Privacy notice

Last updated: 27 October 2026

This notice explains what personal data CorviNotes stores, why, and how you can see or delete it. We keep it to the minimum the site needs.

Who is responsible

The data controller is Koppány Leé, who runs CorviNotes as an independent student project (not run by Corvinus University). Contact for any privacy question: contact@corvinotes.hu.

What we store

Your account: your Corvinus email address, an internal user ID, whether you are a student or the admin, and when you signed up.
Sign-in records: when you signed in and the IP address used, kept by our sign-in provider for security.
Your uploads: the PDF files and their title, course, group, size and date, linked to your user ID so you can delete them. Other students never see who uploaded a note.
Reports you send: the note, the reason, any details you write, and your user ID (seen only by the admin).
Downloads: which notes you downloaded and when, used only for overall statistics.

We do not use advertising, tracking or analytics cookies. The site only sets the cookies needed to keep you signed in, so it does not ask for cookie consent.

Why we use it (legal basis)

To provide your account, uploads and downloads: this is needed to run the service you signed up for (GDPR Art. 6(1)(b)).
To keep the site safe, handle reports and removal requests, and see overall usage: our legitimate interest in running a lawful, safe service (GDPR Art. 6(1)(f)).

Who processes it for us

Supabase: database and sign-in, hosted in the EU.
Cloudflare: runs the website and stores the PDF files, which are kept in the EU.
Resend: sends the sign-in code emails, from the EU.

These providers only process data on our behalf. Some are based in the United States; any transfer there is covered by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. We never sell your data or share it with anyone else, unless the law requires it.

How long we keep it

We keep your data while your account exists. Notes you delete are removed straight away, including the PDF file. When your account is deleted, your profile, uploads, reports and download records are deleted with it.

Your rights

You can ask to see a copy of your data, correct it, receive it in a portable format, object to its use, or have it deleted. Email contact@corvinotes.hu from your Corvinus address and we will reply within one month.

Deleting your account: email contact@corvinotes.hu from your Corvinus address with the subject "Delete my account". You can remove individual notes yourself at any time under My uploads.

If you think we handle your data unlawfully, you can complain to the Hungarian data protection authority, NAIH (naih.hu).