Documents
Privacy Policy
Version pl-2026-10-12, effective from 12 October 2026
This is an English translation for your convenience. The Polish version is the binding one.
This policy describes what data I process on the joanasi.com website (the site, the blog, the free training plan and the newsletter, Instagram Live reminders, the shop for the Fresh Start Meal Plan (Dieta na Start in the Polish terms) and the platform after you sign in), why, on what basis, for how long and to whom I entrust it. I write it in line with Article 13 GDPR and in Polish.
1. Data controller
The controller of your personal data is Joanna Sirak, a sole trader registered in the Central Register and Information on Economic Activity (CEIDG) under the business name JOANASI JOANNA SIRAK, NIP (tax ID) 6751435279, REGON (statistical number) 146446576, ul. Tkacka 5/5, 30-050 Kraków. Contact on data matters: hello@joanasi.com, or by post to the address above. No data protection officer has been appointed.
2. What data I process
When you buy and use the platform
- E-mail address given at purchase and used to sign in.
- Order data: order identifier, product and edition bought, price and currency, payment and access status, transaction identifiers on the Stripe side.
- Where the order came from: the page and form from which you started the purchase, UTM parameters from the page address (for example “Instagram story”) and the address of the page from which you arrived.
- Record of the statements made at purchase: the exact wording and version of the statements, whether and when they were made, the version of the terms you accepted, a hash of your IP address and your browser family (for example “iOS”, “Android”), as evidence.
- Name and payment details you give to Stripe on its payment page. I do not store them; what comes back to me is the e-mail address, the amount, the status and the transaction identifier.
- Access codes and sessions: cryptographic hashes of single-use codes and session tokens, their validity period, browser family.
- Your choices on the platform: planned days and dishes, number of servings, favourites, the state of the shopping list.
- Sign-up for a notification about the training platform, when you click “Powiadom mnie” (“Notify me”) on the platform: the wording and version of the consent, the time it was given, a hash of your IP address and your browser family. The training platform is a separate product; I will send you one e-mail when it launches. You can withdraw your consent at any time by writing to hello@joanasi.com or clicking the link in that message.
- Product events: pseudonymous events from a closed list (for example “plan opened”, “ebook downloaded”) linked to the customer identifier in my database, never to the e-mail address. They contain no health data and no plan content.
- Marks on issued copies of PDF files: every file issued has an invisible copy identifier, stored in the database together with the order or newsletter sign-up it relates to.
- Correspondence, when you write to me.
When you sign up for the newsletter and the free plan
- E-mail address from the form.
- Proof of consent: the wording and version of the consent, the time it was given, a hash of your IP address, your browser family, the page and campaign from which you signed up, and the time and manner of withdrawal of consent.
- Download links issued: a hash of the token, expiry date (14 days), number of downloads, copy identifier.
When you sign up for an Instagram Live reminder
- E-mail address from the form on the event page (live.joanasi.com).
- Proof of consent: the wording and version of the consent, the event it relates to, the time it was given, a hash of your IP address, your browser family, and the time and manner of withdrawal of consent.
- Event sign-up: which event, when, the source and campaign from the page address (UTM parameters, for example “Instagram story”).
- Messages: the sign-up confirmation, at most two reminders (the day before and the hour before the start) and a summary after the event, as well as information from the e-mail provider on whether a message was delivered, bounced or was reported as spam.
On all pages
- Server logs: IP address, time, page address, response code, browser family, kept for 30 days for security and diagnostics.
- Aggregate visit counters: one row per day per page address with the number of views. The browser reports only the address of the page viewed; I do not store an IP address, an identifier or a cookie, and you cannot be recognised from this data.
- Google Analytics statistics (only with your consent): on joanasi.com pages, including live.joanasi.com, a browser identifier stored in a cookie, pages visited, approximate location (country, city), device and browser type, traffic source and events such as viewing the offer, signing up for a free material, starting a payment, a purchase (with the order number, without personal data), starting a replay, the part watched, a chapter clicked or going to Instagram. I do not pass your e-mail address or any other form data to Google.
- PostHog statistics (only with your consent, the same consent as for Google Analytics): on joanasi.com pages, including live.joanasi.com, a random browser identifier stored in a cookie and in browser storage, pages visited and when you left them, approximate location (country, city) derived from your IP address, device and browser type, traffic source and the same events as in Google Analytics. Page addresses reach PostHog without parameters (except utm campaign tags) and without order identifiers or links from e-mails. I do not record sessions, collect clicks or page content, and I do not pass your e-mail address or any other form data to PostHog.
- Counters limiting the number of attempts (sign-in, sign-up, purchase): hashes of the e-mail address and IP address with a counter for a time window.
What I do not collect. I do not collect data about health, test results, weight, body measurements or medication. The platform has no place for them. The calorie calculator, if you use it, calculates only in your browser: it does not send the values entered or the result to the server and does not store them.
3. Purposes, legal bases and retention periods
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Selling the set and maintaining access | order, e-mail address, edition, access status | Article 6(1)(b) GDPR (contract) | for the period of access, and as a sales document 5 years from the end of the year in which the tax obligation arose |
| Record of statements made at purchase | wording and version of the statements, time, IP hash, browser family | Article 6(1)(c) GDPR (Article 21 of the Polish Consumer Rights Act (ustawa o prawach konsumenta)), then point (f): showing what I showed you and when | together with the order, 5 years from the end of the tax year |
| Passwordless sign-in and sessions | e-mail address, hashes of codes and tokens | Article 6(1)(b) GDPR | codes until expiry (60 minutes); sessions until sign-out or expiry (90 days from last use) |
| Sending access messages and confirmations | e-mail address, message content | Article 6(1)(b) GDPR | copy of the message 90 days; the fact that the confirmation was sent, together with the order |
| Weekly plan, favourites and shopping list | your choices on the platform | Article 6(1)(b) GDPR | for the period of access, then deletion within 30 days |
| Marking issued PDF files | copy identifier, link to the order or sign-up | Article 6(1)(f) GDPR: establishing the source of a copy shared without authorisation | 3 years from the end of access |
| Product events | event type, time, customer identifier | Article 6(1)(f) GDPR: checking that the purchase, access and main features work | 12 months |
| Handling questions and complaints | correspondence | Article 6(1)(b) and (c) GDPR | 3 years from closing the matter, in the mailbox; manual review once a quarter |
| Limiting the number of attempts | hashes of e-mail address and IP, counters | Article 6(1)(f) GDPR: protection against abuse | up to 24 hours from the end of the window |
| Server logs | IP address, time, page address, browser family | Article 6(1)(f) GDPR: security and diagnostics | 30 days |
| Aggregate visit counters | day, page address, number of views | Article 6(1)(f) GDPR: knowing which pages are read; the data identifies no one | 400 days, as aggregate data |
| Google Analytics statistics | browser identifier, pages visited, events, approximate location, device | Article 6(1)(a) GDPR (consent) and Article 399 of the Polish Electronic Communications Law (Prawo komunikacji elektronicznej) | until consent is withdrawn; Google keeps statistics data for 14 months |
| PostHog statistics | browser identifier, pages visited, events, approximate location, device | Article 6(1)(a) GDPR (consent) and Article 399 of the Polish Electronic Communications Law (Prawo komunikacji elektronicznej) | until consent is withdrawn; PostHog keeps events for one year |
| Newsletter and free plan | e-mail address, consent status, sign-up and download events | Article 6(1)(a) GDPR (consent) and Article 398 of the Polish Electronic Communications Law (Prawo komunikacji elektronicznej) | until consent is withdrawn; after that only proof of consent and withdrawal, for 3 years from withdrawal |
| Instagram Live reminders and summary | e-mail address, proof of consent, event sign-up | Article 6(1)(a) GDPR (consent) and Article 398 of the Polish Electronic Communications Law (Prawo komunikacji elektronicznej) | I send messages until the summary after the event or until consent is withdrawn; copies of messages 90 days, delivery information 12 months; proof of consent, withdrawal and sign-up 3 years from the event |
| Notification of the training platform launch | e-mail address from the account, proof of consent | Article 6(1)(a) GDPR (consent) and Article 398 of the Polish Electronic Communications Law (Prawo komunikacji elektronicznej) | until the one message about the platform launch is sent or consent is withdrawn; proof of consent 3 years from sending or withdrawal |
| Tax and accounting obligations | sales records | Article 6(1)(c) GDPR | 5 years from the end of the year in which the tax payment deadline passed |
| Establishing and defending claims | order data, statements, correspondence | Article 6(1)(f) GDPR | until the limitation period expires, and in pending proceedings until they end |
Giving your e-mail address is necessary to buy the set and receive access, to sign up for the newsletter or to get an Instagram Live reminder; without it I cannot perform the contract or send the plan. Your name and payment details are required by Stripe to carry out the payment. Signing up for the newsletter is voluntary and is never a condition of a purchase or of using the platform.
Periods given as a number of days are enforced by a daily automated task. I have no influence over providers' backups, which expire in their own cycle.
4. Purchase and payment
Payments are handled by Stripe (Stripe Payments Europe, Limited, Ireland). You pay on Stripe's page by card, BLIK, Przelewy24 transfer, Apple Pay or Google Pay. I do not see or store your card number. I am the seller and the party to the contract; Stripe acts as a processor on my behalf for payment handling, and as a separate controller for fraud prevention, legal obligations and card network settlements, on the terms described in its privacy policy.
5. Access to the platform
You do not create an account with a password. You enter the e-mail address used for the purchase and get a six-digit code and a link; you enter the code or click the link. The response to a request for a code is always the same, regardless of whether the address is in my database. I store codes and tokens only as cryptographic hashes. A link to a file is short-lived and issued only to a person with an active entitlement.
6. Newsletter and free plan
Signing up for the newsletter is one separate consent; I thank you for signing up with the Strength Start plan (Siła na Start in the Polish terms). Consent is given by entering your address in the form and clicking the button next to the consent sentence; there is no box to tick, and the sentence says plainly what you agree to. I record proof of it (point 2). The first message contains a link to the plan valid for 14 days. You can generate a new link on the /materialy/odbierz page while your consent is active.
I send the newsletter myself through Amazon SES (point 7), from my own server; I do not use an external newsletter tool and I do not embed a newsletter tool's script on the site.
You can withdraw your consent at any time using the unsubscribe link in every message (/rezygnacja) or by writing to me. Withdrawing consent does not affect the lawfulness of messages sent before withdrawal. The details are set out in the Newsletter Terms (/en/newsletter).
6a. Instagram Live reminders
Signing up for a reminder is a separate consent, given the same way (by clicking the button next to the consent sentence) and independent of the newsletter: it does not sign you up for the newsletter, and unsubscribing from reminders does not change your newsletter, if you have it. After signing up you get a confirmation, then at most two reminders, and one summary after the event. After that I no longer send messages on the basis of this consent.
You can withdraw your consent at any time using the “Wypisz mnie” (“Unsubscribe”) link in each of these messages, the unsubscribe button in your e-mail program or by writing to me. I send the messages through Amazon SES (point 7) from hello@joanasi.com; I do not track message opens or link clicks.
7. Recipients of data
| Provider | What for | Role | Where |
|---|---|---|---|
| Amazon Web Services EMEA SARL (Luxembourg) | hosting of the platform and the database, file storage, sending e-mails (Amazon SES), logs | processor | Frankfurt region (eu-central-1), European Union; AWS service access may take place from outside the EEA on the basis of standard contractual clauses and AWS certification under the EU-U.S. Data Privacy Framework |
| Google Ireland Limited (Ireland), Google Analytics service | statistics on visits to joanasi.com pages, only with your consent | processor | Ireland; transfer to Google LLC (USA) on the basis of certification under the EU-U.S. Data Privacy Framework and standard contractual clauses |
| PostHog, Inc. (USA), PostHog Cloud EU service | statistics on visits to joanasi.com pages, only with your consent | processor | servers in Frankfurt, European Union; service access by PostHog, Inc. from the USA on the basis of standard contractual clauses |
| Stripe Payments Europe, Limited (Ireland) | payments, refunds, payment disputes | processor, in part a separate controller | Ireland; transfer to Stripe, Inc. (USA) on the basis of standard contractual clauses and certification under the EU-U.S. Data Privacy Framework |
I do not use any ongoing accounting or legal services to which I would pass your data; if that changes, I will add them here in advance. Data may be disclosed to authorised public authorities if the law requires it.
8. Transfers of data outside the EEA
I store data in the European Union (AWS, Frankfurt). Data leaves the EEA when it is passed to Stripe, Inc. (USA), to Google LLC (USA) if you consent to statistics, and through any service access by AWS and PostHog, Inc. (USA). The basis, depending on the recipient, is Commission Implementing Decision (EU) 2023/1795 on the EU-U.S. Data Privacy Framework, where the recipient is certified under it, and the standard contractual clauses adopted by Commission Decision (EU) 2021/914. I will provide a copy of the safeguards applied, or information about them, on request: hello@joanasi.com.
9. Your rights
You have the right to access your data and obtain a copy of it, to rectification, erasure, restriction of processing and data portability, and to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal).
Right to object. You may at any time object to processing based on my legitimate interest, in particular to product events, logs, marking of copies and processing for the defence of claims. After an objection I will stop processing that data, unless I demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims.
Write to hello@joanasi.com. I reply without undue delay, and at the latest within one month; in a complex case I may extend this period by two months, and I will tell you if I do. I must keep some data despite a request if tax law requires it or if it is needed for the defence of claims.
I do not make decisions about you based solely on automated processing that would produce legal effects. I do not profile you for marketing purposes.
10. Cookies and browser storage
The website uses cookies that are strictly necessary to provide the service you request. Under Article 399(3) of the Polish Electronic Communications Law (Prawo komunikacji elektronicznej), they do not require consent. On your first visit I also ask, in one short notice, for your consent to Google Analytics and PostHog statistics. Until you click “Akceptuję” (“Accept”), neither Google Analytics nor PostHog is loaded. Your decision applies on all joanasi.com pages, including live.joanasi.com, and you can change it at any time by clicking “Cookies” in the page footer. Statistics are not loaded in the order handling panel (staff only).
| Name | Type | What for | How long |
|---|---|---|---|
| joanasi_session | strictly necessary cookie, HttpOnly | keeping you signed in to the platform without a password; the browser sends it only to joanasi.com, and scripts cannot access it | until sign-out or 90 days from last use |
| joanasi_staff | strictly necessary cookie, HttpOnly | signing in the person handling orders in the /ops panel (staff only) | until sign-out or 12 hours |
| joanasi_order | strictly necessary cookie, HttpOnly | recognising your own order on the confirmation page after purchase, so that no one else can see it via its address | 24 hours from the start of the purchase |
| joanasi:lead-email (sessionStorage) | browser storage, not a cookie | showing your e-mail address on the thank-you page after signing up for the newsletter; this way the address does not reach the server or the page address | until the browser tab is closed |
| joanasi:live-email (sessionStorage) | browser storage, not a cookie | showing your e-mail address on the thank-you page after signing up for an Instagram Live reminder; this way the address does not reach the server or the page address | until the browser tab is closed |
| joanasi_analytics | cookie necessary to remember your decision | remembering whether you agree to statistics (without data about you), shared across joanasi.com pages | 180 days |
| _ga, _ga_GGCJ7J831K | Google Analytics analytics cookie, only after consent | distinguishing visits and sessions in the statistics | up to 2 years or until consent is withdrawn (we then delete them) |
| ph_(project identifier)_posthog, also in browser storage (localStorage, sessionStorage) | PostHog analytics cookie, only after consent | distinguishing visits and sessions in the statistics | up to one year or until consent is withdrawn (we then delete them) |
I do not use marketing cookies or advertising pixels. The only third-party scripts are Google Analytics, with advertising features (Google Signals) switched off, and PostHog, without session recording or click collection; both are loaded only after your consent. Apart from that, I count visits without cookies and without identifiers: as a daily counter per page address (point 2). The calorie calculator does not store anything in browser storage.
Disabling strictly necessary cookies in your browser settings will make it impossible to sign in to the platform; the public pages work without them.
11. Security
The connection is encrypted (TLS). I store codes, tokens and identifiers as cryptographic hashes. Access to the database is limited to the platform, and customers' data is separated at database level, so one customer cannot read another's data. I limit the number of sign-in, sign-up and purchase attempts to protect accounts against abuse.
12. Complaint to the President of UODO
If you believe that I process your data unlawfully, you have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl. Independently of this, you may pursue your rights before a court.
13. Changes to this policy
I update the policy when the services, providers or the law change. The current version is always at this address, with the version designation and the date it came into force. I will tell you about significant changes by e-mail, if I have your address.