processing (Art. 18 GDPR):** Request temporary suspension of data processing under statutory conditions. 5. **Right to Data Portability (Art. 20 GDPR):** Receive your personal data in a structured, commonly used, and machine-readable format. 6. **Right to Object (Art. 21 GDPR):** Object at any time to processing grounded in legitimate interests (Art. 6(1)(f)). 7. **Right to Withdraw Consent (Art. 7(3) GDPR):** Withdraw your consent for functional or analytics storage at any time without affecting the lawfulness of processing based on consent before its withdrawal. To exercise any of these rights, email `privacy@esencja.app`. We verify identity and respond within **30 days** without charge. ### Right to Lodge a Complaint with a Supervisory Authority If you believe that our processing of your personal data infringes the GDPR, you have the statutory right to file a complaint with your local supervisory authority or our primary supervisory authority: * **Urząd Ochrony Danych Osobowych (UODO)** ul. Stawki 2, 00-193 Warsaw, Poland Phone: +48 22 531 03 00 Website: [https://uodo.gov.pl](https://uodo.gov.pl) --- ## 9. Automated Decision-Making and Profiling Esencja does not conduct automated individual decision-making, profiling, or behavioral targeting within the meaning of Article 22(1) and (4) of the GDPR. --- ## 10. Children’s Privacy The platform is designed for adult professionals, researchers, and self-directed learners. We do not knowingly solicit or collect personal data from individuals under 16 years of age. If we learn that personal data of a minor has been gathered without parental consent, we will take swift measures to delete it. --- ## 11. Updates to This Privacy Policy We may update this Privacy Policy from time to time to reflect technological improvements, legal changes, or service enhancements. The current version will always be available at `https://esencja.app/privacy` with the revised effective date clearly posted. **Contact:** `privacy@esencja.app`