Privacy policy

Last updated: 2026-10-17

Cork Academy is a free study tool for people preparing for WSET wine exams. This policy explains what personal data we process when you use corkacademy.com, why, on what legal basis, who receives it, how long we keep it, and what your rights are. We try to collect as little as possible. This policy is available in English and Polish; if the versions differ, the Polish version prevails for consumers in Poland.

1. Who we are

The controller of your personal data is:

Łukasz Sowa Consulting
Planetarna 10, 05-825 Kozerki, Poland
REGON: 365999950 · NIP: PL5291771229

For anything privacy-related, write to contact@corkacademy.com. We have not appointed a data protection officer (we are not required to); privacy requests are handled by the owner.

2. What we process and why

Practising as a guest

You can practise without signing up. When you answer your first question, Google Firebase Authentication creates a guest identity for your browser, and our server creates a matching guest record with a random ID. We don't ask for your name or email. Linked to that guest ID we store:

• your answers: which day's set and certification level, which question or flashcard, what you chose or how you graded yourself, whether it was correct, and when;
• your streak, which isn't stored separately but worked out from the days you practised.

The guest ID is a pseudonym, not anonymous: it doesn't contain your name, but your answers, your sessions (see below) and, if you consent, session replays are linked to it. Google Analytics isn't given your guest ID.

The certification level you pick (WSET 1, 2 or 3) is remembered in your browser. The level of each set you practise is also part of your answers on our server.

To create the guest identity, your browser contacts Google's Firebase servers, which process your IP address and browser type for security and abuse prevention. This happens whether or not you accept analytics.

Why: to provide the practice you asked for: saving answers, showing explanations, keeping your streak. Legal basis: performance of the service agreement you enter into by using Cork Academy (Art. 6(1)(b) GDPR).

The guest identity lives in your browser. If you clear your browser's site data, you'll normally lose access to your past progress; the data on our server stays linked to the old guest ID; section 5 explains what happens when the guest record is deleted.

Sessions with our server

Each time your browser starts or renews a session with our server, we record the IP address and browser type (user agent) of the request, together with the session token.

Why: to keep sessions secure and spot misuse. Legal basis: our legitimate interest in securing the service (Art. 6(1)(f) GDPR).

Email signup

If you leave your email in the signup box, we use it only to send you the one email the form promises, when something big ships. The form posts directly to Formspree, which stores the submission for us in the United States. We won't add you to a newsletter; if we ever offer one, we'll ask you separately.

Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by writing to us, and we'll delete your address.

Analytics: only with your consent

If you accept, we use Google Analytics 4 to count visits and see which pages and features get used. It receives the pages you view, the actions you take in the app (such as answering a question, with the certification level, whether the answer was correct and your current streak), your browser and device type, and an approximate location derived from your IP address (Google Analytics 4 does not store the IP address itself). Advertising features are switched off. Google Analytics is not loaded unless you accept.

Legal basis: consent (Art. 6(1)(a) GDPR, and Art. 399 of the Polish Electronic Communications Law for storing and reading cookies on your device).

Performance and session replay: only with your consent

If you accept, we use OpenObserve, monitoring software we run ourselves on our server at DigitalOcean, to measure page performance and to record replays of sessions so we can find bugs. It collects page performance timings, the pages you visit, your clicks and other interactions, console errors, your browser and device type, and the IP address of the request. About half of consenting sessions are recorded as a replay, and each replay is tagged with your guest ID so we can look into a problem you report.

In replays, what you type into form fields is masked. Other content on the screen, such as the questions and the answers you pick, is recorded as it appears.

Legal basis: consent (Art. 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law).

Error reports

When something breaks in your browser, it sends a short error report to our server: the error message, a shortened technical stack trace, the page path, the app version, your browser type and the time. Error reports use no cookies or storage and carry no guest or session ID, and we don't use them to identify you or connect your visits. Our server sees the IP address of the request, as with any web request.

Legal basis: our legitimate interest in keeping the service working (Art. 6(1)(f) GDPR).

Server logs

Our servers log each request to our API: the time, address requested, response status, your browser type, the IP address, your guest ID, and the content of the request and response (such as the answers you submit), with sign-in tokens removed. Our tracing records the same kind of technical data. If you ask us to delete your data, we delete matching log entries, or confirm that they will be deleted automatically when they reach the end of their retention period.

Why: to keep the service running and secure and to investigate problems. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).

Contacting us

If you write to us, we process your email address, your name if you give it, and the content of your message to answer you. Mail to contact@corkacademy.com is forwarded by ImprovMX to a personal Gmail mailbox (Google), where we read and keep it.

Legal basis: our legitimate interest in answering you (Art. 6(1)(f) GDPR), or compliance with a legal obligation when you exercise your rights under the GDPR (Art. 6(1)(c)).

Donations

Donation buttons take you to Stripe or Buy Me a Coffee. Buy Me a Coffee processes the payment as an independent controller under its own privacy policy. Stripe processes it on our behalf under its data-processing agreement, and as an independent controller for its own purposes, such as fraud prevention and its legal obligations, under its own privacy policy. We never see your card details. We do receive what these platforms show to recipients, such as your name or nickname, your email address, any message you add, the amount, the date and a transaction ID.

Why: to receive and account for donations, and to thank you if you leave a message. Legal basis: compliance with tax and accounting obligations (Art. 6(1)(c) GDPR) and our legitimate interest (Art. 6(1)(f)).

What we don't do

We don't sell your data and we don't use it for advertising. We don't use solely automated decision-making that produces legal or similarly significant effects on you (Art. 22 GDPR).

3. Who receives your data

We use these providers:

For Firebase, Google Analytics, DigitalOcean, Formspree and ImprovMX, the provider acts as our processor under its data-processing terms. Stripe acts as our processor when it processes a donation, and as an independent controller for its own purposes (see Donations above). Our Gmail mailbox is a personal Google account, so Google provides it under its own terms and privacy policy, not as our processor.

We also use OpenRouter (an AI service) to draft short teaser texts for our social-media posts about the day's practice set. It receives only the topics of the questions, no personal data.

We may disclose personal data if the law requires it, for example to a court or authority with a valid request.

4. Transfers outside the EU

Our server and database are hosted by DigitalOcean in the United States, and Google, Formspree, ImprovMX and Stripe process data there. The safeguards are:

• Google LLC, which processes data for Firebase, Google Analytics and Gmail in the United States: certified under the EU-U.S. Data Privacy Framework; for Firebase and Google Analytics, Google's data-processing terms also include the European Commission's Standard Contractual Clauses.
• DigitalOcean, LLC: certified under the EU-U.S. Data Privacy Framework; its data-processing agreement incorporates the Standard Contractual Clauses.
• Formspree, Inc.: transfers rely on the Standard Contractual Clauses in Formspree's data-processing agreement.
• ImprovMX Incorporated: transfers rely on the Standard Contractual Clauses in ImprovMX's data-processing agreement.
• Stripe, LLC: certified under the EU-U.S. Data Privacy Framework; Stripe's data-processing agreement also includes the Standard Contractual Clauses.

You can ask us for a copy of the safeguards that apply to a given transfer by writing to contact@corkacademy.com.

5. How long we keep data

Our own cleanup jobs run daily, so on our systems deletion happens within a day or two after the periods below. Providers delete on their own schedules, as noted.

6. Your rights

You have the right to:

• access your data and get a copy of it;
• correct inaccurate data;
• delete your data ("right to be forgotten");
• restrict processing in the cases set out in Art. 18 GDPR;
• object to processing based on our legitimate interest (Art. 21 GDPR);
• data portability for the data you provided and that we process on the basis of your consent or to provide the service;
• withdraw consent at any time, without affecting earlier processing. For analytics and session replay, use Cookie settings at the bottom of any page; for the email signup, write to us.

To exercise any of these, write to contact@corkacademy.com. As a guest, you don't have a name or email address with us, so we'll ask you for your guest ID (shown in the account menu behind the person icon: in the top bar on a phone, or in the Guest session card of the side menu on a larger screen) and may ask you to make the request from the same browser, so we only act on your own data. We'll answer within one month; if a request is complex we may take up to two months longer, and we'll tell you if so.

You also have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland, uodo.gov.pl, or with the authority of the EU country where you live.

Cork Academy is for people aged 18 or older. If we learn that someone younger is using it, we'll delete their data.

7. Cookies and similar storage

We use your browser's storage only where needed, and ask before anything optional. We don't set cookies of our own; our essential storage is browser storage, not cookies.

Essential (always on): the service doesn't work without these. They are used only to deliver the service you asked for, so they don't require consent.

Only with your consent:

Browsers may shorten these lifetimes (for example, Safari caps script-set cookies at 7 days).

You can change your choice at any time with Cookie settings at the bottom of any page. Withdrawing stops the tools straight away: it deletes the _ga* and _oo_s cookies and reloads the page without them, and they don't load again.

8. Changes to this policy

When we change this policy, we update the date at the top. If a change affects what we ask your consent for, we'll ask again.