Privacy Policy

Last updated: 2026-10-27

This policy explains what personal data we process when you use kriti.life and its sections — the news site (www.kriti.life), Kouzina (kouzina.kriti.life), Kafeneion (blog.kriti.life), Lexi (lexi.kriti.life) and the shared accounts service (accounts.kriti.life) — why we process it, and the rights you have under the EU General Data Protection Regulation (GDPR).

1. Who is responsible

The controller for the processing described here is Alexander Graefe (grafeio.IT), contactable at [email protected]. Our full postal address and provider details are in the Legal notice.

We have not appointed a Data Protection Officer; we are not required to. Data-protection questions go to the address above.

2. The data we process, and why

Providing an email address and a password is necessary to open an account; without them we cannot create one. Everything else below is either part of a feature you choose to use, or optional — analytics runs only if you accept it. We do not make automated decisions that produce legal or similarly significant effects about you.

Account data

If you register at accounts.kriti.life we store your email address, a one-way hash of your password (scrypt — we never store the password itself), your display name, your preferred language, an account tier, and the dates your account and its changes were made. We use this to create and run your account and to sign you in across all kriti.life sections. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Sign-in cookies

When you sign in we set a signed cookie (kriti_session) scoped to .kriti.life so you stay signed in across the sections without signing in again; it lasts up to 30 days. Staff who open an admin area also get a short-lived kriti_admin_session cookie (12 hours). These are strictly necessary for the service and are not used for tracking. Legal basis: Art. 6(1)(b); no consent is required for strictly necessary cookies.

Signing in with Google or Facebook

If you choose "Sign in with Google" or "Continue with Facebook", the provider sends us your name, email address and a provider-specific user ID. We store the user ID and link it to your account so we can recognise you next time. We do not post anything to those accounts and request only basic profile and email scopes. Legal basis: Art. 6(1)(b) and your request (Art. 6(1)(a)).

Email we send you

We send transactional email only — address confirmation, password reset, email-change confirmation and notices, and an account-deletion notice. These are delivered through Resend (Resend, Inc.), which processes the recipient address and message content on our behalf. Legal basis: Art. 6(1)(b) and our legitimate interest in account security (Art. 6(1)(f)).

Lexi learning history

If you use lexi.kriti.life, we store your practice sessions and progress, keyed to your account email, so the app can show your history and adapt exercises. Legal basis: Art. 6(1)(b).

Analytics

We use Google Analytics 4 to understand, in aggregate, how the sites are used. It runs only after you accept analytics cookies in the banner; until then no analytics data is collected. IP addresses are truncated (anonymised) before storage and we do not use Google Analytics for advertising. You can change your choice at any time via Cookie preferences in the footer. Legal basis: your consent (Art. 6(1)(a)), which you may withdraw at any time.

Server logs

Our web server records each request — IP address, date and time, the URL requested, referrer and browser user-agent — to keep the service secure and diagnose faults. These logs are held for a short period and then deleted or rotated. Legal basis: our legitimate interest in the security and stability of the service (Art. 6(1)(f)).

Content delivery and protection (Cloudflare)

All traffic to kriti.life passes through Cloudflare, which provides content delivery and protection against attacks. Cloudflare processes connection data, including your IP address, as our processor. Legal basis: Art. 6(1)(f).

3. Cookies and local storage

4. Who we share data with

We do not sell your data. We use these processors, each under a data-processing agreement:

• Hetzner Online GmbH (Germany) — server hosting.
• Cloudflare, Inc. — content delivery, security, and image storage (Cloudflare R2).
• Google LLC — Google Analytics (only with consent) and, if you use it, Google sign-in.
• Meta Platforms, Inc. — only if you use Facebook sign-in.
• Resend, Inc. — delivery of transactional email.

We may also disclose data where required by law.

5. International transfers

Some of these providers are established in the United States. Where data is transferred outside the European Economic Area, it is protected by the European Commission's Standard Contractual Clauses and/or the provider's certification under the EU–US Data Privacy Framework.

6. How long we keep your data

Account data is kept until you delete your account, after which it is removed from the live systems. Learning history is deleted with the account. Server logs are kept for a short period as above. Encrypted backups are retained for up to 90 days for disaster recovery; data you have deleted may persist in a backup until that backup is rotated out, after which it is permanently gone.

7. Deleting your data

You can delete your account yourself at any time: sign in, go to Settings, and use "Delete my account". This permanently removes your account, any linked Google/Facebook sign-in, and your Lexi learning history from our live systems (backups age out as described in section 6). You can also ask us to do it by emailing [email protected].

8. Your rights

Under the GDPR you have the right to access your data, to have inaccurate data corrected, to have your data erased, to restrict or object to processing, and to data portability. Where processing is based on consent, you can withdraw it at any time without affecting processing already carried out. To exercise any of these, email [email protected] — most can also be done directly in your account Settings.

You also have the right to lodge a complaint with a data-protection supervisory authority, in particular Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα) (https://www.dpa.gr).

9. Children

kriti.life is not directed at children and we do not knowingly collect data from children below the age of digital consent in their country. If you believe a child has given us personal data, contact us and we will delete it.

10. Changes to this policy

We may update this policy; the "last updated" date above always reflects the current version. If a change materially affects you and you have an account, we will tell you.

11. Contact

Questions about this policy or your data: [email protected].