Privacy Policy (GDPR)

The controller of personal data is: Show operator details, e-mail: pomoc@webbyn.pl (hereinafter: “Controller”).

Data Protection Officer: not appointed.

• Account data: email, first name, password in hashed form, session identifiers.
• Project content: ideas, briefs, chapters, offer metadata, PDF files / covers, product settings.
• Product funnel data: creation stages (e.g. offer selection, generation), Plan limits, entitlement status.
• Billing data on Stripe's side: payment / subscription status, Stripe customer identifiers linked to the account (card details usually at Stripe, not in Webbyn).
• Technical data: server logs, IP address to the extent necessary for security, theme preference in the browser's local storage.
• Abuse protection: when you sign in, a hash (HMAC) of the browser id from the wb_dev cookie and a hash of the IP address, and for comparisons your e-mail address without dots and "+tags" (Gmail). Used only to keep the free trial one per person; IP hashes are deleted after 30 days (legitimate interest, Art. 6(1)(f) GDPR).
• Onboarding preferences stored locally or in the Service, if you make them available.
• If you connect a TikTok account (optional): your account ID for our app (open_id), display name and avatar, and TikTok access tokens (encrypted). We use them only to send a carousel to the drafts in your TikTok app when you click the button. We never post on your behalf and we don't read your videos, followers or statistics. You can disconnect in Settings → TikTok; we then delete the tokens and revoke access at TikTok.

• Providing the Service, account, generation, storage (Art. 6(1)(b) GDPR, contract).
• Billing, accounting, tax obligations (Art. 6(1)(c) GDPR, legal obligation), to the extent of data on the Operator's / Stripe's side.
• Security, fraud prevention, pursuing claims (Art. 6(1)(f) GDPR, legitimate interest).
• Responding to inquiries and complaints (Art. 6(1)(b) or (f) GDPR).
• Our own email marketing only after separate consent, if we implement it (Art. 6(1)(a) GDPR). We currently do not run a newsletter without consent.

Data may be shared with entities processing it on our behalf or independently:

• Stripe : payments, customer portal, fraud prevention (separate Stripe policy).
• Hosting / infrastructure: VPS infrastructure / containers in the EEA (details from the Operator on request)..
• TikTok: Only if you connect an account. Sign-in with TikTok (Login Kit) and sending the carousel you choose to your drafts (Content Posting API). TikTok downloads the slide images from our server. TikTok's own privacy policy applies from there.
• AI providers: DeepSeek (text / chapters) and Hugging Face (covers) : prompt content and results may be processed by these providers to generate the output. Check their policies and do not paste sensitive third-party data without a legal basis.
• Other processors / providers (email, monitoring, etc.): Stripe (payments), DeepSeek (text generation), Hugging Face (covers), VPS hosting..

Transfer outside the EEA: Some processors may process data outside the EEA based on SCCs / mechanisms recognized by the European Commission - details in the provider agreements.

• Account data and projects: for the duration of the account, then deleted or anonymized after account deletion, except for backup copies in the rotation cycle (up to 30 days).
• PDF files / covers in storage: linked to the project, deleted together with the account / project according to the Service's processes.
• Technical logs: usually up to 90 days, longer in the event of a security incident.
• Billing / accounting data: periods required by law (often up to 5 years) : mainly at Stripe / in the Operator's documentation.
• Preferences in the browser's localStorage: until you clear them or delete the account (onboarding, theme, client-side action plan).

You are entitled to, among other things:

• access to data and a copy,
• rectification,
• erasure (“right to be forgotten”) within the limits of the law,
• restriction of processing,
• data portability (to the extent of data provided and processed under contract),
• objection to processing based on Art. 6(1)(f) GDPR,
• withdrawal of consent, if processing is based on consent,
• complaint to the President of the Personal Data Protection Office (uodo.gov.pl).

Deleting your account in Settings largely fulfills the right to erasure of data in the Service. Account export (JSON) is available in Settings → “Download my data”. You can also send GDPR requests by email: Settings → “Download my data (JSON)”. Other GDPR requests: e-mail support.

We use essential session cookies (login, security) and local storage (theme, UI preferences). We currently do not load marketing analytics tools that require consent. Details: Cookie Notice.

Providing your email and password is necessary for the Service agreement. Without them you cannot create an account. Project content is voluntary, but without it the Service will not generate a product.

We may update this document. The current version is always on this page. For material changes we will notify you in the Service or by email, where the law requires it.