Privacy policy
personal data

1. Data controller

The data controller is:

Michal Kortus
Self-employed natural person, website operator polkor.cz under the brand PoLKoR
Email: gdpr@polkor.cz
Reg. no.: 29506981
Za Podjezdem 1024/5, 725 25 Ostrava – Polanka nad Odrou

2. What personal data we process

We only process data that you provide yourself or data collected automatically when you visit the site (see Cookies and analytics below):

• Full name — when submitting a review (displayed publicly on the site)
• Review text — voluntarily submitted product comment
• Anonymized analytical data — via Google Analytics 4 (only with your consent). These are anonymised visitor behaviour data: page views, traffic sources, affiliate link clicks, device type and browser. IP address is anonymised. More information in section 8.
• Herbarium app account — when registering for the Herbarium web app (herbar.polkor.cz) we process the email address, account status (trial / paid access) and trial expiration date. This data is stored in the Supabase operator database (see section 5).
• Plant photographs — if you use the plant identification feature, the photo is sent to PlantNet and Google Gemini servers for plant species recognition. The photo is not stored on our servers. The photo is not stored on our servers.
• Menstrual calendar and contraception — if you use the calendar, we store the entries you add to your account: bleeding days, symptoms, moods, notes and cycle settings. If you set up contraception and reminders, we also store the plan (type, first day of the pack, reminder time), intake records and the technical address of your device for sending notifications. This is health data. Notifications have a neutral text with no mention of medication.
• App data stored locally — herbal diary, favourite herbs, quiz progress, created fitness plan and the plant identification history (a downscaled photo thumbnail, suggested species and date) are stored exclusively in your browser's local storage (localStorage, IndexedDB) and are not transmitted to any server. You can delete the identification history at any time in the app.

We do not process national identification numbers, payment data, location or other sensitive categories of personal data.

3. Purpose and legal basis for processing

• Contact form — purpose: reply to your query or suggestion. Legal basis: legitimate interest of the controller (Art. 6(1)(f) GDPR) — communication with persons who initiate contact. Data is retained for the period necessary to handle the query.
• Reviews — purpose: publication of user review on the site. Legal basis: consent given by submitting the form (Art. 6(1)(a) GDPR).
• Analytical data (Google Analytics 4) — purpose: traffic measurement and site content improvement. Legal basis: consent given via the cookie banner (Art. 6(1)(a) GDPR).
• Newsletter — purpose: sending news, tips and product information to email. Legal basis: consent given by submitting the signup form (Art. 6(1)(a) GDPR). Consent can be withdrawn at any time by emailing info@polkor.cz.
• Herbarium app account — purpose: user account management, access status verification (trial / paid). Legal basis: contract performance (Art. 6(1)(b) GDPR).
• Plant identification from photo — purpose: plant species recognition using AI. The photo is sent to an external API (PlantNet, Google Gemini) exclusively for this purpose and is not stored. Legal basis: consent expressed by using the identification feature (Art. 6(1)(a) GDPR).
• Menstrual calendar and contraception — purpose: providing the calendar's features (cycle tracking, forecasts, reminders). Legal basis: explicit consent to the processing of health data (Art. 6(1)(a) and Art. 9(2)(a) GDPR), which you give when registering or when you first open the calendar, and for contraception when you set it up. You can withdraw consent at any time by deleting the plan in the app or by email to gdpr@polkor.cz.

4. How long we retain data

• Reviews — until you request their removal or until we delete them during moderation.
• Analytical data — the default retention period in Google Analytics 4 is 14 months.
• Newsletter (e-mail) — for the duration of consent, at most until unsubscribing or withdrawing consent.
• Herbarium app account — for the duration of the account. After cancellation or non-renewal of access, data is deleted within 90 days.
• Plant photographs (identifikace) — are not stored. Processed immediately and then discarded.
• Menstrual calendar and contraception — for the duration of the account. You can delete the contraception plan and intake records at any time in the app, other entries on request. After the account is cancelled, the data is deleted within 90 days.

5. Recipients of personal data

We do not share your personal data with third parties for marketing purposes nor do we sell it. Data may only be disclosed to:

• To technical service providers necessary for site operation (hosting, email platform) — always based on a processing agreement.
• GoPay s.r.o. (Reg. no.: 26046768, Plana nad Luznici) — payment gateway processing payments for digital products (e-books, guide). GoPay processes payment data as an independent controller according to its own privacy policy — see GoPay Privacy policy.
• Web3Forms (web3forms.com, operator: Nicepage Inc.) — technical service for processing data submitted via site forms (contact form, review form, newsletter signup). Web3Forms processes submitted data as a processor under a processing agreement. See Web3Forms Privacy Policy.
• Supabase (Supabase Inc., USA) — cloud database and authentication service for the Herbarium app. Stores email address, access status, trial date and the Menstrual calendar entries (including health data). Supabase is certified under the EU–US Data Privacy Framework. See Supabase Privacy Policy. We also use the same database for internal records of which email, when and for what purpose (newsletter, contact form, Herbarium registration) we obtained processing consent — it serves solely to document consent under GDPR and is not publicly accessible.
• PlantNet (CIRAD / INRAE / INRIA, Francie) — API for plant identification from photos. The photo is sent for the purpose of identification a PlantNet processes it according to its own terms. See PlantNet Privacy Policy.
• Google Gemini API (Google LLC, USA) — API for verifying and refining plant identification results. The photo is sent for analysis. Google processes it according to its own terms. See Google Privacy Policy.
• Notification delivery services (Google, Apple, Mozilla or Microsoft, depending on your device's browser) — they pass an encrypted message with a neutral text to your device. They do not know the content of your plan.
• To state authorities if required by law.

6. Transfers of data outside the EU

The site loads fonts from Google Fonts (Google LLC servers, USA). Google is certified under the EU–US Data Privacy Framework, which ensures an adequate level of protection.

For traffic measurement (only with your consent) we use Google Analytics 4 (Google LLC, USA) and for protecting forms against spam and bots Cloudflare Turnstile (Cloudflare, Inc., USA). Both providers are certified under the EU–US Data Privacy Framework, which ensures an adequate level of protection.

App Herbarium uses services Supabase (USA) for account management and Google Gemini API (USA) pro plant identification from photos. Both providers are certified under the Data Privacy Framework EU–USA. Fotografie sent k identifikaci is not Operatorem stored. Notification delivery services may be operated outside the EU (e.g. in the USA). The messages are encrypted and contain no health data.

7. Your rights

As a data subject you have the right to:

• To access — find out what data we process about you.
• Na repair — have inaccurate data corrected.
• Na deletion — request deletion of your data ("right to be forgotten").
• Upon withdrawal of consent — at any time and without giving a reason, without affecting the lawfulness of processing before withdrawal.
• To portability — receive your data in a machine-readable format.
• File a complaint — at the Office for Personal Data Protection (DPA), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.

To exercise your rights contact us at: gdpr@polkor.cz

We will respond to your request within 1 month of receiving it (in accordance with Art. 12(3) GDPR).

8. Cookies and analytics

The site uses the following cookies:

Technical cookies — Google Fonts (font loading). They are essential for correct site display and do not require consent.

Analytics cookies — Google Analytics 4 — I use Google Analytics 4 (operator: Google LLC, USA) for site traffic measurement. This service stores anonymised visitor behaviour data (page views, traffic sources, affiliate link clicks). Data is processed based on your consent given via the cookie banner. IP address is anonymised. More information: Privacy policy privacy Google.

You are informed about cookie usage on your first visit via the cookie banner, where you can decline analytical cookies.

9. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse. The site operates over a secure HTTPS connection.

10. Changes to this policy

We may update this policy from time to time. We will inform about significant changes with a notice on the site. The date of the last update is stated at the top of the document.