Contents · 10 sections
Version of 28 October 2026. This policy explains what personal data gregciupek.com ("The Online Empire") processes, why, on what legal basis and for how long. The publisher is a company in Poland, so the EU General Data Protection Regulation (GDPR) applies to all readers, wherever they live.
1. Controller
The controller of personal data collected on gregciupek.com is JG INVEST Prosta Spółka Akcyjna (a Polish simple joint-stock company), ul. Jana Matejki 2, 32-600 Oświęcim, Poland, entered in the Polish National Court Register (KRS) under number 0000915798, tax ID (NIP) 5492463888 (the "Controller", "we"). Contact for anything about personal data: privacy@gregciupek.com. We have not appointed a data protection officer.
2. What data, why and on what basis
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Sending The Empire Report newsletter | email address, chosen interests, the wording and date of your consent, IP address at sign-up and confirmation, information about opened emails and clicked links | consent: Art. 6(1)(a) GDPR, and Art. 398 of the Polish Electronic Communications Law for sending commercial email | until you withdraw consent; the record of your consent for the limitation period for claims |
| Connected apps and AI agents (OAuth sign-in): access by an app you choose to your Empire Report subscription | email address, the app's name (as given by the app itself), scope of access, dates of consent and last use, and, if you tick the newsletter consent on the consent screen, the time and IP address of that consent; tokens, codes and sign-in links stored only as keyed hashes (HMAC); in the security log a pseudonym instead of your email and a hash of the IP address | providing the service you request: Art. 6(1)(b) GDPR; the newsletter itself: consent (as above); the security log: our legitimate interest in preventing abuse, Art. 6(1)(f) GDPR | until you revoke access, or after 6 months without use; after revocation we delete the record within 30 days; sign-in codes and links 15 minutes; security log 90 days |
| Free Telegram channel and group: moderation (link filter, spam removal) and welcome messages by our bot | Telegram account ID, username and display name, the text of messages in the group (checked when sent, not stored); the bot's technical log keeps the last 60 events | legitimate interest (order and safety in the chats): Art. 6(1)(f) GDPR | messages are not stored; the technical log is overwritten continuously (last 60 events) |
| Premium Telegram group (Empire Insider): granting and removing access, a reminder before the paid period ends | email address, Telegram ID, username and display name, the paid access period, where the access came from, the reminder date; the one-time link that connects your account stored only as a hash (SHA-256) | performance of a contract: Art. 6(1)(b) GDPR | for as long as you have access, then for the limitation period for claims and accounting obligations |
| Publishing comments and questions under articles, replying to them, moderation and spam protection | name or nickname, email address (never published), comment text, date and time, a hash of the IP address, reports from other readers | our legitimate interest (running and protecting discussion on the site): Art. 6(1)(f) GDPR | for as long as the page the comment is under exists, or until you ask us to delete it; IP hash 180 days; comments marked as spam 30 days |
| Email notifications about replies to your comment (if you tick that option) | email address, status and date of confirmation | consent: Art. 6(1)(a) GDPR | until you unsubscribe; unconfirmed requests are deleted after 14 days |
| Handling reports about comments, including notices of illegal content (Art. 16 of the EU Digital Services Act) | the reason and explanation of the report, optionally the reporter's email address, a hash of the IP address and browser with a salt that changes daily | legal obligation: Art. 6(1)(c) GDPR together with Art. 16 of Regulation (EU) 2022/2065 (DSA); legitimate interest: Art. 6(1)(f) GDPR | until the report is handled, then for the limitation period for claims |
| Replying to your email | email address, name, message content | our legitimate interest: Art. 6(1)(f) GDPR | until the matter is closed, then for the limitation period for claims |
| Security and operation of the site | IP address, date and time, page address, browser type (server logs) | legitimate interest: Art. 6(1)(f) GDPR | for the server log rotation period needed to detect abuse |
| Visit statistics (Google Analytics 4), only after you consent in the banner | cookie identifiers, IP address (truncated by Google), device and browser information, pages visited, clicks on links, newsletter sign-ups | consent: Art. 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law (storing information on your device) | until you withdraw consent; data in Google Analytics up to 14 months |
| Click statistics for partner links | the number of clicks on a given link, never linked to a person | legitimate interest: Art. 6(1)(f) GDPR | indefinitely, as totals only |
Giving us your data is voluntary. Without an email address we cannot send you the newsletter or reply to your message.
3. Newsletter: how sign-up works
Sign-up has two steps (double opt-in). After you enter your address, we send one email with a confirmation link valid for 3 days. Only clicking that link activates the subscription. Unconfirmed sign-ups are deleted after 7 days. You can withdraw consent at any time with the link at the bottom of every email or by writing to privacy@gregciupek.com. Withdrawing consent does not affect the lawfulness of emails sent before.
The newsletter is run with NetSendo, a mailing tool hosted for us on Google Cloud infrastructure, and sent through Twilio SendGrid. Emails come from newsletter@gregciupek.com.
Connected apps and AI agents
You can allow an app or an AI agent (for example an assistant you use, connected to our MCP server) to check whether you subscribe to The Empire Report, subscribe you with the topics you choose, change them or unsubscribe you. You sign in without a password: we send a one-time link and a 6-digit code to your address, valid for 15 minutes. Then the consent screen shows the app's name (as given by the app itself), the address it will return to, and the scope of access. Access is created only after you click "Allow". The app receives a short-lived token (1 hour) and a refresh token; we store them only as hashes, so they cannot be read from our database. The app never receives your email address from us.
If you are not subscribed, the app can subscribe you only if you tick the newsletter consent on the consent screen (the same wording as on the sign-up form). Clicking the sign-in link from your email proves the address is yours, so in that case we do not send a separate confirmation link. We record the wording and time of the consent, the IP address you ticked it from, and the app's name as the source of the subscription. Without that consent the app gets read-only access. We email you when an app subscribes you.
After every new connection we email you a link to the "Your connected apps" page, where you can revoke access with one click (it takes effect immediately). Revoking access does not unsubscribe you from the newsletter: use the link in any issue for that. During sign-in we set a technical cookie, __Host-oe_oa_b (2 hours), which ties the sign-in to your browser; it is strictly necessary for secure sign-in and is not used for tracking.
4. Comments, questions and reply notifications
You can leave a comment or ask a question under articles. Only the name or nickname you give, the text and the date are public. We never publish your email address: it is used for moderation, for contacting you about the comment and, if you tick that option, for reply notifications. Name and email are optional. We do not use Gravatar or any third-party comment system: the data stays on our server in the European Union.
We store your IP address only as a hash with a secret key. That lets us detect spam and comment floods from one place, but not read the address. The hash is deleted after 180 days. "Helpful" votes and reports are anonymous: to prevent abuse we compute a hash of the IP address and browser with a salt that changes daily, so votes cannot be linked across days. Your browser remembers locally (localStorage) that you have voted, and also the name and email from the form so you do not have to type them again.
Reply notifications are sent only after you confirm your address with a link from an email (the first time you use it). Every notification has a one-click unsubscribe link. This is not the newsletter: subscribing to The Empire Report is a separate, voluntary consent (the box in the comment form starts the normal double opt-in described in section 3).
Moderation. We approve the first comment from each email address by hand. Comments with referral codes or affiliate links, with more than one link to sites outside our fleet and official government pages, or with profanity go to moderation automatically. After three reports from readers, a comment is hidden until a moderator decides. You can report illegal content with the "Report" button under a comment (a notice under Art. 16 DSA) or at editor@gregciupek.com.
Deleting a comment. Write to privacy@gregciupek.com from the address you used for the comment and tell us which one it is, and we will delete it along with your data. Discussion rules: gregciupek.com/discussion-rules.
5. Who receives the data
- our hosting, email and server infrastructure provider (servers in the European Union), under a data processing agreement;
- NetSendo, the newsletter tool, running on Google Cloud infrastructure, and the email delivery provider Twilio SendGrid, under data processing agreements;
- Google Ireland Ltd. for Google Analytics 4, only if you consent;
- authorities entitled by law, when they request it.
Our Telegram channel and groups run inside the Telegram messenger. Telegram processes its users' data as a separate controller, under its own privacy policy (telegram.org/privacy). Our bot only sees what Telegram passes to bots that administer a chat.
We do not sell personal data and we do not share it with affiliate partners. For readers in California and other US states with similar laws: we do not "sell" or "share" personal information for cross-context behavioral advertising, and we run no ads or remarketing.
6. Partner links
When you click a partner link, you go to another company's website. From that moment that company decides about its cookies and data processing, under its own privacy policy. Our site only redirects you and does not pass on your email address or any other data.
7. Cookies and statistics
Strictly necessary. The site stores in your browser (localStorage) your choice in the consent banner, your color theme and whether you closed the newsletter bar, so it does not show you the same thing again. The admin dashboard uses session cookies, and connected-app sign-in uses the __Host-oe_oa_b cookie (2 hours, details). These do not require consent.
Cookieless statistics. We count visits from the server logs. Each page sends one technical request (/oe-hit.txt) that lets us tell a human browser from a bot. It stores nothing on your device and contains no identifiers. The same way, we measure in aggregate how pages are read: the page sends short /oe-ev.txt requests with the event name and page address (scroll depth, active reading time, use of the table of contents and FAQ, the choice in the consent banner, script error messages). They contain nothing you type. Our reports keep only totals, with no IP addresses. We publish the aggregate numbers on the Empire Counter.
Analytics, only with consent. If you click "Accept", we load Google Analytics 4 (provider: Google Ireland Ltd.) using Google Consent Mode v2. Until then the Google script is not loaded at all. We have turned off Google signals and ad personalization, and we run no ads or remarketing. Cookies: _ga and _ga_* (up to 2 years). You can change or withdraw consent at any time with the "Cookie settings" button in the site footer; when you withdraw, we remove the _ga cookies from your browser.
8. Your rights
You have the right to access your data, to have it corrected or erased, to restrict processing, to data portability, to object to processing based on legitimate interest, and to withdraw consent at any time. To use any of them, write to privacy@gregciupek.com; we reply within one month.
You can also lodge a complaint with a supervisory authority. Our lead authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland. If you live elsewhere in the EU, you can complain to your local authority. If you live in the UK, you can complain to the Information Commissioner's Office (ico.org.uk).
9. Transfers outside the EEA and profiling
Some of our providers (Google Cloud, Google Analytics, Twilio SendGrid) belong to groups headquartered in the US. Where data leaves the European Economic Area as a result, this happens on the basis of the European Commission's adequacy decision (the EU-US Data Privacy Framework) or standard contractual clauses. Telegram operates outside the EEA; when you join our chats you use its service on its terms, and we only send it the bot's instructions about your account (for example approving a request to join the premium group). You can get a copy of the safeguards by writing to privacy@gregciupek.com.
In the newsletter we match content to the interests you choose (starting from zero, store or company, affiliate and creators). We do not make decisions about you based solely on automated processing that would have legal or similarly significant effects.
10. Changes
We will announce material changes to this policy on this page, and to newsletter subscribers by email as well.