Privacy Policy
Effective date: 22 October 2026
Draft awaiting review by a lawyer. A legal professional has not checked this text yet, so its wording may still change before it enters into force.
Below we describe what happens to personal data when you use Kadraris Studio, Kadraris API and the kadraris.com website (the "Service"). The policy follows the EU General Data Protection Regulation (GDPR).
1. Controller and contact
Your personal data is controlled by Piotr Olszewski, ul. Białołęcka 247, 03-253, Warszawa, NIP (Polish tax ID) 5242572263 ("we", "us"). Questions about your data and requests to exercise your rights go to promptowy@gmail.com. We have no Data Protection Officer, since the law does not oblige us to appoint one; the address above handles every privacy matter.
2. What data we process
| Category | What it includes | Where it comes from |
|---|---|---|
| Account data | e-mail address, password if you chose one (kept only as a hash), one-time login codes (hashed, removed after a day), name if given, account settings and account currency | you |
| Billing data | your full name or the company's name, postal address, VAT ID, list of top-ups with their amounts, invoice numbers, payment status | you and our payment provider |
| Payment data | type of payment method, last digits of the card, outcome of the payment | our payment provider (the full card number never reaches us) |
| Task history | prompts and parameters, input files and URLs you uploaded, chosen model, cost, status, Output links | you, while using Studio or the API |
| API and technical logs | your IP, the identifier of the API Key (never the key), endpoint called, times, response codes, browser or client type | collected automatically during use |
| Support correspondence | your messages and our answers | you |
| Referral data | referral code, dates of the click and of sign-up, commission amounts | the referral cookie and your Account |
| Moderation data | flags from automated filters, content reports, decisions and appeals | automatically and from reports |
Your Input can include other people's personal data, such as a photo of someone used as a reference. Submit it only when you have a legal basis, for instance that person's consent.
3. Why we process data and on what legal basis
| Purpose | GDPR legal basis |
|---|---|
| Opening and maintaining your Account, running Generations, storing task history | Art. 6(1)(b) - performing the contract |
| Handling Top-ups, issuing invoices, keeping the books | Art. 6(1)(b) and 6(1)(c) - the contract and duties under tax and accounting law |
| Fighting abuse, fraud and illegal content, enforcing the Terms, protecting the Service | Art. 6(1)(f) - we have a legitimate interest in running a safe and lawful Service; Art. 6(1)(c) where the law obliges us to act (e.g. the EU Digital Services Act) |
| Replying to support requests and complaints | Art. 6(1)(b) and 6(1)(f) |
| Operating the referral program | towards the referrer, Art. 6(1)(b); linking a new user to whoever referred them, Art. 6(1)(f) |
| Establishing, pursuing or defending legal claims | Art. 6(1)(f) |
| Service messages (payment confirmations, security alerts, changes to the Terms and similar) | Art. 6(1)(b) and 6(1)(c) |
Marketing e-mails are sent only with your consent. Consent you give, for example to a product newsletter, can be withdrawn at any time; processing that took place before withdrawal stays lawful.
Your prompts, Input and Output are not used to train AI models.
4. How long we keep data
| Data | How long |
|---|---|
| Task history (prompts and parameters, chosen model, cost, status) | 90 days after the Task |
| Output files | a limited period for downloading; after it the download links stop working |
| API and technical logs | 30 days |
| Invoices and other billing documents | as tax law requires: 5 years, counted from the end of the calendar year in which the tax fell due for payment |
| Account data | for the lifetime of the Account; erased after closure, except what billing rules or possible legal claims oblige us to retain |
| Support correspondence | up to 2 years after the conversation ends, longer if a legal claim requires it |
| Moderation data concerning a serious breach | as long as needed to stop a closed Account from being opened again and to defend legal claims, but not beyond the applicable limitation period |
5. Who processes data for us
We pass data to service providers who process it for us on the basis of a data processing agreement, and to other parties only when the law requires it. The providers belong to these categories:
- Payments - Stripe processes payments and payment data. Where payment and anti-money-laundering rules require it, Stripe acts as a separate controller.
- Invoicing - inFakt (inFakt Sp. z o.o., Kraków) issues and stores invoices and submits them to the Polish National e-Invoicing System (KSeF).
- Hosting and storage - providers of the servers, databases and file storage on which the Service runs and Output files are kept.
- External AI model infrastructure providers - companies running the AI models you select. They get your prompts and Input files solely to produce the Output you asked for.
- E-mail delivery - providers sending service e-mails such as payment confirmations and security alerts.
If you ask, we will name the specific recipients who received your data.
When a legal duty applies, data may also be handed over to courts, the police, prosecutors or other state bodies. Content showing child sexual abuse is reported to the competent authorities.
6. Transfers outside the EEA
Part of the processing, including by external AI model infrastructure providers, may happen in countries outside the EEA, such as the United States. For each such transfer we use either an adequacy decision issued by the European Commission (this covers, among others, companies certified under the EU-US Data Privacy Framework) or the Commission's Standard Contractual Clauses, adding further safeguards when they are needed. A copy of the safeguards in place is available on request at promptowy@gmail.com.
7. Your rights
The GDPR gives you the right to:
- access your data and get a copy;
- have incorrect data rectified;
- have your data erased;
- have processing restricted;
- receive the data you provided in a structured, machine-readable format (portability);
- object, on grounds relating to your particular situation, where we rely on legitimate interest;
- withdraw consent at any time where processing relies on consent.
Deleting your Account does not require writing to us. Use the "Delete account" button, found under Overview in the dashboard; kadraris.com/delete-account walks you through it. Once you confirm, we erase at once your e-mail address, profile, active sessions, API Keys, prompts, uploads and Outputs. Invoices and payment records stay for the period given in section 4.
To use any of these rights, write to promptowy@gmail.com from the address tied to your Account. You will get an answer within one month. For complex requests this can be extended by two more months, and we will explain the reason.
You may also file a complaint with a supervisory authority for personal data. The Polish one is Prezes Urzędu Ochrony Danych Osobowych (the head of the Polish data protection office), ul. Stawki 2, 00-193 Warsaw. If you live elsewhere in the EU, your local authority is an option too.
8. Is providing data required?
An Account cannot be created without an e-mail address. Billing data is required so that we can accept a Top-up and, as tax law demands, invoice it. Without this data we are unable to provide the Service.
9. Automated decisions
Automated filters scan requests and content for signs of illegal activity or breaches of our Terms, and a filter may stop a single request. Suspending or closing an Account is always reviewed by a human, and you can challenge such a decision as set out in our Terms of Service. We take no decisions based solely on automated processing that have legal effects on you or affect you in a similarly significant way.
10. Cookies
The Service sets three cookies and no others:
| Cookie | What it does | How long it lasts |
|---|---|---|
| Session cookie | keeps you signed in and protects your session | until you sign out or the session ends |
| Referral cookie | holds the referral code from a link you opened, so your sign-up can be credited to the person who referred you; it stores the code and nothing else | 30 days |
| Campaign cookie | if you came from one of our ads, holds the source, campaign and ad name from the link (such as utm_campaign) and the landing page, so your sign-up can be attributed to that campaign; it is never passed to any ad network | 30 days |
We set no advertising cookies, run no third-party trackers and build no profiles across websites. Without the session cookie the Service could not work at all. The referral cookie appears only after you open a link with a referral code, and the campaign cookie only after you arrive from an ad. We save the source on your Account to see which campaigns are worth running (legitimate interest, Art. 6(1)(f) GDPR). Cookies can be deleted or blocked in your browser; with the session cookie blocked, signing in is not possible.
11. Security
Data is protected by encryption in transit (HTTPS), access restricted to people whose work requires it, hashed passwords, and logs that record API Key identifiers rather than whole keys. No system can be fully secure. If a personal data breach is likely to put you at high risk, we will inform you without undue delay.
12. Changes to this policy
This policy may be updated when our processing changes or the law demands it. Material changes will be announced by e-mail or in the Service before they apply. The effective date is shown at the top of this page.