Privacy Policy

01 — Who we are

Jasse ("we," "us," "our") is a lifestyle brand and technology platform based in Poland. We curate vintage watches and jewelry, host a community for those interested in style, kindness, and self-improvement, and provide educational scheduling tools including Jasse Tutoring across jasse.pl and dedicated subdomains.

The data controller, in the meaning of Regulation (EU) 2016/679 (GDPR), is Jasse, reachable at jassebusiness@gmail.com.

02 — What we collect

We collect only what is necessary to run our operation. Specifically:

Information you give us directly

• Your name and email address when you write to us or book a tutoring lesson
• Postal address and order details if you purchase a watch through Vinted, Instagram DMs, or directly from us
• Lesson reservation information: student name, student email, subject, and appointment timestamps
• Any message content you send us

Information collected for Jasse Tutoring (Google Calendar API)

When tutors connect their Google Calendar to Jasse Tutoring via OAuth 2.0 (using the https://www.googleapis.com/auth/calendar.events scope), our application accesses:

• OAuth Refresh and Access Tokens — stored securely and encrypted in our database to maintain automated calendar synchronization.
• Calendar Event Availability — start and end times of existing events on the tutor's calendar to calculate free/busy slots and prevent double-booking. We do not inspect, collect, or store personal contents of unrelated calendar events.
• Lesson Booking Events — event identifiers and details created specifically by our service for confirmed tutoring appointments.

Information collected through social-media platforms

To publish posts to our own social-media accounts, we use a self-hosted scheduling tool (Postiz) that connects to the official APIs of Meta (Instagram, Facebook), Pinterest, and TikTok. Through these APIs, the tool stores on our private server our own credentials, scheduled post content, and public engagement metrics. We do not collect, store, or process data belonging to other users beyond what is publicly displayed on our own posts.

Information collected automatically

• Basic server logs (IP address, browser type, pages visited) for security and to understand site stability. Logs are retained for 30 days, then deleted.
• We do not currently use analytics services like Google Analytics.

03 — How we use your data

We use the data we collect only for these purposes:

• To reply to messages you send us
• To fulfil orders for watches or jewelry you purchase from us
• To manage tutoring appointments and automatically create, update, or cancel calendar events in the tutor's Google Calendar upon student booking or rescheduling
• To calculate real-time tutor availability and prevent double-booking
• To publish and schedule posts on our own social-media accounts
• To keep the website secure (server logs)

We do not sell your data. We do not share it with advertisers. We do not use it for automated decision-making or profiling.

Google API Services User Data Policy Compliance (Limited Use)

Jasse Tutoring's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We only use Google Calendar data to provide and improve user-facing scheduling features.
• We do not transfer or disclose Google user data to third parties, except as strictly required to provide the scheduling service or comply with applicable laws.
• We do not use Google user data for serving advertisements, personalized marketing, or retargeting.
• We do not allow humans to read Google user data unless we have explicit consent for troubleshooting, it is necessary for security, or required by law.
• We do not use Google user data to train AI/ML models.

04 — Legal basis (GDPR)

Under Article 6 of the GDPR, we rely on the following legal bases: Consent, Contract performance, Legitimate interest, and Legal obligation.

05 — Third-party platforms

To operate Jasse, we use: Google LLC (Google Calendar API), Meta Platforms (Instagram, Facebook), Pinterest, TikTok, Vinted, Resend (transactional emails), and Hetzner Online GmbH (EU-hosted servers in Finland & Germany).

06 — How long we keep data

• Order records: 5 years (tax law requirement)
• Email correspondence: 12 months after the last reply
• Tutoring lesson records: 12 months from completion
• Google OAuth tokens: stored securely until disconnected by the tutor
• Server logs: 30 days

07 — Your rights

Under the GDPR, you have the right to access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. You can also lodge a complaint with the Polish supervisory authority (UODO at uodo.gov.pl). To exercise any rights, contact jassebusiness@gmail.com.

08 — Security

Our website runs over HTTPS with TLS 1.3 encryption. Access tokens are encrypted at rest. We use strong unique credentials and multi-factor authentication across all administration channels.

09 — Data deletion

You can request deletion of personal data at any time by emailing jassebusiness@gmail.com. Tutors can disconnect Google Calendar in /tutor by clicking "Rozłącz kalendarz", which immediately and permanently deletes the stored OAuth tokens.

10 — Changes to this policy

When changes are made, we update the "last updated" date at the top. Continued use signifies acceptance of the revised policy.

11 — Contact

Email jassebusiness@gmail.com. We read every message and reply ourselves.