Effective date: October 17, 2026

1. Controller

The controller of your personal data is MATEUSZ DURAJ, sole proprietorship, ul. Tetmajera 6a, 34-700 Rabka-Zdrój, Poland, NIP 7352615394, REGON 383081941, email support@aipromptagent.ai ("we"). We have not appointed a Data Protection Officer. Contact us at the email above about any privacy matter.

2. What data we collect and why

• Processing your order, delivering files, memberships, customer support, complaints
  Data: name, email, country, order details, payment status (no full card number), messages you send us
  Legal basis (GDPR): contract, Art. 6(1)(b)
  How long: for the duration of the contract, then until claims expire (generally up to 6 years)

• Evidence of your checkout consent and of delivery: checkbox consent, confirmation email, download logs
  Data: date and time of consent, IP address, browser/device data, confirmation email sent, download date/time/IP and count
  Legal basis (GDPR): legal obligation to confirm the waiver on a durable medium, Art. 6(1)(c); our legitimate interest in proving delivery and the consent and defending payment disputes and claims, Art. 6(1)(f)
  How long: until claims and payment disputes can no longer be raised (generally up to 6 years)

• Checking where you buy from (we don't accept orders from Mexico or Brazil) and sanctions compliance
  Data: country, billing country, card-issuing country, IP-based country
  Legal basis (GDPR): legitimate interests, Art. 6(1)(f); legal obligation where sanctions apply, Art. 6(1)(c)
  How long: as for order data

• Accounting and tax records (invoices, VAT/OSS evidence of your country)
  Data: name, email, country, IP-based or card-issuing country, amount, date
  Legal basis (GDPR): legal obligation, Art. 6(1)(c)
  How long: 5 years from the end of the tax year (10 years for EU OSS VAT records)

• Newsletter and free lead magnet (e.g. "25 Viral Prompts")
  Data: email, first name (optional), language, opens/clicks
  Legal basis (GDPR): your consent, Art. 6(1)(a)
  How long: until you unsubscribe (link in every email)

• Site analytics and ads measurement (only if you accept cookies)
  Data: cookie IDs, pages viewed, device and browser data, approximate location
  Legal basis (GDPR): your consent, Art. 6(1)(a)
  How long: per cookie; see the cookie banner

• Site security and fraud prevention
  Data: IP address, logs, transaction data
  Legal basis (GDPR): our legitimate interests, Art. 6(1)(f)
  How long: up to 12 months for logs, longer if needed for a claim

Providing data is voluntary, but we need your email and payment details to sell and deliver a product.

3. Who receives your data

We share data only as needed, with these recipients or categories of recipients (we'll tell you the exact provider names on request):

• Hostinger (website and store hosting);

• Stripe (Stripe Payments Europe, Limited: payments, fraud prevention, payment disputes). Stripe acts partly as our processor and partly as an independent controller for its own legal obligations (see stripe.com/privacy);

• our email delivery and newsletter provider (sends order emails and, if you subscribed, the newsletter);

• analytics and advertising providers (e.g. Google Analytics, Meta Pixel), only after you consent to cookies;

• our accountant (Biuro Mika);

• banks and card networks, when a payment is disputed (order record, consent and download logs, see Section 2);

• public authorities, where the law requires it.

We don't sell your personal data.

4. Transfers outside the EEA

Some providers (e.g. Stripe, Google, Meta) may process data in the USA or other countries. We rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses. For UK users, we rely on the UK adequacy regulations and the UK Addendum/IDTA. You can ask us for a copy of the safeguards.

5. Your rights (GDPR / UK GDPR)

You have the right to access, correct, delete, restrict and port your data, to object to processing based on legitimate interests, and to withdraw consent at any time. Withdrawing consent doesn't affect earlier processing. To exercise these rights, email support@aipromptagent.ai. We reply within one month.

You can also complain to a supervisory authority:

• in Poland, the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl;

• the authority in the EU/EEA country where you live (e.g. AEPD in Spain, CNPD in Portugal);

• in the UK, the ICO (https://ico.org.uk).

6. US privacy notice (including California)

Do Not Sell or Share My Personal Information.

• We do not sell your personal information, and we have not sold it in the past 12 months.

• We do not "share" it for cross-context behavioral advertising unless you opt in to marketing cookies. You can opt out at any time via "Cookie Settings" / "Your Privacy Choices" in the site footer.

• We treat a Global Privacy Control (GPC) signal from your browser as a valid opt-out request where our tools support it.

• We do not knowingly sell or share data of consumers under 16.

Notice at collection.

• Categories we collect: identifiers (name, email, IP address); commercial information (orders, payments, downloads); internet activity (pages viewed, only with cookie consent); approximate geolocation (country); and your communications with us.

• Purposes and retention: listed in Section 2.

• Sensitive personal information: we don't collect or use it for inferring characteristics.

Your rights (California and other states with privacy laws, e.g. Colorado, Connecticut, Virginia, Texas). Depending on your state, you may ask us to:

• know or access the personal information we hold about you;

• correct it;

• delete it (subject to legal retention duties);

• receive a portable copy;

• opt out of sale, sharing or targeted advertising.

Email support@aipromptagent.ai (subject: "Privacy request"). We'll verify your request using the email address on your order and respond within 45 days. You may use an authorized agent. If we deny your request, you may appeal by replying to our decision. We will not discriminate against you for using these rights.

California "Shine the Light": we don't disclose personal information to third parties for their own direct-marketing purposes.

We are a small Polish business and may not meet the thresholds of the CCPA/CPRA or other state laws, but we apply these commitments to all US customers.

7. Cookies and similar technologies

• Necessary cookies run the site, the cart and the checkout, and keep it secure. They are always on.

• Analytics cookies (e.g. Google Analytics) and marketing cookies/pixels (e.g. Meta Pixel) are set only if you accept them in the cookie banner. They help us understand which pages work and measure our ads.

• Your choices: you can accept, reject or customize cookies in the banner, and change your choice at any time via "Cookie Settings" in the footer. You can also block or delete cookies in your browser settings, but parts of the site may then stop working.

• Do Not Track: browsers' "Do Not Track" signals have no common standard, so we rely on your cookie choices and GPC instead.

• Stripe sets its own cookies on the checkout page for fraud prevention and security.

8. Automated decisions

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. Stripe uses automated fraud checks and may block payments from countries we don't serve. Contact us if your payment was blocked.

9. Children

Our products are not intended for anyone under 16, and we don't knowingly collect their data. Purchases are for adults (18+) or with a parent's or guardian's consent.

10. Security

We use HTTPS, reputable providers and limited access to data. No system is 100% secure. We will notify you and the authorities of a serious breach as the law requires.

11. Changes

We may update this policy. The current version and its date are always on this page.

Privacy Policy