Privacy policy

This policy explains what personal data we collect on reklamuj.ai and in the app at app.reklamuj.ai, why we process it, who we share it with and how long we keep it. It discharges the information duty under Articles 13 and 14 of the GDPR.

Cookies and similar technologies are covered separately, in the Cookies policy.

1. Controller

Operator of the service: FUNGIES EUROPE prosta spółka akcyjna
Legal form: prosta spółka akcyjna (a Polish simple joint-stock company)
Registered office and address for correspondence: Aleje Jerozolimskie 109/70, 02-011 Warsaw, Poland
Registry court: District Court for the Capital City of Warsaw, 13th Commercial Division of the National Court Register
KRS number: 0001137340
NIP (tax identification number): 5214093272
REGON (statistical number): 540135615
Share capital: 10 000,00 PLN
E-mail address: contact@reklamuj.ai

We have not appointed a data protection officer. For any data protection matter write to contact@reklamuj.ai — messages marked as data protection matters are routed to the person responsible for that area.

2. What we process, and on what basis

2.1. Your account in the app

We process your e-mail address, your password as a cryptographic hash, your credit balance, your generation history and the files you generate.

Legal basis: Article 6(1)(b) GDPR — performance of the service contract. Providing this data is a condition of having an Account.

2.2. Material you upload for generation

We process product photos, descriptions, logos and links to listings. Where an uploaded photo contains a person’s likeness, we process that likeness too.

Legal basis: Article 6(1)(b) GDPR. Where you upload material containing third parties’ data as part of a B2B engagement, we process it as a processor on your instructions, on the terms in the Enterprise terms.

We do not use this material to train publicly available models without your separate consent.

2.3. Contact form and quote requests

We process your first name, e-mail address, company name, an optional link to a listing and the content of your enquiry.

Legal basis: Article 6(1)(b) GDPR, and for enquiries that do not lead to a contract, Article 6(1)(f) — our legitimate interest in handling correspondence.

We process your e-mail address and optionally your company name.

Legal basis: Article 6(1)(a) GDPR — your consent — together with Article 10 of the Polish Act on the Provision of Electronic Services. You can withdraw consent at any time using the unsubscribe link in any message or by writing to us. Withdrawal does not affect the lawfulness of processing before it.

2.5. Billing and accounting records

We process the data needed to issue an invoice: name, address, tax number (NIP) and payment history.

Legal basis: Article 6(1)(c) GDPR — a legal obligation under Polish tax and accounting law.

2.6. Security and technical logs

We process IP address, browser and device information, the date and time of a request, and application event records.

Legal basis: Article 6(1)(f) GDPR — our legitimate interest in keeping the service secure and functioning and in detecting abuse.

2.7. Choosing the language of the site

To pick a language version we use the browser’s language header and the country information our infrastructure provider derives from the IP address. We do not store the IP address for this purpose — we store only the resulting language choice, in the cookie described in the Cookies policy.

Legal basis: Article 6(1)(f) GDPR — our legitimate interest in showing the site in a language you can read.

2.8. Establishing and defending claims

In the event of a dispute we process the data needed to establish, pursue or defend claims, under Article 6(1)(f) GDPR.

2.9. Statistics and measuring our ads

If you agree in the cookie banner, we collect visit statistics and measure how our own ads perform. We run this through Google Tag Manager; clause 4 of the Cookies policy sets out the data and the cookie names.

Legal basis: Article 6(1)(a) GDPR — your consent. Without it none of these tools runs, and you can withdraw it at any time through the Cookie settings link in the footer.

3. What we do not do

We do not sell personal data. We start no statistics or ad measurement without your consent, and if you do not give it, no measurement tool runs on the site at all. We do not profile visitors and we take no decisions about them based solely on automated processing that would produce legal effects within the meaning of Article 22 GDPR.

Generating assets is an automated process, but it is not a decision about you — its output is an image or video file.

4. Recipients

We share data only with the providers we need in order to run the service. Each acts under a data processing agreement concluded under Article 28 GDPR:

Provider	Role	Scope
Vercel Inc. (USA)	hosting for the site and app	technical logs, request IP address
Supabase Inc. (USA)	database, authentication, file storage	account data, input and output material
Resend (USA)	sending e-mail and the newsletter	e-mail address, message content
AI infrastructure providers	generating assets with AI models	input material submitted for generation
Google Ireland Ltd.	visit statistics and ad measurement — only once you have consented	data from the cookies in clause 4 of the Cookies policy, IP address, browser and device information

AI infrastructure providers are given as a category of recipient. We will name the specific providers in that category on request to contact@reklamuj.ai.

Data may also be disclosed to our legal and tax advisers, our bookkeeping provider and — to the extent the law requires — public authorities making a lawful request.

5. Transfers outside the EEA

Some of the providers above are established in the United States, which means data is transferred outside the European Economic Area. Transfers rely on the mechanisms in Chapter V of the GDPR — the standard contractual clauses approved by the European Commission, or the provider’s participation in a framework recognised as providing an adequate level of protection.

Statistics and ad measurement data goes to Google Ireland Limited, established in Ireland, but may be passed on to Google LLC in the United States. Google participates in the Data Privacy Framework, which is the transfer basis under Article 45 GDPR. That transfer happens only if you agree in the cookie banner.

We will provide a copy of the safeguards in place on request to contact@reklamuj.ai.

6. How long we keep data

Account data and generated files — for the duration of the contract and then 30 days, so you can download your files. After that we delete or anonymise them.
Input material — up to 90 days after generation, unless you delete it sooner.
Contact form enquiries — up to 12 months from the last contact, where the enquiry did not lead to a contract.
Newsletter — until you withdraw consent, and evidence of consent for up to 3 years after withdrawal, to defend against claims.
Accounting records — 5 years from the end of the tax year in which the tax payment deadline fell.
Technical logs — up to 12 months.
Data needed to defend claims — until the limitation period expires.

7. Your rights

You have the right to:

access your data and receive a copy of it (Article 15 GDPR),
have it rectified (Article 16),
have it erased (Article 17),
restrict processing (Article 18),
data portability, for data processed on the basis of a contract or consent (Article 20),
object to processing based on legitimate interests (Article 21),
withdraw consent at any time where processing is based on consent (Article 7(3)).

Send requests to contact@reklamuj.ai. We respond within one month; for complex requests we may extend that by two months and will tell you if we do.

If you believe we are processing data unlawfully you may lodge a complaint with the supervisory authority: President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

8. Security

Connections to the site are encrypted with TLS. Passwords are stored as cryptographic hashes — we do not know them and cannot read them. Database access is constrained by row-level security rules, so a user can only reach their own records. Only authorised members of our team can access the admin panel.

9. Children’s data

The service is intended for businesses and is not directed at people under 16. We do not knowingly collect their data.

10. Changes to this policy

We update this policy when the way we deliver the service changes or when our set of providers changes. We will announce significant changes on the site or by e-mail at least 14 days before they take effect. The date of the last update is shown at the top of this document.