Proposition Studio
Privacy Policy
This Privacy Policy explains what personal data Proposition Studio processes on its website and in its application, why, who receives it, how long we keep it and what rights you have.
1. Who we are
The controller of your personal data is M8 Mateusz Bochyński, Trzy Lipy 2, 1/1, 80-152 Gdańsk, Poland, NIP 5833465375 ("we", "us"). We are responsible for providing the service, including your projects and AI operations, and for access requests, accounts, purchases, support, security and analytics. For any privacy matter write to hello@propositionstudio.com.
The service is for people aged 18 and over.
2. What data we process and why
- Website visitors: technical data your browser sends, such as IP address, browser type, language and the page you open, used to deliver and protect the website and to count visits.
- Access requests: email address, first and last name, country, profession, how you heard about us, language, and the page and campaign you came from when you use Request Access, used to assess your request and write to you about it.
- Accounts: name, email address, sign-in details (a password or Google sign-in), profile picture if you add one, preferences, your workspace, credit balance and the documents you accepted, used to provide your account and keep it secure.
- Referrals: your own referral code and, if you requested access through someone's referral link, the code you used and, once your account is active, who invited you, used to grant referral credits to both sides and to prevent abuse of the referral program. Deleting the inviter's account removes the link; credits already granted stay with the account that received them.
- Projects and AI operations: uploaded images, prompts, selections, masks, references, annotations, generated results and operation details, used to run the operations you request, keep your versions and let you export results.
- Purchases: pack, amount, currency, date, credits, refunds and any invoice details you give. Card details go directly to the payment provider; we never see them.
- Support and requests: your messages and our replies, used to answer you and keep a record of complaints and privacy requests.
- Security: sign-in events, error and diagnostic logs and records of suspected abuse, used to keep the service running and protect it and other users.
If your images show other people, you are responsible for having the right to upload them and for informing those people where the law requires it. We process such content only to provide the service to you.
3. Legal bases
- Contract, Article 6(1)(b) GDPR: handling your access request at your request, and providing your account, projects, AI operations, credits (including referral credits) and support.
- Legal obligation, Article 6(1)(c) GDPR: accounting and tax records, consumer complaints and privacy requests.
- Legitimate interest, Article 6(1)(f) GDPR: security, abuse prevention (including in the referral program), records of accepted documents, establishing or defending legal claims, counting website visits in aggregate and improving the product with signed-in app analytics.
- Consent, Article 6(1)(a) GDPR, and for storing or reading information on your device, Article 399 of the Polish Electronic Communications Law: optional website analytics and the ps_visitor identifier that links your visits to an access request or account. You can withdraw consent at any time with "Cookie settings" in the website footer; this does not affect earlier processing.
You can object at any time to processing based on legitimate interest. Signed-in app analytics only serves product improvement. To object to it, open Account, Preferences, Product analytics in the application and choose Off; we then stop recording your app pageviews and stop linking new website visits to your account.
You do not have to give us personal data, but some is needed for what you ask: without your name and email we cannot assess an access request or open an account, without your images and prompts we cannot run AI operations, and without payment details you cannot buy credits. Optional analytics is never a condition of using the website or the service.
We do not make decisions based solely on automated processing that have legal or similarly significant effects for you.
4. Recipients and AI providers
We share data only with providers that help us run the service, and only what each feature needs:
- Hosting, content delivery and protection of the website and the application, file storage and, only with your consent, website analytics.
- Database hosting for the application.
- Google, if you sign in with Google.
- AI model providers for the operations you request: currently fal.ai, Google AI (Gemini), and OpenRouter together with the model provider it routes to.
- Transactional email delivery (invitations, password resets, purchase confirmations).
- Private operational notifications to us about access requests and service events; nothing is published.
- Stripe and Sold through Link, LLC for payments, taxes, transaction documents, refunds and disputes when purchases are available; they are also independent controllers for their own payment, tax and fraud-prevention purposes.
- Our accounting firm: transaction documents needed for bookkeeping and tax, never your images or prompts.
For an AI operation we send the prompt and the images it needs; not every provider receives every item. We do not use your content for advertising and we do not train models on it. AI providers process data under their own terms, including their own retention and regions.
A current list of our service providers with their locations is available on request at hello@propositionstudio.com.
5. Transfers outside the EEA
Some providers, including AI, email, payment and infrastructure providers, process data in the United States or other countries outside the European Economic Area. These transfers rely on safeguards required by the GDPR, such as an adequacy decision of the European Commission or standard contractual clauses. Write to hello@propositionstudio.com for details and a copy of the safeguards.
7. How long we keep data
- Access requests: 12 months after we decide on the request, and if we open an account, your name and email continue as account data; we delete data older than that at least every quarter.
- Account data and project content: while your account exists; after we complete an erasure request, backup copies are removed in the normal backup rotation.
- Referral links between accounts: while both accounts exist; the referral code in an access request follows the access-request period above.
- Purchase, invoice and accounting records: 5 years from the end of the calendar year in which the related tax was due, as Polish tax law requires.
- Records of accepted Terms and purchase consents: while the contract lasts and then until related claims expire, generally 6 years.
- Support correspondence, complaints and privacy requests: 12 months after the matter is closed, or longer if needed for a legal claim; we delete data older than that at least every quarter.
- Security and diagnostic logs: 90 days, after which we delete them at least once a month; records of a specific incident or abuse until it is resolved and related claims have expired.
- Analytics events: 13 months; we delete data older than that at least every quarter. Links between an analytics identifier and your request or account last as long as that request or account data.
- Private operational notifications: 12 months; we delete data older than that at least every quarter.
Archiving a project in the application hides it but does not delete it.
8. Your rights and how to exercise them
You have the right to access your data and get a copy, to correct it, to have it erased, to restrict its processing, to data portability and to object to processing based on legitimate interest. You can withdraw consent at any time.
To use a right, write to hello@propositionstudio.com; you do not need an active account. We may ask for information to confirm your identity. We answer within one month, or within up to two further months for complex requests, in which case we tell you why.
There is no self-service account deletion; ask us by email. On request we send you a copy of your account data and files, and we correct your name and access-request details.
When we erase an account, we delete its profile, projects, files and analytics links and keep only the records listed in section 7 for their stated periods, such as purchase, tax and accounting records, accepted documents, support correspondence and abuse records. Copies held by providers are deleted under their own processes. We tell you what we removed, what we kept and why.
You may also lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, or with the authority where you live or work.
9. Security
We protect data with encrypted connections, access limited to the people and services that need it, and monitoring for abuse. If a personal data breach is likely to put you at high risk, we will tell you as the law requires.
10. Changes
We update this Policy when the way we process data changes. Each version shows its date, and we announce material changes in the application or by email.
Contact: hello@propositionstudio.com