Privacy notice

1. Who is responsible

The controller of your personal data is DevUnit.pl Mateusz Hinca, ul. Arcangela Corellego 17/12, 03-289 Warszawa, Polska, NIP 839-312-42-45, REGON 368565464. Write to wirewhysupport@gmail.com about anything in this notice.

2. Without an account

The canvas, simulation, exercises, and sharing work without an account. Your circuit, preferences, and exercise progress are kept in your own browser (local storage), not sent to us, until you share or save something.

• Shared circuits and published exercises: the circuit you share (no personal data unless you type it in), when it was created, and how many times the link was opened. Nothing about the person opening it.
• Feedback you send: your message, the page and language, and your circuit if you choose to include it. It does not identify you unless you write something that does.
• Class sessions (follow-along): the teacher's circuit is passed to the followers while the session runs; nothing is stored.
• Technical logs: our servers record requests (including the IP address) and errors to keep the service secure and working. When the page itself fails in your browser, it reports the error and the page address without link identifiers; no cookies and nothing that identifies you.

3. With an account

When you sign in, we keep: an identifier from Microsoft Entra External ID, your email address, your display name, when you created the account and last signed in, your plans (with their dates and sources), your subscriptions as Paddle reports them (plan, status, dates, and Paddle's customer number), and the circuits you save.

Sign-in itself (your password or email codes, or your Google sign-in) is handled by Microsoft Entra External ID; we never see your password.

4. Payments

Paddle.com sells our plans as the Merchant of Record and processes your payment and billing details as an independent controller under its own privacy notice (paddle.com/legal/privacy). We receive only what we need to give you your plan: your WireWhy account id (which you pass to the checkout), the plan, its status and dates, and Paddle's customer and transaction numbers. We never see your card or bank details.

5. Why we process data (legal bases)

• To provide the service you asked for, your account, and your plans: performance of a contract (Art. 6(1)(b) GDPR).
• To keep the service secure and working (logs), to answer feedback, and to understand how the product is used with privacy-friendly statistics: our legitimate interests (Art. 6(1)(f) GDPR).
• To keep records the law requires: legal obligation (Art. 6(1)(c) GDPR).

6. Who processes data for us

• Microsoft (Azure hosting in the European Union, Microsoft Entra External ID for sign-in, Application Insights for technical logs).
• Google, if you choose to sign in with Google (under Google's own privacy policy).
• Paddle, for payments (see section 4).
• A privacy-friendly analytics service (Plausible or Umami) that uses no cookies and receives page addresses without link identifiers, and never your identity.

Our data is stored in the European Union. Where a provider processes data outside the European Economic Area, it does so under the safeguards the GDPR requires (such as the European Commission's standard contractual clauses or an adequacy decision).

7. How long we keep data

• Your account and saved circuits: until you delete the account. Accounts that never had a paid plan are deleted automatically after 12 months without a sign-in.
• Plans and subscription records: as long as the account exists; purchase and tax records are kept by Paddle as the law requires.
• Shared circuits and published exercises: as long as the link should keep working, or until you ask us to remove them.
• Feedback: up to 2 years.
• Technical logs: up to 90 days.

8. Cookies and local storage

WireWhy uses no advertising or tracking cookies. When you sign in, we set one cookie that keeps you signed in (wirewhy.session, up to 30 days); Microsoft Entra and, during checkout, Paddle set the cookies their services need. Your circuit, preferences, and progress are kept in your browser's local storage, which you can clear at any time.

9. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable form. Deleting your account in the Account dialog deletes your account data at once. For anything else, write to wirewhysupport@gmail.com; we answer within one month.

You can also complain to a data protection authority: in Poland the President of the Personal Data Protection Office (UODO, uodo.gov.pl), in Brazil the ANPD (gov.br/anpd), in Switzerland the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch), or the authority where you live or work. If you are in Switzerland, the Swiss Federal Act on Data Protection (revFADP) gives you the same rights.

10. Children

Students do not need an account to use WireWhy, to join a class session, or to do exercises. If you are under 16, ask a parent or guardian before creating an account.

11. Changes

We update this notice when what we process changes, and show the date it took effect at the top.