Privacy Policy

We are the data controller under the GDPR (Regulation (EU) 2016/679, „RODO") for the personal data we process through WONDER. For any privacy request, use the email or phone number above — we respond within 30 days.

2. What we collect

• Account data — email address, optional display name, account creation date.
• Learning data — facts you save, your review history, XP, streak and daily-goal settings. This is your product data, not sold and never shared.
• Session data — a session token stored locally in your browser (localStorage) to keep you signed in.
• Technical data — anonymized request logs (IP, user agent, timestamps) used only for security and abuse prevention.

3. Legal bases (GDPR Art. 6)

• Performance of a contract (b) — providing the service: account, review queue, progress.
• Legitimate interest (f) — security, fraud prevention, service improvement. You may object at any time.
• Consent (a) — where we ask for it (e.g. optional notifications).
• Legal obligation (c) — invoicing and tax records if you purchase a paid plan.

4. Cookies & local storage

WONDER uses no third-party tracking cookies. We store your session token and preferences in your browser's local storage on your device. You can clear them anytime in your browser settings without losing your account — just sign in again.

5. Your rights (GDPR Art. 15–22)

You have the right to access, rectify, erase, restrict, port and object to the processing of your data. In the app you can:

• Export your data — Settings → „Download my data" (JSON, includes your full learning history).
• Delete your account — Settings → „Delete my account". This permanently erases your profile, progress, streak and review history, and invalidates all sessions.
• Contact us at privacy@wonder.zordonintelligence.pl for any other request — we respond within 30 days.

6. Retention

We keep your data while your account is active. After account deletion, personal data is erased immediately, except where a longer retention is required by law (e.g. invoicing records, which we keep for 5 years as required by Polish tax regulations).

7. Security

Passwords are stored as salted hashes, traffic is TLS-encrypted, and data is hosted in EU data centers. We apply least-privilege access and review access to production systems.

8. Transfers & subprocessors

We do not sell personal data. Where we use subprocessors (hosting, payments via Stripe, email delivery), data stays within the EU/EEA or is covered by standard contractual clauses. A full list is available on request.

9. Contact & supervisory authority

Questions or complaints: privacy@wonder.zordonintelligence.pl , phone 576 895 831, or via zordonintelligence.pl . You also have the right to lodge a complaint with the Polish data protection authority (Prezes UODO, uodo.gov.pl).