Privacy Policy
Draft - pending legal review. This document has not yet been reviewed by a lawyer and may change before it takes effect.
This policy explains how we process personal data when you use Jantaris Studio, the Jantaris API and the website at jantaris.com (the "Service"). It is based on the EU General Data Protection Regulation (GDPR).
1. Controller and contact
The controller of your personal data is Piotr Olszewski, ul. Białołęcka 247, 03-253, Warszawa, tax ID (NIP) 5242572263 ("we", "us"). For any question about your data or to exercise your rights, write to promptowy@gmail.com. We have not appointed a Data Protection Officer, because the law does not require it in our case. Please use the address above for all privacy matters.
2. What data we process
| Category | Examples | Source |
|---|---|---|
| Account data | email address, password if you set one (stored as a hash), one-time login codes (stored as a hash, deleted after a day), name if you provide it, account settings, account currency | you |
| Billing data | name or company name, address, VAT ID, top-up history, amounts, invoice numbers, payment status | you and our payment provider |
| Payment data | payment method type, last digits of a card, payment result | our payment provider (we never receive your full card number) |
| Task history | prompts, parameters, uploaded input files and URLs, model, cost, status, links to Output | you, when you use Studio or the API |
| API and technical logs | IP address, API Key identifier (not the key itself), endpoint, timestamps, response codes, browser or client type | automatically, when you use the Service |
| Support correspondence | content of your messages and our replies | you |
| Referral data | referral code, date of the click and sign-up, commission amounts | referral cookie and your Account |
| Moderation data | flags raised by automated filters, reports about content, decisions and appeals | automatically and from reports |
Your Input may contain personal data of other people, for example a photo of a person used as a reference. You may submit such data only if you have a legal basis for it, such as that person's consent.
3. Why we process data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your Account, processing Generations, keeping your task history | Art. 6(1)(b) - performance of the contract |
| Processing Top-ups, issuing invoices, keeping accounting records | Art. 6(1)(b) and 6(1)(c) - contract and legal obligations under tax and accounting law |
| Preventing abuse, fraud and illegal content, enforcing our Terms, securing the Service | Art. 6(1)(f) - our legitimate interest in a safe and lawful Service; Art. 6(1)(c) where the law requires us to act (for example the EU Digital Services Act) |
| Answering support requests and complaints | Art. 6(1)(b) and 6(1)(f) |
| Running the referral program | Art. 6(1)(b) for the referrer; Art. 6(1)(f) for assigning a referred user |
| Establishing, pursuing or defending legal claims | Art. 6(1)(f) |
| Sending service messages (for example payment confirmations, security alerts, changes to the Terms) | Art. 6(1)(b) and 6(1)(c) |
We do not send marketing emails without your consent. If you give consent (for example to a product newsletter), you can withdraw it at any time without affecting the lawfulness of earlier processing.
We do not use your prompts, Input or Output to train AI models.
4. How long we keep data
| Data | Retention period |
|---|---|
| Task history (prompts, parameters, model, cost, status) | 90 days from the Task |
| Output files | a limited time needed to download them; download links expire after that |
| API and technical logs | 30 days |
| Invoices and billing records | 5 years from the end of the calendar year in which the tax payment deadline passed, as required by tax law |
| Account data | while your Account exists; deleted after the Account is closed, except data we must keep for billing or legal claims |
| Support correspondence | up to 2 years from the end of the conversation, or longer if needed for a legal claim |
| Moderation data related to a serious breach | as long as needed to prevent the closed Account from being recreated and to defend legal claims, no longer than the applicable limitation period |
5. Who processes data for us
We share data only with service providers who process it on our behalf under a data processing agreement, or where the law requires it. These providers fall into the following categories:
- Payment processing - Stripe, which processes payments and payment data. Stripe also acts as an independent controller where payment and anti-money-laundering regulations require it.
- Invoicing - Fakturownia, which issues and stores invoices.
- Hosting and storage - providers of servers, databases and file storage where the Service and Output files run and are stored.
- AI model infrastructure providers - companies that run the AI models you choose. They receive your prompts and Input files only to generate the Output for your request.
- reAPI (reapi.ai) - intermediary for access to AI models; processes prompts and input files to generate outputs.
- Email delivery - providers that send service emails such as payment confirmations and security alerts.
We may also disclose data to courts, law enforcement and other public authorities when the law requires it, and we report content depicting child sexual abuse to the competent authorities.
6. Transfers outside the EEA
Some of our providers, including AI model infrastructure providers, may process data outside the European Economic Area, for example in the United States. In such cases we rely on an adequacy decision of the European Commission (for example for companies certified under the EU-US Data Privacy Framework) or on Standard Contractual Clauses approved by the European Commission, together with additional safeguards where needed. You can ask us for a copy of the relevant safeguards at promptowy@gmail.com.
7. Your rights
Under the GDPR you have the right to:
- access your data and receive a copy of it;
- have inaccurate data corrected;
- have your data erased;
- restrict processing;
- receive the data you gave us in a structured, machine-readable format (data portability);
- object to processing based on our legitimate interest, including for reasons related to your particular situation;
- withdraw consent at any time, where processing is based on consent.
To exercise your rights, write to promptowy@gmail.com from the email address linked to your Account. We answer within one month, which may be extended by two further months for complex requests, in which case we will tell you why.
You also have the right to lodge a complaint with a data protection supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw). If you live in another EU country, you can also contact the authority in your country.
8. Is providing data required?
Providing your email address is necessary to create an Account. Billing data is necessary to process a Top-up and issue an invoice, as required by tax law. Without this data we cannot provide the Service.
9. Automated decisions
We use automated filters to detect content and requests that may break the law or our Terms. A filter can block an individual request. Decisions to suspend or close an Account are reviewed by a person, and you can contest them as described in our Terms of Service. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
10. Cookies
We use only two cookies:
| Cookie | Purpose | Duration |
|---|---|---|
| Session cookie | keeps you logged in and protects your session | until you log out or the session expires |
| Referral cookie | stores the referral code from a link you clicked, so the sign-up can be assigned to the person who referred you; it contains only the code | 30 days |
We do not use advertising cookies, third-party tracking or cross-site profiling. The session cookie is strictly necessary for the Service. The referral cookie is set only when you open a link with a referral code. You can delete or block cookies in your browser settings; if you block the session cookie, you will not be able to log in.
11. Security
We protect data with encryption in transit (HTTPS), access control limited to people who need it for their work, hashed passwords and API Key identifiers in logs instead of full keys. No system is completely secure. If a personal data breach occurs that is likely to result in a high risk to you, we will notify you without undue delay.
12. Changes to this policy
We may update this policy when our processing changes or the law requires it. We will inform you of material changes by email or in the Service before they take effect. The date of the last update is shown at the top of this page.