Last updated: 30 October 2026
This is the privacy policy for alexsmyrk.com (and, after the move, alexi.cz). It explains what personal data I collect, why, and what your rights are. I have written it in plain English. If anything is unclear, write to me.
1. Who is responsible
The controller of your personal data is:
Alex Smyrk, English language teacher and course creator (self-employed)
Mladeč 24e, 783 21 Mladeč, Czech Republic
IČO: 74382063 · DIČ: CZ6107037530
Email: alex@alexi.cz
There is no data protection officer; I run this site myself.
2. The short version
- I collect only what I need to run the site, teach you, and bill you.
- I do not sell your data, and I do not run advertising or tracking.
- Your account, course progress, notes and exercise results stay on my own server.
- Lesson videos come from YouTube. Payments go through SureCart.
- You can see, change or delete your data at any time by writing to me.
3. What I collect and why
3.1 Visiting the site
When you open a page, my web host records your IP address, browser type, the page you asked for and the time. This is a technical log kept for security and to keep the site running. Legal basis: legitimate interest (Article 6(1)(f) GDPR). Kept: 30 days.
The site also detects which country you are in, so it can show prices in the right currency and the right wording. The first time, your IP address is sent to a geolocation service (ipapi.co) and the answer is cached on my server for 12 hours. If you allow “Preferences” cookies, the country is remembered in a cookie for 30 days; if not, it is checked again on each visit. Legal basis: legitimate interest for the detection; consent for the cookie.
Security plugins (Wordfence) record IP addresses of failed logins and blocked requests to protect the site from attacks. Legal basis: legitimate interest. Kept: 30 days.
3.2 Cookies
The site uses only a few cookies. The details, and your choices, are in the Cookie Policy. You can change your choice at any time with the “Cookie settings” link at the bottom of the Cookie Policy.
3.3 Your account
When you register or I create an account for you, I store your name, email address and a password (stored encrypted). While you are logged in, cookies keep you signed in. Legal basis: performance of a contract (Article 6(1)(b)) — I cannot give you a course without an account. Kept: for as long as you have an account, then deleted within 12 months of your last login or on request.
3.4 Your profile (“My details”)
You can add to your profile: phone number, company, position, website, LinkedIn profile, your English level and notes about how you like to learn. All of these are optional.
The profile also has a section on neurodiversity (for example dyslexia or ADHD). This is health information, which the law treats as a special category. I ask for it only because my teaching is designed for neurodivergent adults, and knowing helps me adapt lessons and exercises for you. You decide whether to tell me. If you do, I process it on the basis of your explicit consent (Article 9(2)(a)). You can remove it from your profile at any time, and that withdraws your consent. I never share it with anyone, including your employer.
3.5 Learning data
While logged in the site stores:
- which exercises you have completed, and your exercise scores (H5P exercise results);
- the notes you write in the Notes panel of each course;
- your assessed English level after each lesson, so you and I can see your progress on a chart;
- for live lessons, my lesson summary (what we covered, key vocabulary, homework) and attendance.
Legal basis: performance of a contract — this is the service you are paying for. Kept: for as long as you have an account.
3.6 Lesson recordings and transcripts
To write your lesson summary, I record the audio of live in-person lessons and Teams lessons and have them transcribed. The transcript is processed with an AI writing assistant (Anthropic’s Claude) to draft the summary, which I then check and edit. Recordings are deleted once the summary is written; the summary is kept with your learning data. I will always tell you before a lesson is recorded, and you can say no. Legal basis: consent (Article 6(1)(a)).
3.7 Corporate clients
If your employer pays for your lessons, I report to them what they need to invoice and manage the programme: dates attended, attendance, and a short lesson summary. I do not pass on your profile notes, your neurodiversity information or your private course notes. Your employer is responsible for its own handling of this report. Legal basis: performance of the contract with your employer and my legitimate interest in administering it.
3.8 Payments and membership
Payments are handled by SureCart, my e-commerce provider, with the card or payment method processed by Stripe. I never see your full card number. I receive your name, email, billing address, country, VAT number (if you give one), what you bought and the amount. SureCart sends the order and payment emails. Invoices and tax records are kept for 10 years, as Czech tax law requires. Legal basis: performance of a contract and legal obligation (Article 6(1)(c)).
3.9 Contact forms and email
If you write to me through a form or by email, I keep your message and your contact details to answer you and to keep a record of what we agreed. Legal basis: legitimate interest, or steps before a contract. Kept: 3 years after the last contact.
3.10 Newsletters and reminders
I use a self-hosted mailing system (FluentCRM) to send course emails, reminders and, if you agree, a newsletter. Service emails about your account or course are part of the contract. Marketing emails go only to people who have opted in, and every one has an unsubscribe link. I do not track whether emails are opened.
3.11 Comments and blog
If you comment on a blog post, your name, email, comment and IP address are stored with the comment, as WordPress does by default.
4. Who else sees your data
I use the following service providers. Each acts on my instructions as a processor, or is a separate controller for its own service.
| Service | What for | Where | Notes |
|---|---|---|---|
| Hostinger | Web hosting and content delivery | EU | Processor |
| Titan (Flock) | Email mailbox for alex@alexsmyrk.com | India | Processor |
| SureCart | Checkout, payments, order emails | USA | Processor; EU–US Data Privacy Framework |
| Stripe | Taking the payment | EU/USA | Separate controller for payment data |
| YouTube (Google) | Playing lesson videos (privacy-enhanced mode) | USA | Sets cookies only once you start a video (play button, “Play clip”, or a design item); see Google’s privacy policy |
| ipapi.co | Country detection from your IP address | USA | Only the IP address is sent |
| Wordfence (Defiant Inc.) | Security scanning and firewall | USA | IP addresses of suspicious requests |
| Microsoft Teams | Online lessons | EU/USA | Your employer may provide the account |
| Anthropic (Claude) | Drafting lesson summaries from transcripts | USA | Data is not used to train models under my subscription |
| Complianz | Cookie consent banner | runs on my server | Your consent choice is stored only in your browser |
FluentCRM, Fluent Forms, H5P, the course platform and the Notes panel all run on my own server; nothing from them is sent to a third party.
Where a provider is outside the EU, transfers rest on the EU–US Data Privacy Framework or on the European Commission’s standard contractual clauses.
5. How long I keep data
| Data | Kept for |
|---|---|
| Server and security logs | 30 days |
| Account, profile, learning data, notes | While you have an account; deleted within 12 months of your last login or on request |
| Lesson recordings | Until the summary is written, then deleted |
| Invoices and payment records | 10 years (Czech tax law) |
| Messages and contact forms | 3 years |
| Cookie consent choice | 365 days, in your browser |
6. Your rights
Under the GDPR you can:
- see the data I hold about you and get a copy;
- correct anything that is wrong — most of your profile you can edit yourself under “My details”;
- delete your data (“right to be forgotten”), unless I must keep it for tax reasons;
- limit how I use it, or object to processing based on legitimate interest;
- take your data with you in a common file format;
- withdraw consent at any time (for cookies, neurodiversity information, recordings or newsletters) — this does not affect what was done before you withdrew it.
To use any of these, email alex@alexi.cz. I will answer within one month. I may ask you to confirm your identity first.
If you are not happy with how I handle your data, you can complain to the Czech supervisory authority:
Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, www.uoou.gov.cz, posta@uoou.gov.cz.
7. Children
My courses are for working adults. I do not knowingly collect data from anyone under 16. If you think a child has given me data, write to me and I will delete it.
8. Security
The site runs over HTTPS. Passwords are stored encrypted. Access to the admin area is protected by a firewall and limited to me. Daily backups are kept with Hostinger for 7 days. No system is perfectly secure, so if I ever learn of a breach that affects you, I will tell you and the authority as the law requires.
9. Changes to this policy
I will update this page when something changes and put the new date at the top. For big changes I will also email account holders.
