Privacy Policy

1. Introduction

I’m Maciek Gdula (legally Maciej Gdula), and I run Ancient Greek School, a one-teacher online school. I am responsible for your personal data (the “controller”, in the GDPR’s words), and you can reach me at ul. 1 Sierpnia 36B m. 109, 02-134 Warszawa, Poland or by email at the address in section 16. This Privacy Policy explains how I collect, use, disclose, and safeguard your information when you visit my website and use my services, including my newsletter, my forms, and my lessons.

I comply with the General Data Protection Regulation (GDPR) and other applicable data protection laws. This policy tells you what I do with your data and what rights you have over it.

2. Information I Collect

Personal Data You Provide

I may collect the following personal information when you voluntarily provide it to me:

Newsletter subscription: Email address
Contact form: Name, email address, an optional subject line, and message content. Messages sent until the form changed, on the evening of October 14, 2026, also carry the version of the data-use statement shown on the form at the time, so I can tell you what you were told.
Lesson requests: Your email address and your message. If you write for your child, whatever you tell me about them.
Lessons: Once we agree on lessons, our emails, the dates we plan, my notes on your progress, and payment details (the payer’s name, the amount and currency, and the account or Revolut profile it came from), and, if you ask me for an invoice, the name and address it must carry (and a tax number, for a business).
Support on Buy Me a Coffee: If you support my work there, Buy Me a Coffee shows me your name or the name you chose, your email address, your message, and the amount and date of your support.

Automatically Collected Data

When you visit my website, certain information may be collected automatically, including:

Browser type and version
Operating system
Pages visited and time spent
Referring website
IP address: my site holds it in its memory for a few minutes, to limit how often the forms, the newsletter, its unsubscribe link, the server log and crash reports can be used (section 10), and Vercel’s own record of each request keeps it for one hour. Vercel, Ahrefs and Sentry each work out an approximate location from it, and none of them keeps the address itself.

My site also notes in its server log each step a page reaches: that it opened, that it is still running and how smoothly, a move to another of its pages, the first scroll, the page going out of view and coming back, an error, a link that led nowhere or a file that did not load, and that you left. Each line holds the page’s address without anything after a question mark, the time since it opened, the size of your browser window and its pixel density, whether it is a touch screen, how you came to the page (a link, a reload, or Back), whether it is in view, how far down the page you are, two features your browser supports, any error message with the file it came from, your browser’s description of itself, and a random number made when you open my site in a tab, which stays the same while you move between its pages in that tab. It shows me when a page fails on a device, so I can fix it. Nothing in it names you, nothing is stored on your device, and Vercel keeps the log for one hour. Vercel also keeps its own record of each request for that hour, with your IP address and the page’s full address.

When something goes wrong on a page, a short report goes to Sentry, a service I use to find and fix errors: straight from your browser for what goes wrong on the page, and from my site’s server for the rest. It says what went wrong (an error in the page’s code, a file or a link that did not work, a page that stopped responding, or a form that could not send), and gives the page’s address without anything after a question mark, your browser’s and device’s description of themselves, and the last few things that happened on the page before it went wrong, such as clicks, taps and pages opened. Every step described above goes to Sentry too, on every visit, whether or not anything goes wrong. Sentry keeps all of this in the European Union for 30 days. From the internet address a report comes from, Sentry works out an approximate location, usually a country, a region and the nearest city of your internet provider rather than where you are, and keeps that, but not the address itself. Nothing in it names you: it holds no IP address, nothing you typed into a form, and nothing stored on your device. If a page crashes in Chrome or Edge, your browser may also send my site a short crash report of its own, with the page’s address, the reason the browser gives, and its description of itself.

To do all this, my site’s own script, and those of Vercel, Ahrefs and Sentry, read a few facts from your browser while a page is open: the size of its window and of your screen, its pixel density, whether it is a touch screen, its language, the type of its connection, a few features it supports, its description of itself, and whether it has been set not to be counted in my analytics. They store nothing on your device. You can stop these reads in your browser’s settings, by turning off scripts or blocking my analytics providers, or with a content blocker; my pages and forms still work without them.

Analytics Events

I use Vercel Web Analytics and Ahrefs Web Analytics to understand how visitors interact with my site. In addition to standard page view data, I track the following custom events:

Button clicks: When you click a call-to-action button (e.g., “Book Your First Lesson”), I record which button was clicked and its location on the page
Form submissions: When you successfully submit the contact form, send a lesson request, or subscribe to the newsletter, I record the event (not your personal data)
Feed link: When you tap the link to my News feed, I record that, and where on the page the link stands
Links and forms, by Ahrefs: Ahrefs also records on its own when you follow a link to another website (with that link’s address) and when a form is sent (not what is in it)

Both are privacy-focused: they do not use cookies, do not track users across sites, and do not collect personally identifiable information. To tell one visit from another for a day, both briefly use your IP address and your browser’s description: Ahrefs combines them with a random value that is deleted every 24 hours, and Vercel turns them into a value it discards after 24 hours, so a visit cannot be connected to you after that day. Each also works out an approximate location (country and city) from your IP address, without keeping the address. Analytics data is aggregated and cannot be used to identify individual users.

I also use Vercel Speed Insights to collect anonymous, cookieless real-user performance measurements (such as page load timing) so I can keep the site fast. Like Vercel Analytics, it does not use cookies and cannot identify individual users.

3. How I Use Your Information

I use the information I collect for the following purposes:

To answer your messages and lesson requests
To arrange and give your lessons, and to take payment for them
To send you my newsletter, if you have subscribed: word when group courses open for enrollment and when there are other major updates, and to see whether my emails reach their readers
To thank you, if you support my work on Buy Me a Coffee
To keep my website working and secure, and to improve it
To meet my legal obligations, such as keeping payment records for tax

4. Legal Basis for Processing (GDPR)

Under the GDPR, I process your personal data based on the following legal grounds:

Consent (Article 6(1)(a)): When you subscribe to my newsletter, you give explicit consent for me to send it to you, and for Brevo to record whether my emails are opened and which of their links are clicked (section 7). You can withdraw that consent at any time, and every email carries an unsubscribe link. If we agree to record a lesson, that recording also rests on your consent, which you can withdraw at any time. Withdrawing consent does not make unlawful what was done before you withdrew it.
Your request, and the contract that may follow (Article 6(1)(b)): When you write to me through the contact form or send a lesson request, I use what you send to answer you: for the contact form, your name, email address, and message; for a lesson request, your email address and message. This does not run on consent: replying is the thing you asked me for. The same basis covers teaching you once lessons begin.
A legal obligation (Article 6(1)(c)): Polish tax law requires me to keep records of the payments I receive, for lessons and for support. I keep them for as long as it requires, even if you ask me to delete your other data.
Legitimate interests (Article 6(1)(f)): For messages that are not about lessons, I rely on my legitimate interest in answering correspondence addressed to me. When a parent writes to me about a child, I use what they tell me about the child on the basis of my legitimate interest, and theirs, in arranging and preparing the child’s lessons. After lessons end, I keep our emails for a limited time to settle any questions or claims. I also rely on legitimate interests to keep the site secure and working, and to improve it: that covers the analytics, the server log, and the error reports in section 2. When you unsubscribe from my newsletter, I keep your address marked as unsubscribed so that nothing is sent to it again, and if you support me on Buy Me a Coffee, I use what it shows me to thank you: both rest on legitimate interests too. You can object to processing on this basis at any time.

You don’t have to give me any of this, but without your email address I can’t reply, and the contact form also needs your name. If you choose to tell me something sensitive, such as your faith or your health, I use it only to reply and to plan lessons, and I delete it on the same schedule as the rest. I make no automated decisions about you.

5. Data Retention

I retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

Newsletter subscribers: While you are subscribed, with Brevo’s record of which of my emails you opened and clicked. When you unsubscribe, Brevo keeps your address and that record, marked as unsubscribed, so nothing is sent to it again unless the address is signed up again; if you’d like it deleted altogether, ask me.
Contact form submissions: Up to 2 years after your last interaction
Lesson requests that don’t lead to lessons: 12 months after the last message
Students: While lessons continue, then until the end of the third calendar year after the last lesson
Payment records: 5 years from the end of the year in which the tax on that income was due (for example, payments from 2026 until the end of 2032), as Polish tax law requires
Support on Buy Me a Coffee: As payment records, above
Lesson recordings: Only if we agreed to make one, and for at most 30 days
My site’s server log, and Vercel’s record of each request: One hour
The values that tell one visit from another in my analytics: 24 hours (the statistics made from them name no one)
Error reports, the page’s steps, and their approximate locations at Sentry: 30 days

6. Your Rights (GDPR)

Under the GDPR, you have the following rights regarding your personal data:

Right of access: Request a copy of the personal data I hold about you
Right to rectification: Request correction of inaccurate or incomplete data
Right to erasure: Request deletion of your personal data (“right to be forgotten”)
Right to restrict processing: Request that I limit how I use your data
Right to data portability: Request your data in a structured, machine-readable format
Right to object: Object to processing I carry out on the basis of legitimate interests
Right to withdraw consent: Where I rely on consent, as I do for my newsletter and for a lesson recording, withdraw it at any time, without affecting what was done before you withdrew it
Right to lodge a complaint: Complain to a data protection supervisory authority, either where you live or work, or in Poland, where I am based: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa.

To exercise any of these rights, please contact me using the information provided below.

When you subscribe to my newsletter, you agree to receive emails from me when group courses open for enrollment and when there are other major updates. When you first subscribe, one email arrives straight away to say you’re subscribed. Every email has an unsubscribe link, so you can stop them at any time.

Brevo records whether my emails are opened and which of their links are clicked, so I can see whether my announcements reach their readers. Most email apps let you stop this by not loading images in emails.

I do not sell, rent, or share your email address with third parties for marketing purposes.

8. Third-Party Services

My website uses the following third-party services that may process your data:

Vercel (hosting and analytics): My website is hosted on Vercel, which provides privacy-focused web analytics and keeps its own record of each request for one hour, with your IP address and the page’s full address. Messages you send through my forms pass through Vercel’s servers on their way to my mailbox. Vercel Analytics does not use cookies and does not track users across websites. Vercel Privacy Notice (opens in new tab) Vercel Web Analytics and privacy (opens in new tab)
Ahrefs (analytics): Ahrefs Web Analytics records page views with their full addresses, referring websites, your browser’s and device’s description, language and screen size, approximate location (country and city), clicks on links to other websites, and the sending of forms (not what is in them), without cookies and without storing IP addresses. Ahrefs Privacy Policy (opens in new tab)
Sentry (error reports): My site and your browser send Sentry a short report when something goes wrong on a page, and the steps of each visit, so I can find and fix problems, as described in section 2. Sentry keeps them in the European Union for 30 days. Sentry Privacy Policy (opens in new tab)
Brevo (newsletter): When you subscribe to my newsletter, Brevo (formerly Sendinblue) stores your email address, sends the newsletter and the email that says you’re subscribed, and records whether those emails are opened and which of their links are clicked. Brevo Privacy Policy (opens in new tab)
Apple iCloud Mail (email): Messages from my forms reach me as email, and all my emails with you, including the confirmation each of my forms sends you and our emails about lessons, go through Apple’s iCloud Mail, which stores and delivers them. Apple Privacy Policy (opens in new tab)
Claude (reading error reports): I use Claude, an AI assistant made by Anthropic, to read the error reports and the server log described in section 2. In the European Union it is provided by Anthropic Ireland, and its use of my conversations to train its models is switched off. Anthropic Privacy Policy (opens in new tab)
Google Meet and Zoom (calls and lessons): The free intro call and lessons take place on Google Meet, or sometimes Zoom. Each processes your name, image, voice, and chat during the call under its own privacy policy. Google Privacy Policy (opens in new tab) Zoom Privacy Statement (opens in new tab)
Revolut (payments): Payments for lessons reach my Revolut account, by Revolut or by bank transfer, in any currency Revolut supports. Revolut, and your own bank or payment app, process the payment details under their own privacy policies and the legal duties that apply to payments. Privacy at Revolut (opens in new tab)
Buy Me a Coffee (support): The Buy Me a Coffee button on my Free Content page leads to a page where you can support my work. Buy Me a Coffee, a U.S. company, handles your payment and keeps your details under its own privacy policy, and shows me what section 2 lists. Buy Me a Coffee Privacy Policy (opens in new tab)
Embedded and linked content: I embed videos from YouTube. A YouTube player loads only after you choose to play a video, from YouTube’s privacy-enhanced mode (youtube-nocookie.com): until you press play, nothing is sent to YouTube. Once you play, YouTube (Google) receives your IP address and your browser’s description, and may store cookies or similar data on your device under its own privacy policy. I also link to my profiles on YouTube, Instagram, TikTok, Facebook, X, Xiaohongshu, and LinkedIn. Those are ordinary links, not embeds: following one takes you to that platform, which has its own privacy policy.

9. Cookies

My website does not set any first-party cookies. I do not use tracking cookies for advertising purposes. My analytics providers (Vercel Analytics and Ahrefs Web Analytics) are cookieless and do not track users across websites. Embedded YouTube videos do not load, and therefore cannot set cookies, until you choose to play them; after that, YouTube (in privacy-enhanced mode) may set its own cookies according to its privacy policy. Links to my profiles on other platforms set no cookies on my site and only take you to those platforms if you click them. Nothing else is stored on your device; what my site and my providers read from your browser is described in section 2.

10. Rate Limiting

To protect my services from abuse, I apply rate limiting to form submissions (contact form, lesson requests, and newsletter signup), to unsubscribing from and re-subscribing to the newsletter, and to the server log’s lines and the crash reports browsers send (section 2). This uses your IP address temporarily in server memory to count requests within a short time window. IP addresses used for rate limiting are not stored persistently and are automatically cleared from memory.

11. Data Security

I implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet is 100% secure.

12. International Data Transfers

Some services I use are based outside the European Economic Area, so your information may be transferred to and processed in the United States: Apple (email), Vercel (hosting and analytics), Google (video calls, and YouTube when you play a video), Zoom (video calls), Buy Me a Coffee (support), and Anthropic, whose servers for Claude are in the United States; and in Singapore and the United States by Ahrefs (analytics), a Singapore company that stores data in the United States. Brevo, my newsletter provider, stores its data in the European Union, and Sentry, a U.S. company, keeps my site’s error reports there too, but each may let its staff or its own providers outside the European Union reach the data, for example for support. Revolut is based in the European Economic Area and may transfer data outside it, for example for international payments. These transfers rely on the EU-U.S. Data Privacy Framework or on the EU’s Standard Contractual Clauses, as each provider states in its own terms; for Ahrefs, on the Standard Contractual Clauses I have signed with it.

13. Children’s Privacy

Lessons for anyone under 18 are arranged by a parent or legal guardian: they write to me, agree to the lesson terms, pay, and are the person I write to about lessons. When a parent tells me about their child, I ask only for what I need to plan lessons (such as a first name, age, and experience with Ancient Greek), I use it only for that, and I delete it on the schedule in section 5 (as a lesson request, or as a student’s data once lessons begin). The parent can ask me to correct or delete it, or object to my using it, at any time. My newsletter is not intended for children under 16. If you believe a child has sent me personal data without a parent’s or guardian’s knowledge, please contact me and I will delete it.

14. Lesson Recordings

I don’t record lessons. If you’d like a recording of a lesson, ask me before it starts: I record it only if we both agree (for a learner under 18, with a parent’s agreement), share it only with you, never publish it, and delete it within 30 days, or sooner if you ask. You can withdraw your agreement at any time.

15. Changes to This Policy

I may update this Privacy Policy from time to time. I will notify you of any changes by posting the new policy on this page and updating the “Last updated” date.

16. Contact Me

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact me at:

Post: Maciej Gdula, ul. 1 Sierpnia 36B m. 109, 02-134 Warszawa, Poland
Email: maciek (at) ancientgreekschool.com
Contact form: ancientgreekschool.com/contact