The Protocol of Aesthetic Intelligence

Privacy Policy

Last updated 16 August 2026

This policy explains what personal data we collect when you visit this website or buy the digital edition of The Protocol of Aesthetic Intelligence, why we collect it, who we share it with, and what rights you have over it. It is written to meet the requirements of the General Data Protection Regulation (EU) 2016/679.

01Who is responsible for your data

The controller of your personal data is:

We have not appointed a Data Protection Officer, as we are not required to. For any question about this policy or your data, write to the address above and we will respond within one month.

02What we collect

If you only browse the site

We do not require you to give us anything. Our hosting provider automatically records standard server log data — your IP address, the pages requested, timestamps and your browser's user-agent string — for security and to keep the site running.

If you buy the book

Payment is taken by Stripe on a page hosted by Stripe. We never see or store your card number. What we receive and store is:

• your email address;
• your name, if you provide it at checkout;
• the amount and currency paid, and the date;
• Stripe's transaction references (a checkout session ID and a payment ID), which let us match a payment to your access;
• whether your access is currently active or revoked.

When you sign in

We do not use passwords. To open your copy, we email you a single-use link. For this we store:

• an irreversible cryptographic hash of the sign-in token — never the token itself, so a copy of our database cannot be used to sign in as you;
• the IP address from which a sign-in link was requested, used only to limit how many can be requested per hour;
• a session cookie in your browser that keeps you signed in.

If you contact us

We keep the correspondence and the address you wrote from, so we can deal with your question, refund or complaint.

03Why we use it, and on what legal basis

Purpose	Legal basis (GDPR Art. 6)
Taking payment, granting and maintaining your access to the book, sending your access link	Performance of a contract — Art. 6(1)(b)
Issuing invoices and keeping accounting and tax records	Legal obligation — Art. 6(1)(c)
Handling refunds, disputes, chargebacks and complaints	Contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c)
Preventing fraud and abuse, rate-limiting sign-in requests, keeping the site secure	Legitimate interests — Art. 6(1)(f): protecting our business and our customers' accounts
Establishing or defending legal claims	Legitimate interests — Art. 6(1)(f)
Sending you occasional email about new writing or editions, if you asked us to	Consent — Art. 6(1)(a). You can withdraw it at any time, using the unsubscribe link in any such email.
Measuring how the site is used, so we can improve it	Consent — Art. 6(1)(a), given through the cookie banner. You can withdraw it at any time.

We do not make any decision about you by purely automated means, and we do not profile you.

04Who we share it with

We do not sell your data, and we do not share it for anyone else's marketing. We use a small number of service providers who process data on our instructions:

Provider	What they do	Where
Stripe Payments Europe, Limited (Ireland) and its group companies	Processing card payments, refunds, fraud prevention and issuing receipts	Ireland, with transfers to the United States
Hostinger International Ltd	Website and database hosting, and delivery of your access link and account emails	European Union
Google Ireland Limited	Google Analytics — aggregate statistics about how the site is used, only if you have consented to analytics cookies	Ireland, with transfers to the United States

We may also disclose data where the law requires it — for example to a tax authority, or to a court.

05Transfers outside the European Economic Area

Some of the providers above process data in the United States. Where that happens, the transfer is protected by the European Commission's Standard Contractual Clauses, or by that provider's certification under the EU–US Data Privacy Framework where applicable. You can ask us for details of the safeguards that apply.

06How long we keep it

Data	Retention
Your account and access record	For as long as your access is active. If you ask us to delete it, we will — but doing so ends your access to the book.
Invoices and accounting records	Five years from the end of the calendar year in which the tax became payable, as Polish tax law requires. We cannot delete these earlier, even on request.
Sign-in tokens	They expire within 72 hours and are deleted within 30 days.
Server logs	As retained by our hosting provider, typically a matter of weeks.
Correspondence	Up to three years after the matter is closed, in case of a later dispute.

07Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you, and receive a copy;
• rectify it, if it is wrong or incomplete;
• erase it, where we have no overriding obligation to keep it;
• restrict how we process it, in certain circumstances;
• portability — receive the data you gave us in a structured, machine-readable format;
• object to processing based on our legitimate interests;
• withdraw consent at any time, where we rely on it. This does not affect anything done before you withdrew it.

To exercise any of these, write to welcome@protocolofaestheticintelligence.com. We will not charge you, and we will reply within one month.

08Cookies

Strictly necessary

One cookie, set only after you sign in: a session cookie that keeps you signed in to your copy of the book. It is marked secure and HTTP-only, and it expires after 60 days or when you sign out. Because it is strictly necessary for the service to work, it does not require your consent.

Stripe sets its own cookies on its checkout page for fraud prevention. Those are governed by Stripe's privacy policy.

Analytics

We use Google Analytics to understand, in aggregate, which pages people read and how they arrive. It sets cookies in your browser that hold a randomly generated identifier. These are not strictly necessary, so we set them only if you accept analytics cookies in our cookie banner. If you decline, or simply ignore the banner, they are never set. You can change your mind at any time by clearing this site's cookies in your browser and choosing again.

We have IP anonymisation enabled, we do not link analytics data to your account or your purchase, and we do not use Google Analytics for advertising or audience remarketing. Google's own handling of this data is described in Google's privacy policy.

We do not use advertising cookies, and we do not track you across other websites.

09How we protect it

The site is served over HTTPS. Sign-in tokens are stored only as SHA-256 hashes. The book file and our configuration are held outside the public web directory and cannot be reached by URL. Access to the database is restricted to the application. No system is perfect, but we take these measures seriously and review them.

10Children

This product is intended for adults. We do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, write to us and we will delete it.

11Changes to this policy

If we change this policy we will update the date at the top. Where a change materially affects you, we will tell you by email.

12Contact

TW Reserved
welcome@protocolofaestheticintelligence.com