Privacy Policy
[BRACKETED] value and have a qualified lawyer review this before publishing. This document is not legal advice.1Controller
The data controller is [LEGAL ENTITY NAME], [registered address], [country]. Contact: [PRIVACY EMAIL].
2Data we collect
| Category | Examples | Source |
|---|---|---|
| Account | Name, email address, profile picture | Google sign-in (via Supabase Auth) |
| Content | Prompts you submit and the PRDs generated for you | You |
| Billing | Plan, subscription status, country, tax location | Paddle (we do not receive full card numbers) |
| Technical | IP, device/browser, log & usage data | Automatically |
3How we use your data
- to provide the Service (authenticate you, generate and store your PRDs);
- to process payments and manage subscriptions (via Paddle);
- to secure, maintain, and improve the Service;
- to communicate about your account and important changes;
- to comply with legal obligations.
4Legal bases (GDPR)
We process data under: performance of a contract (providing the Service), legitimate interests (security, improvement), consent (where required), and legal obligation (tax, accounting).
5Processors & sharing
We do not sell your personal data. We share it with service providers who process it on our behalf:
- Supabase — authentication and database storage of your account and PRDs.
- Vercel — hosting and serverless functions.
- Google — sign-in (OAuth).
- AI model providers — your prompt is sent to the selected model provider (e.g. via NVIDIA's API) to generate output.
- Paddle.com Market Ltd. — Merchant of Record; handles checkout, payment, tax, and billing data.
6International transfers
These providers may process data outside your country. Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses.
7Retention
We keep account and content data while your account is active. You can delete individual PRDs in the app at any time. On account deletion, associated data is removed within [X days], except records we must keep for legal or accounting reasons.
8Your rights
Subject to your jurisdiction, you may request access, correction, deletion, portability, or restriction of your data, and may object to certain processing. To exercise these, email [PRIVACY EMAIL]. You may also complain to your local data protection authority.
9Cookies & local storage
We use strictly necessary storage to keep you signed in (Supabase session) and to run checkout (Paddle). We do not use advertising cookies. [Add analytics disclosure here if you enable any.]
10Security
We use access controls and row-level security so each user can only access their own data, and rely on reputable infrastructure providers. No method of transmission or storage is 100% secure.
11Children
The Service is not directed to children under 16. We do not knowingly collect their data.
12Changes
We may update this policy; material changes will be posted here with a new date.
13Contact
Privacy questions: [PRIVACY EMAIL] · see also Contact.