Privacy Policy

1. Data Controller

The controller of your personal data is coverly ("we", "the platform"). For questions about data protection, you can contact us at prywatnosc@coverly.cc.

2. What Data We Collect and From Whom

From donors (people supporting projects):

• email address (always, passed to us by Stripe after a payment is made)
• display name (optional)
• a message to the creator (optional — visible only to the project's creator, never publicly)

From project creators:

• email address (for login and notifications)
• GitHub id, username, and email address (optional — only if you log in via GitHub)

A login attempt using an email address (or a GitHub account) that has not been granted access to the creator dashboard does not cause that address to be stored, and no account is created.

3. Purpose and Legal Basis for Processing

We process your data to fulfil a donation and to manage a creator account — on the basis of Article 6(1)(b) GDPR (performance of a contract to which the data subject is party, or steps taken at the data subject's request prior to entering into a contract). Providing an email address is necessary to make a donation or log in to the creator dashboard — without it, we cannot provide these services. A display name and a message to the creator are optional; if you provide them, we process them on the same basis, at your explicit request.

In addition to the main service, a separate test environment is operated, in which no real payments are processed; we process the email addresses of people testing the platform there on the same basis.

4. Recipients of Data / Subprocessors

To provide the service, we use external providers who process data on our behalf:

• Stripe, Inc. — payment processing (sees the email address, name, donation amount, and any optional message to the creator, which we pass to it as payment-session metadata). Stripe Privacy Policy ↗
• Resend — sending transactional emails (sees the email address and name). Resend Privacy Policy ↗

Both providers are based in the United States — your data may be processed there in accordance with their own data-protection safeguards (standard contractual clauses and compliance mechanisms described in their privacy policies above).

5. Retention Period

We retain donation data for the duration of the platform relationship plus an additional 5 years from the end of the year in which the donation was made — in accordance with accounting regulations and tax-claim limitation periods. After this period, data is deleted or anonymized. A creator account with no donations at all is retained for as long as the platform is actively used — the 5-year period counted from a donation does not apply in that case.

Data in the separate test environment may be deleted at any time, regardless of the period stated above, and is not backed up.

6. Your Rights

You have the right to:

• access your data and receive a copy of it
• rectify inaccurate data
• erasure of data ("the right to be forgotten")
• restrict processing
• data portability
• object to processing
• lodge a complaint with the President of the Personal Data Protection Office (PUODO)

To exercise these rights — e.g. to request deletion of your data — write to us at prywatnosc@coverly.cc. We will respond and fulfil the request within 30 days.

7. Public Display of Data

On a project's public page (e.g. coverly.cc/p/project-name), only the donor's name and the donation amount are visible. The email address and any message to the creator are never publicly visible — only the logged-in project creator and Stripe, as the subprocessor handling the payment, have access to them (see section 4).

8. Cookies

We use only one, strictly necessary session cookie (a login token, httpOnly) needed to log in to the creator dashboard. We do not use analytics cookies, marketing cookies, or any tracking tools.