Privacy Policy

Last updated: October 23, 2026 · Effective as of: October 23, 2026

This Privacy Policy is drafted in English, which is its authoritative language. If a translation is provided, it is for convenience only and the English version prevails in the event of any discrepancy. This does not affect the User's rights under the mandatory provisions of the law of their country of habitual residence.

Summary (not a substitute for the full policy)

uHint.me processes the live audio of your conversation in real time to detect questions and generate answer cues. It does not store the audio, transcripts, detected questions or answer cues. Answer cues exist only in your answer view, during the session and for up to 10 minutes after it ends. Microsoft, our AI provider, may keep audio, prompts and outputs for a limited period (up to 30 days) for abuse monitoring, outside our systems; see Section 4.
The only personal data needed to run your account is your email address, your conversation language, when you accepted the Terms, which apps and browsers are signed in, your session time balance, and the history of your sessions (when they started and ended, and how long they were). No name is required to create an account (you may give one when you write to us or make a complaint), there is no password, and no payment data (payments are not processed yet).
All AI processing takes place on Microsoft Azure in the European Union. The server and the database are in the European Union. Cloudflare provides the network layer in front of our server (the audio stream and answer cues pass through it in transit, through its global network) and hosts the website; Resend sends our emails.
We do not sell personal data, do not show advertising, do not profile you and do not use tracking cookies.

Section 1. Data Controller

The controller of Users' personal data is Daniel Loposzko, operating under the business name Zinit Daniel Loposzko, ul. Sportowa 35, 55-040 Kobierzyce, Poland, Tax Identification Number (NIP): 896-116-23-34, Statistical Identification Number (REGON): 021006839 (hereinafter: the "Controller").
For matters related to data protection, the Controller may be contacted:
1. by email: info@uhint.me,
2. through the contact form at app.uhint.me/contact,
3. by mail: ul. Sportowa 35, 55-040 Kobierzyce, Poland.
The Controller has not appointed a Data Protection Officer.
Capitalised terms not defined here (User, Account, Session, Session Time, App, Answer View, Session PIN, Service) have the meaning given in the Terms of Service available at uhint.me/terms.

Section 2. Categories of Personal Data Processed

Data provided by the User:
1. email address (the Account identifier; there is no password and no name),
2. conversation language chosen for Sessions (English, Polish, German, French, Italian or Spanish),
3. the content of messages sent to the Controller through the contact form or by email, together with the sender's email address.
Data collected automatically when the Account is created or used:
1. date and time of Account creation and of acceptance of the Terms,
2. date and time of the first confirmation of the email address (first successful sign-in with a one-time code),
3. a keyed hash (HMAC) of the network address range from which the Account was registered, used only to limit the number of Accounts registered from one network range per day and removed 30 days after registration; the network address itself is not stored,
4. the free trial offered on the registration form (number of minutes and when it was shown) and whether the free trial was refused because the email address had already used it,
5. for each signed-in installation of the App ("device"): platform (macOS, Windows or the reference client), App version at sign-in, time of sign-in and time of last use; a hash of the device credential (the credential itself is stored only on the User's computer),
6. for each signed-in browser on the account pages: a hash of the session cookie value, time of sign-in, expiry (30 days), time of the last code confirmation and, when ended, the time and reason of ending,
7. security events concerning the Account: type of event (for example account created, signed in, signed out, other devices signed out, language changed, account deleted), time, and the identifiers of the Account, device, credential or browser session concerned; security events contain no email address, network address, code or credential,
8. one-time code records: the email address the code was sent to, the purpose of the code, a keyed hash of the code (the code itself is not stored), validity, number of attempts and state; kept for 15 to 30 minutes,
9. rate-limit records: keyed hashes of the email address or of the network address range with the time of the event; kept for 24 hours; the network address itself is not stored.
Data processed in the course of providing the Service (Sessions):
1. Session history: for each Session the time it started and ended, its duration, how it ended (Stop, Session Time exhausted or failure) and which device ran it; the Session history contains no content,
2. Session Time ledger: every grant (free trial, grant by the Controller on request, future purchase) and every deduction, with time, amount in seconds and, for grants by the Controller, a short comment,
3. live audio of the selected source (Microphone or Computer audio), which may contain the voice and words of the User and of the other participants of the conversation: processed in real time in server memory and forwarded to the AI services listed in Section 5 solely to detect questions and obtain a transcript; not stored or archived by the Controller,
4. transcripts of fragments of the conversation and detected questions: processed in server memory for the time needed to decide on and generate an Answer Cue; not stored,
5. Answer Cues: generated by AI, delivered to the Answer View and held in server memory while the Session is running and for up to 10 (ten) minutes after it ends, so that the Answer View can still show them; then permanently discarded; not stored,
6. the Session PIN and the Answer View address of a Session: held in server memory for the duration of the Session; the PIN is shown only in the User's App.
Data processed when the User opens the Answer View, the account pages or the uhint.me website: the network address and technical request data (browser type, requested address, time) processed by Cloudflare as the network provider in front of the Controller's server, and by the server to enforce rate limits (as keyed hashes of the network range, Section 2, subsection 2, items 3 and 9). The Controller's server logs contain request identifiers, operation names, result codes and Account, device and Session identifiers; they contain no email address, network address, code, credential or conversation content, and are kept for 30 days.
Technical and diagnostic data of the App: the App stores on the User's computer its settings, the masked Account email address and the device credential (in the macOS Keychain or the Windows Credential Manager). The App sends the Controller its version and platform when it signs in and when it starts a Session. The App contains no analytics or crash-reporting component and sends no usage statistics or crash reports to anyone.
Payment data: the Controller does not process payment data. No payments are processed in the Application during the launch offer (free of charge until 31 December 2026). When paid top-ups of Session Time are introduced, this Privacy Policy will be updated to name the payment service provider and the data it processes before the first payment is taken.
Data the Controller does NOT process: the Controller does not keep recordings, transcripts, detected questions or Answer Cues; does not analyse the content of conversations for any purpose other than generating Answer Cues in real time; does not create voiceprints or any biometric identifiers; does not require the User's name, address, date of birth or payment details to create or use an Account (such data may occur in content the User provides, including conversations processed in real time, correspondence, a complaint or a withdrawal form); does not use advertising or analytics trackers.

Section 3. Purposes and Legal Bases for Processing Personal Data

The Controller processes Users' personal data for the following purposes and on the following legal bases:
1. Provision of the Service (conclusion and performance of the Agreement: Account, sign-in, Sessions, Answer Cues, Session Time balance). Legal basis: Article 6(1)(b) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, hereinafter: "GDPR"), processing necessary for the performance of a contract. Scope: email address, conversation language, device and browser session records, Session history and Session Time ledger, and, in real time, live audio, transcripts, detected questions and Answer Cues (Section 4).
2. Processing of the data of other participants of the conversation contained in the live audio (their voice and what they say), in order to detect the questions they ask and generate Answer Cues for the User. Role and legal basis: the User alone decides whether, when, from which audio source and for what purpose a Session is run. Whether the User's own processing falls within the GDPR depends on the circumstances: where the User uses the Application in the course of a purely personal activity (which may be the case, for example, for a job interview conducted by the User on their own behalf), the GDPR does not apply to the User's processing (Article 2(2)(c) GDPR), and the Controller processes the audio as the User's technical service provider on the basis of Article 6(1)(f) GDPR: the legitimate interest of the Controller in providing the Service ordered by the User and the legitimate interest of the User in obtaining cues in their own conversation. In balancing these interests against the interests of the other participants the Controller relies on the following: the participants are speaking to the User in a conversation in which they can expect the User to take notes and prepare answers; on the Controller's side the processing is momentary and in memory only, and nothing about the participants is stored, identified or profiled by the Controller; the content leaves the Controller's systems only to the processors described in Sections 4 and 5: the AI provider, whose retention for abuse monitoring is limited in time, serves only that purpose, does not identify the participants and is not accessible to the Controller (Section 4, subsection 5), and the network provider through which the content passes in transit without being stored (Section 5, subsection 1, item 4); and the Terms require the User to inform the participants or obtain their consent where the applicable law or the rules of the conversation require it. Where the User's use is not purely personal and the User is a controller of the other participants' data, the Controller processes the audio on the User's behalf and instruction as a processor (Article 28 GDPR), on the terms set out in Section 14 of the Terms of Service.
3. Security of the Account and of the Service: one-time codes, rate limits, limit on Accounts registered from one network range, security events, blocking of Accounts that breach the Terms. Legal basis: Article 6(1)(f) GDPR, the legitimate interest of the Controller in protecting Accounts and the Service against unauthorised access and abuse; and Article 6(1)(b) GDPR to the extent sign-in is part of the Service. Scope: email address, keyed hashes of codes, email address and network address ranges, device, credential and browser session records, security events, server logs.
4. Preventing repeated use of the free trial by the same email address after Account deletion. Legal basis: Article 6(1)(f) GDPR, the legitimate interest of the Controller in protecting the free offer against abuse. Scope: a keyed hash (HMAC) of the email address of a deleted Account; the email address itself is removed at deletion.
5. Handling complaints, withdrawal declarations, requests and messages sent through the contact form or by email. Legal basis: Article 6(1)(c) GDPR (obligations under the Consumer Rights Act and the Civil Code) and Article 6(1)(f) GDPR (the legitimate interest of the Controller in answering messages). Scope: sender's email address, Account identifier if signed in, content of the message and of the correspondence.
6. Compliance with legal obligations (tax, accounting), once paid Session Time is offered. Legal basis: Article 6(1)(c) GDPR (tax and accounting regulations). Scope: identification and transaction data of paying Users.
7. Establishment, exercise or defence of legal claims. Legal basis: Article 6(1)(f) GDPR, the legitimate interest of the Controller in being able to defend against or pursue claims. Scope: Account data, Session history, Session Time ledger, security events, correspondence.
8. Informing Users of changes to the Terms, the Privacy Policy or the Service that concern their Account. Legal basis: Article 6(1)(b) and (c) GDPR. Scope: email address.
9. Publication of a Review sent by the User, with the attribution chosen by the User. Legal basis: Article 6(1)(a) GDPR, the User's separate consent given in the manner described in Section 9 of the Terms of Service, which may be withdrawn at any time. Scope: the text of the Review and the attribution chosen by the User (for example first name and role, or initials). A published Review is publicly available on the uhint.me website for as long as the consent stands and the Controller displays it; after withdrawal of consent the Review is removed from the website within 14 days (copies made by search engines or other third parties while it was public are outside the Controller's control).
The Controller does not process personal data for marketing purposes and does not send newsletters or promotional emails; the only exception is the publication of a Review with the User's consent (subsection 1, item 9). The Controller sends only emails necessary to operate the Account: one-time codes requested by the User, confirmations that Session Time has been added to the Account, notices concerning the Account (such as a blocking, termination, deletion, or acknowledgement of a withdrawal or complaint), replies to the User's messages, and notices of changes to the Terms of Service or this Privacy Policy.
Providing the email address is voluntary but necessary to create an Account and use the Service.

Section 4. Processing of Live Audio and Data by Artificial Intelligence

The Controller applies a single principle to all conversation content: processed in real time, never stored. Audio, transcripts, detected questions and Answer Cues exist in the memory of the Controller's server only for as long as they are needed to generate and show an Answer Cue (and, for Answer Cues, for up to 10 minutes after the Session so that the Answer View can show them), and are then permanently discarded. Nothing from a Session is written to disk, to the database or to logs on the Controller's infrastructure. The only exception outside the Controller's systems is the temporary retention by Microsoft described in subsection 5.
Live audio of the selected source is streamed from the App to the Controller's server over an encrypted connection and forwarded in real time to artificial intelligence services of Microsoft Corporation (Microsoft Azure AI services), processed in Microsoft data centres in the European Union:
1. real-time speech and language models, to detect the current question in the audio,
2. speech recognition models, to obtain a text transcript of the audio.
The transcript of the relevant fragment and the detected question are then forwarded to large language models of the same Microsoft Azure AI services, processed in the European Union, in three parallel steps: deciding whether the question gets an Answer Cue, generating the Answer Cue, and deciding whether the question continues the previous one. The result is sent to the User's Answer View. The Controller may replace a model with another model provided by Microsoft and processed in the European Union without changing this Privacy Policy; a change of the AI provider or of the place of processing is announced as described in Section 10d.
No other artificial intelligence provider receives conversation content. The Controller does not use conversation content to train, fine-tune or evaluate any model. Under the Azure terms applicable to the Controller, Microsoft does not use customer data to train its models.
Microsoft processes the audio, transcripts, prompts and generated content under Microsoft's data protection terms for Azure services (the Microsoft Products and Services Data Protection Addendum) and does not use them to train, retrain or improve its models. In accordance with the terms of the Azure AI services, Microsoft may temporarily retain prompts, audio and generated content for abuse monitoring for a limited period which, according to Microsoft's documentation applicable on the date of this Privacy Policy, does not exceed 30 (thirty) days, after which they are deleted by Microsoft. The Controller has not obtained an exemption from abuse monitoring and therefore informs Users that this retention by Microsoft applies to Session Content. This retention takes place in Microsoft data centres in the European Union and is outside the Controller's systems; the Controller has no access to that data. Should the Controller obtain an exemption (Modified Abuse Monitoring or Zero Data Retention), this Privacy Policy will be updated.
Live audio is not processed for the purpose of biometric identification of the User or of any participant. Voice is used solely as a carrier of content to be converted to text and analysed for questions. The Controller does not create, store or compare voiceprints or other biometric identifiers, and does not perform emotion recognition.
Other participants of the conversation: the User decides to run a Session and selects the audio source. The audio may therefore contain the voices of persons other than the User. The Controller processes that audio only as described in this Section, does not identify those persons, does not store anything about them and does not contact them. The Controller has no means of informing those persons itself; the Terms require the User to make sure that processing the audio of the conversation is permitted and, where the applicable law or the rules of the conversation require it, to inform the participants or obtain their consent before the Session. Subsection 8 contains a short notice text that the User may use for this purpose. A participant who has questions about this processing may contact the Controller at the address in Section 1; Section 8, subsection 6 describes their rights.
Notice for the other participants of a conversation. The User may give the participants the following information, in their own words or by pointing them to this Privacy Policy (uhint.me/privacy, Section 4): "I am using uHint.me, an assistant that listens to this conversation in real time and suggests answers to me. The audio is processed by the service and its AI provider, in the European Union, to detect questions and transcribe them. The service records and stores nothing; the AI provider may retain fragments for up to 30 days for abuse monitoring. Nobody is identified by their voice. The privacy policy is at uhint.me/privacy." The User remains responsible for giving this information where it is required and for obtaining consent where the applicable law or the rules of the conversation require it (Terms of Service, Section 10, subsection 4).

Section 5. Recipients of Personal Data

Users' personal data may be disclosed to the following categories of recipients, acting as processors on the Controller's behalf unless stated otherwise:
1. Server infrastructure provider:
  1. Hetzner Online GmbH (Germany), hosting the Controller's application server in Nuremberg, Germany.
2. Database provider:
  1. Supabase, Inc. (United States), hosting the PostgreSQL database with Account data, device and browser session records, security events, Session history and the Session Time ledger, in the Ireland (eu-west-1) region of Amazon Web Services; the database contains no conversation content.
3. Artificial intelligence services (conversation content; see Section 4, subsection 5 for the temporary retention for abuse monitoring):
  1. Microsoft Corporation / Microsoft Ireland Operations Ltd. (Microsoft Azure AI services), processing in Microsoft data centres in the European Union, as described in Section 4.
4. Network, website and download hosting:
  1. Cloudflare, Inc. (United States), which provides DNS, the encrypted tunnel and reverse proxy in front of the Controller's server for app.uhint.me and live.uhint.me (processing network addresses and request data of every visitor, with automatic DDoS protection), hosting of the static website uhint.me, hosting of the App installers at files.uhint.me, and Email Routing for the mailbox info@uhint.me. Cloudflare also terminates the encrypted connection from the App to the Controller's server (api.uhint.me), so the audio stream, Answer Cues, Session PINs and sign-in credentials pass through Cloudflare's network in transit; Cloudflare does not store them. Cloudflare operates a global network and serves traffic from the data centre nearest to the visitor, which may be outside the European Union.
5. Email delivery provider:
  1. Resend, Inc. (United States), sending one-time codes, contact form messages and the service emails listed in Section 3, subsection 2 from info@uhint.me, from its Ireland (eu-west-1) region. Resend processes the recipient's email address and the content of the message (for example the one-time code, the amount of Session Time added, or the User's contact message).
6. Mailbox provider of the Controller:
  1. Google LLC (Gmail), the mailbox in which the Controller receives messages sent to info@uhint.me (contact form messages and emails from Users) and from which it replies.
7. Payment service providers: none at present; to be added before paid top-ups of Session Time are offered.
8. Government authorities, only in cases provided for by law (for example at the request of a court, prosecutor or law enforcement authority).
The providers listed in subsection 1, item 3 process conversation content solely to provide the AI services to the Controller and do not use it to train, fine-tune or improve their models.
The Controller does not sell Users' personal data to third parties. Within the meaning of the California Consumer Privacy Act (CCPA), the Controller does not engage in the "sale" or "sharing" of personal information for cross-context behavioural advertising purposes.
The Controller does not disclose Users' personal data to third parties for marketing purposes; the only exception is a Review the User has agreed to publish (Section 3, subsection 1, item 9), which is public by its nature.
The Controller may change the service providers listed in subsection 1, provided that at least an equivalent level of personal data protection is maintained, and informs Users of material changes by updating this Privacy Policy (see Section 12).

Section 6. Location of Data Processing and Transfers Outside the EEA and Switzerland

The Controller processes personal data primarily in the European Union: the application server is in Germany, the database in Ireland, the AI services in Microsoft Azure data centres in the European Union, and email delivery in Ireland. Conversation content is processed by the Controller and by Microsoft only in the European Union; in transit between the App and the Controller's server it passes through Cloudflare's global network (Section 5), which does not store it.
Some providers are established in the United States (Supabase, Inc., Cloudflare, Inc., Resend, Inc., Google LLC, Microsoft Corporation) and may have access to personal data from the United States for support or operational purposes, and Cloudflare serves network traffic through its global network. Where personal data is transferred outside the EEA or Switzerland, the Controller ensures an adequate level of protection through at least one of the following mechanisms:
1. an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified providers) or a corresponding decision of the Swiss Federal Council,
2. Standard Contractual Clauses adopted by the European Commission or equivalent clauses recognised under Swiss law, as included in the providers' data processing terms,
3. other legally permissible safeguards provided for in Chapter V of the GDPR or in the Swiss Federal Act on Data Protection (FADP).
Data at rest in the database and data in transit between the App, the browser, Cloudflare, the Controller's server, the database and the AI services are encrypted.
The User may obtain further information about the safeguards applied and a copy of the relevant documents by contacting the Controller at the address specified in Section 1, subsection 2.

Section 7. Data Retention Periods

Users' personal data is retained for the following periods:
1. Account data (email address, conversation language, acceptance of the Terms, trial offer, device and browser session records): for the duration of the Agreement. On deletion of the Account the email address is removed from the Account immediately and irreversibly, all devices and browsers are signed out, and the Account record remains without the email address.
2. Keyed hash of the email address of a deleted Account (used only to refuse a second free trial): 12 (twelve) months after deletion of the Account, then removed. Keyed hash of the registration network range: 30 (thirty) days after registration, then removed.
3. Session history, Session Time ledger and security events: for the duration of the Agreement and for 6 (six) years after deletion of the Account (the limitation period for claims), then deleted or reduced to aggregate statistics. After deletion of the Account these records contain no email address or other direct identifier (random identifiers, times, durations and amounts of Session Time); the Controller treats them as pseudonymised personal data, because they could still be linked to a person through correspondence kept under item 10, and uses them only for usage statistics and the defence of claims.
4. Live audio, transcripts, detected questions: only in server memory for the seconds needed to produce an Answer Cue; never stored.
5. Answer Cues: in server memory while the Session is running and for up to 10 (ten) minutes after it ends; never stored.
6. One-time code records: 15 to 30 minutes from issue.
7. Rate-limit records (keyed hashes): 24 hours.
8. Browser session records: until signed out or 30 days from sign-in, then removed by automatic cleanup.
9. Server logs (without personal content): 30 days.
10. Contact form messages and email correspondence: ordinary enquiries for 12 (twelve) months from the end of the calendar year in which the matter was closed; complaints, withdrawal declarations, requests concerning personal data and correspondence related to a dispute for 6 (six) years from the end of the calendar year in which the matter was closed (the limitation period for claims).
11. Transaction data (once paid top-ups exist): for the period required by tax and accounting regulations (5 years from the end of the calendar year in which the deadline for payment of the tax expired, or longer where a specific regime such as VAT OSS requires it).
Upon expiry of the periods specified in subsection 1, personal data is permanently deleted or anonymised.
The User may at any time request earlier deletion of their personal data, subject to the Controller's legal obligations and the legitimate interests described in Section 3 (in particular defence of claims and the prevention of free-trial abuse).

Section 8. User Rights

Users are entitled to the following rights in connection with the processing of their personal data:
1. Right of access (Article 15 GDPR): to obtain confirmation whether their personal data is processed and, if so, access to that data and to information about the purposes, categories, recipients, retention periods and rights. Because conversation content is not stored, access cannot cover audio, transcripts or Answer Cues.
2. Right to rectification (Article 16 GDPR): the conversation language can be changed on the account pages. A change of the Account email address is made by the Controller on a request sent from the current Account email address; before making the change, the Controller verifies that the User controls the new address (Terms, Section 4, subsection 20).
3. Right to erasure (Article 17 GDPR): the User can delete their Account on the account pages at any time (Account → Delete account), with the effects described in Section 7; further erasure requests may be sent to the Controller. This right may be limited where processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims.
4. Right to restriction of processing (Article 18 GDPR).
5. Right to data portability (Article 20 GDPR): to receive the personal data processed on the basis of the Agreement by automated means (Account data, Session history, Session Time ledger) in a structured, commonly used, machine-readable format (JSON), and to transmit it to another controller.
6. Right to object (Article 21 GDPR): to object at any time to processing based on the Controller's legitimate interest (Article 6(1)(f) GDPR); the Controller then ceases the processing unless it demonstrates compelling legitimate grounds that override the User's interests.
7. Right to withdraw consent: to the extent any processing is based on consent, the User may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. At present the only processing based on consent is the publication of a Review (Section 3, subsection 1, item 9); consent is withdrawn by email and the Review is removed within 14 days.
To exercise the above rights, the User contacts the Controller at the address specified in Section 1, subsection 2. The Controller may ask the User to confirm the request from the Account email address or to sign in on the account pages, to verify that the request comes from the Account holder.
The Controller responds to the User's request without undue delay and in any event within one month of receipt. Where necessary, taking into account the complexity and number of requests, this period may be extended by two further months; the Controller informs the User of any such extension, with the reasons, within one month of receipt of the request (Article 12(3) GDPR).
The User has the right to lodge a complaint with a supervisory authority: in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland, www.uodo.gov.pl), or the supervisory authority of the User's country of habitual residence, place of work or place of the alleged infringement (for example CNIL in France, the competent Landesbeauftragte für den Datenschutz in Germany, the Datenschutzbehörde in Austria, the Garante per la protezione dei dati personali in Italy, the AEPD in Spain, or the FDPIC in Switzerland).
The rights above may be exercised free of charge, except where requests are manifestly unfounded or excessive.
Persons other than the User whose voice was processed during a Session (other participants of the conversation) have the same rights towards the Controller. The Controller stores no Session Content and holds no data that would allow it to identify a participant from the audio of a Session; where a request concerns such audio, the Controller informs the requester of this (Article 11 GDPR) and of the processing described in Section 4, including the temporary retention by the AI provider, to which the Controller has no access. The Controller handles the request in respect of any data it does hold about the requester (for example their correspondence with the Controller), takes into account any additional information the requester provides that would make identification possible. Where a request concerns processing by one of its processors, the Controller takes the steps required by applicable data protection law, including contacting that processor where necessary. Where the User acts as the controller of their data, the participants may also exercise their rights towards the User.

Section 9. Automated Decision-Making and Profiling

The Application uses automated processing for the following purposes:
1. automatic detection of questions in the live audio,
2. automatic transcription of the live audio,
3. automatic decision whether a detected question is shown with an Answer Cue, and whether it continues the previous question,
4. automatic generation of Answer Cues,
5. automatic rate limiting of sign-in codes, registrations and connections, and automatic refusal of a second free trial for an email address that already used it.
The automated processing referred to in subsection 1 does not constitute automated decision-making within the meaning of Article 22 GDPR, because it does not produce legal effects concerning the User or similarly significantly affect the User: it is an integral part of the Service requested by the User, and the rate limits and trial rule only delay or limit free use and can be reviewed by the Controller on request.
The Controller does not profile Users for marketing or advertising purposes, does not build profiles of the User's skills or conversations, and does not evaluate the other participants of a conversation.

Section 10. Personal Data Security

The Controller applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or disclosure, including in particular:
1. encryption of all connections (TLS) between the App, the browser, the Controller's server, the database, the email provider and the AI services,
2. encryption of the database at rest,
3. no passwords: sign-in by one-time codes sent to the Account email address, with limits on attempts and frequency,
4. storage of only hashes of codes, device credentials and browser session values, so that a copy of the database does not grant access to Accounts,
5. pseudonymisation of network addresses and email addresses in rate-limit and registration-limit records (keyed hashes),
6. an append-only security event log of changes to Account access,
7. no storage of conversation content; server logs without personal content,
8. the server reachable only through Cloudflare's encrypted tunnel and SSH with key authentication; firewall; intrusion ban on failed SSH attempts; security updates applied by the Controller on a regular basis; log rotation,
9. the database without a public API; access only from the Controller's application and administrative tools.
Access to Users' personal data is limited to the Controller and persons authorised by the Controller, who are obligated to maintain confidentiality.
The Controller regularly reviews the security measures applied and updates them as needed, taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing.
Because the Account is tied to the email address, the User is asked to protect access to that email account and, if they suspect unauthorised access, to use the "Sign out all apps" function on the account pages and contact the Controller.

Section 10a. Minimum User Age

The Application is intended for adults and may be used only by persons who have reached the age of 18 (eighteen). On registration the User declares that they are at least 18 years old. The Controller does not knowingly collect personal data from persons under 18 and, with respect to the United States, from children under 13 (thirteen) within the meaning of the Children's Online Privacy Protection Act (COPPA).
If the Controller becomes aware that an Account is held by a person below the required age, the Controller promptly deletes the Account with the effects described in Section 7.

Section 10b. Additional Information for Users from the United States (US Privacy Disclosures)

This section contains additional information for Users who are residents of the United States of America, to the extent that the laws referred to below apply to the Controller. It supplements the remaining provisions of the Privacy Policy and does not limit any right under the GDPR, which applies to all Users of the Service; where this section and the GDPR provide different response periods, the shorter one applies.

Information for California Residents (CCPA / CPRA)

Under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively: "CCPA"), residents of the State of California have the right to obtain information about the categories of personal information collected, used and disclosed by the Controller.
Categories of personal information collected by the Controller within the meaning of the CCPA:
1. Identifiers: email address, Account and device identifiers,
2. Internet or other electronic network activity information: Session history (times and durations), sign-in and security events, network address processed transiently for rate limiting and by Cloudflare,
3. Audio information: live audio processed in real time for question detection and transcription, not stored,
4. Inferences: none are drawn or stored about the User; detected questions and Answer Cues are discarded after the Session.
Purposes of collection: solely the purposes of providing the Service described in Section 3. The Controller does not use personal information for purposes incompatible with the context in which it was collected without prior notice to the User.
The Controller does not "sell" personal information within the meaning of the CCPA and does not "share" personal information for cross-context behavioural advertising. The Controller does not collect or process "sensitive personal information" within the meaning of the CCPA other than, transiently and without storage, the content of the User's communications in the live audio processed at the User's request.
Rights of California residents under the CCPA: Right to Know, Right to Delete, Right to Correct, Right to Opt-Out of Sale/Sharing (the Controller does not sell or share), Right to Limit Use of Sensitive Personal Information, and Right to Non-Discrimination.
To exercise these rights, the User contacts the Controller at the address specified in Section 1, subsection 2. The Controller verifies the User's identity through the Account email address and responds within 45 (forty-five) days of receipt of the request, with a possible extension of a further 45 days in justified cases.

Information for Illinois Residents (Biometric Information Privacy Act)

Under the Illinois Biometric Information Privacy Act (BIPA), the Controller informs that:
1. the Application processes live audio solely for the purpose of detecting questions and converting speech to text,
2. the Controller does not collect, capture, store or use biometric identifiers or biometric information within the meaning of BIPA,
3. voice is not used to create voiceprints, for voice identification or for any other form of biometric identification or verification,
4. the Controller keeps no archive of audio; audio is processed by the recipients described in Sections 4 and 5 (the AI provider, which may retain it temporarily for abuse monitoring, and the network provider through which it passes in transit) and is not shared with any other third party in audio form.
Should the processing of audio ever change in a way that could result in the collection of biometric data within the meaning of BIPA, the Controller commits to providing prior written notice, obtaining the User's explicit informed consent before such processing, and publishing a biometric data retention and destruction policy.

Information for Residents of Other States

Residents of states with comprehensive state privacy laws in effect may have additional rights regarding their personal data, including the right to access, delete, correct and port data, and the right to object to profiling. To exercise these rights, contact the Controller at the address specified in Section 1, subsection 2.
The Controller does not use dark patterns to obtain User consent or to impede the exercise of their rights.

Note on recording laws

Several US states require the consent of all parties to record or intercept a conversation. uHint.me does not record conversations, but it does process their audio in real time. Users are responsible for complying with the laws that apply to their conversation and are advised to inform the other participants that uHint.me is used.

Section 10c. Users from Outside the European Economic Area (International Users)

The Application is available to Users worldwide. Regardless of the User's location, personal data is processed on the infrastructure described in Section 6 (European Union), and conversation content is processed in European Union regions of Microsoft Azure.
By using the Application from outside the European Economic Area, the User acknowledges that their personal data is transferred to and processed in the European Union, and that Cloudflare serves network traffic through its global network.
Regardless of the User's location, the Controller applies the technical and organisational measures described in Section 10.
For Users from the European Economic Area and the United Kingdom, the Controller processes personal data in accordance with the GDPR (and, for UK Users, the UK GDPR), and all rights arising from it apply in full.
For Users from Switzerland, the Controller processes personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and, to the extent applicable, the GDPR. Swiss Users are entitled to the rights set out in Section 8. The competent supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC).
For Users from the United States, the additional provisions of Section 10b apply.

Section 10d. Changes to Artificial Intelligence Service Providers

Due to the rapidly evolving nature of artificial intelligence technology, the Controller reserves the right to change the AI models and services listed in Section 4, including replacing a model or provider, adding a provider or discontinuing one.
Any change is subject to the following conditions:
1. the provider must ensure at least an equivalent level of personal data protection,
2. the provider may not use conversation content to train its models,
3. the principle that conversation content is processed in real time and never stored by the Controller remains unchanged,
4. the Controller informs Users of a change of the region of processing of conversation content (in particular a change from the European Union to another region) before it takes effect.
The current AI provider and the categories of AI services used are described in Section 4 of the latest version of this Privacy Policy. The Controller informs Users of material changes in accordance with Section 12.

Section 11. Cookies and Local Storage

The uhint.me website (landing page, Terms, Privacy Policy) uses no cookies, no analytics and no third-party resources; fonts and images are served from the website itself.
The account pages at app.uhint.me use one strictly necessary cookie, "__Host-uhint_session", which keeps the User signed in on that browser for up to 30 days or until sign-out. It is HttpOnly, Secure and SameSite=Strict, contains only a random session value, and is not used for tracking. No consent is required for this cookie, because it is strictly necessary to provide the service explicitly requested by the User (Article 5(3) of Directive 2002/58/EC and the Polish Electronic Communications Law of 12 July 2024 implementing it).
The Answer View at live.uhint.me uses no cookies. After the Session PIN is entered, the Answer View is addressed by a random token in the page address for the duration of the Session; the User should not share that address.
Cloudflare, as the network provider in front of app.uhint.me and live.uhint.me, may set strictly necessary cookies for security purposes (for example to distinguish legitimate visitors during an attack). Such cookies are not set in normal operation, are not used by the Controller for any purpose and are described in Cloudflare's cookie policy.
The App stores on the User's computer, in the operating system's protected storage (macOS Keychain or Windows Credential Manager) and in its settings, the device credential, the masked Account email address and the User's preferences (for example the selected audio source). This data stays on the computer and is not shared with third parties. The device credential is removed when the User signs out of the App; uninstalling the App may leave it in the operating system's protected storage until it is removed there.

Section 12. Changes to the Privacy Policy

The Controller reserves the right to amend this Privacy Policy, in particular in the event of changes to applicable law, changes in the manner of processing personal data (including the service providers and AI models used), the introduction of payments, or changes to the Application's functionality.
Users are notified of changes to the Privacy Policy at least 14 (fourteen) days before they take effect, by a notice on the account pages and by publication of the amended Privacy Policy at uhint.me/privacy; material changes are also announced by a notice sent to the Account email address with the date on which they take effect, the full text of the amended Privacy Policy (in the body of the email or as an attachment) and a link to it.
The current version of the Privacy Policy is always available at uhint.me/privacy and is linked from the account pages and the registration form. Each version carries a version date, and previous versions remain available on the uhint.me website.

Section 13. Final Provisions

This Privacy Policy is effective as of October 23, 2026.
Matters not regulated by this Privacy Policy are governed by the GDPR and other generally applicable provisions of Polish and European Union law on the protection of personal data, and with respect to Users from the United States also by applicable state and federal law of the United States.
Contact with the Controller regarding personal data protection: info@uhint.me.