Privacy policy

1. Controller

The controller of personal data processed on NationsTree.org is Event Space Sp. z o.o., ul. Kanarkowa 47, 11-041 Olsztyn, Poland, KRS 0001210621, NIP 7394025935. Contact for all privacy matters: [email protected] or the contact form.

2. Browsing without an account

Public pages can be read without giving any personal data. There is no advertising, no third-party analytics and no tracking pixels. The web server keeps technical logs (IP address, time, requested address, browser) for up to 14 days for security and error diagnosis (legitimate interest, Art. 6(1)(f) GDPR). Traffic passes through Cloudflare, which protects the site against attacks.

Counters of shares and sign-ups store only a one-way hash of the IP address, never the address itself.

3. Account

An account is optional. It stores the e-mail address, a display name, and — when signing in with Google — the Google account identifier and profile picture address. It also stores the date of the last sign-in, the followed countries, the preferred language and, if created, a one-way hash of the API key (the key itself is never stored). Legal basis: performance of the service requested (Art. 6(1)(b) GDPR). Sign-in with Google uses only the scopes openid, email and profile; no other Google data is accessed.

The account can be deleted at any time on the account page; the data listed above is then erased immediately, except records of payments (section 4).

4. Contributions (supporting a tree)

Payments are processed by Stripe Payments Europe, Ltd. (Dublin, Ireland). Card details are entered on Stripe’s page and never reach NationsTree. NationsTree stores the amount, currency, chosen country, payment status, the Stripe session reference, the e-mail address for the confirmation and the language. Legal basis: performance of the contract (Art. 6(1)(b)) and accounting obligations (Art. 6(1)(c) GDPR). Payment records are kept for 5 years after the end of the year of payment, as required by Polish tax law.

Totals per country are published on the transparency page without names or e-mail addresses. The planting partner receives money transfers only, not personal data of contributors.

5. Contact form and notification list

Messages sent through the contact form (name, e-mail address, message, topic, page) are kept for up to 2 years to answer and follow up the matter. An e-mail address left to be notified when payments open is used for that one message only and then deleted.

6. E-mail

Sign-in links, payment confirmations and replies are sent through Resend (Resend, Inc.) as the e-mail delivery provider.

7. Cookies and local storage

Cookies are set only when signing in or starting a payment: a session cookie and a security (CSRF) cookie, both strictly necessary, plus nt_in, which only tells the page that a session exists. Preferences such as the time of day, the view of the forest or the countries chosen for comparison are kept in the browser’s local storage and never sent to the server. No consent banner is needed because no non-essential cookies are used.

8. Recipients and transfers

Data is hosted on servers in the European Union. Processors: the hosting provider (EU), Cloudflare, Inc., Stripe, Google (sign-in only, when chosen) and Resend. Where a processor is located outside the EEA, transfers rely on the EU–US Data Privacy Framework or standard contractual clauses.

9. Rights

Data subjects have the right of access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland. Requests: [email protected]; an answer follows within one month.

10. Changes

Changes to this policy are published on this page with a new date.