Privacy policy

1. Data controller

The controller of your personal data is Przemysław Malinowski, a sole trader, Polish tax ID 5311711088, address: ul. Dąbrówki 15, 05-190 Nasielsk (the “Controller”). For all personal data matters, contact [email protected] or write to the Controller’s address. The Controller has not appointed a data protection officer because there is no obligation to do so.

2. Data we process

• Account data: email address, password hash (we do not store the password itself), account creation date, and the date and version of the accepted Terms of service.
• Domain and billing data: domain addresses, Apeari token balances and activity history, payer name and account email, order amounts and token quantities, payment identifiers and statuses, exchange-rate quotes, the date and version of purchase consent, and sales document data.
• Installation tokens: cryptographic token hash, its initial characters, and creation, last use, and revocation dates.
• Technical data: IP address, request date and time, and browser information in server logs and abuse prevention mechanisms.
• Optional analytics data: with your consent, Google Analytics collects cookie identifiers, page URLs and titles, interactions, browser and device information, and connection information to measure website usage. We do not send account email addresses, passwords, installation tokens, or plugin content as analytics event parameters.
• Correspondence: emails, complaints, and declarations sent to the Controller.
• Content sent by the plugin: instructions and website content excerpts used for the AI service. Where these contain personal data, we act as a processor on the Customer’s behalf under section 14 of the Terms of service.
• Lite service scope: after an administrator selects Apeari and explicitly enables data transfer, Lite sends the instruction, up to six recent conversation messages, the selected page’s title and native block text, block paths, supported style names, and titles and alternative text of selected existing images. Draft generation sends the brief, language, requested type and quantity, sequence number, and up to 30 previous draft titles. Lite does not send image files or theme files. Links or personal data written in a message are part of that message. A domain ownership proof contains the website REST address and a temporary secret; it is used to verify control of that website.

3. Purposes and legal bases

Providing an email address and password is voluntary but necessary to create an account. Without data required by tax law, purchasing Apeari tokens is not possible. We do not process data for marketing or profile users.

4. Data recipients

Data may only be shared with parties that help us provide the services, under data processing agreements or applicable law:

• providers of the servers and database hosting the service;
• AI model provider OpenAI Ireland Limited (Ireland) and its group companies, for content sent by the plugin as part of the AI service;
• Google Ireland Limited (Ireland), for email correspondence and, only with your consent, Google Analytics;
• Cloudflare, Inc., for Turnstile bot protection on registration and sign-in forms, including technical browser and connection signals;
• Tpay, operated by Krajowy Integrator Płatności S.A., for payer name, account email, order reference and amount necessary to process payments. Payment credentials such as card details and BLIK codes are entered on Tpay’s checkout and are not collected by Apeari. See Tpay’s privacy information;
• accounting and legal service providers;
• public authorities, only where disclosure is required by law.

Under the AI model provider’s terms, data sent through the API is not used to train its models by default. The Controller also does not use Customer content to train models.

5. Transfers outside the European Economic Area

AI, email, and analytics providers may also process data in the United States. Transfers rely on a European Commission adequacy decision (the EU–U.S. Data Privacy Framework) for certified entities, or on standard contractual clauses adopted by the European Commission. You can request a copy of these safeguards from the Controller.

6. How long we retain data

• Account, domain, and activity data: for the duration of the contract and then until the limitation period for claims expires (generally six years, or three years for business-related claims, ending on the last day of the calendar year).
• Sales documents and billing data: five years from the end of the calendar year in which the tax payment deadline expired.
• AI service results retained to handle retries of the same request: up to 30 days.
• Lite’s local conversation messages expire seven days after each message is saved, and private editor sessions after two hours of inactivity. This local retention is separate from the AI service results above. WordPress export and erasure tools concern local Plugin records; service account, billing and result erasure requests should be sent to the contact in section 1. Switching off the Plugin’s AI option stops new transfers and does not erase past billing records. With the Customer’s own OpenAI or Anthropic key, Plugin content goes directly to that provider and is not received by Apeari.
• Server logs: up to 12 months.
• Records of starter tokens awarded to a website: while the services are provided, to prevent repeated awards.
• Correspondence: as long as needed to handle it, or, where it concerns a contract or claims, for the same period as account data.
• Analytics cookies and the saved cookie preference: up to 180 days. Data already collected by Google Analytics is subject to the property's data retention settings; withdrawing consent stops further collection. Contact the Controller to request erasure of data already collected.

7. Your rights

You have the right to:

• access your data and receive a copy (Article 15 GDPR);
• rectify your data (Article 16 GDPR);
• have your data erased (Article 17 GDPR);
• restrict processing (Article 18 GDPR);
• port data processed on the basis of a contract (Article 20 GDPR);
• object to processing based on legitimate interests (Article 21 GDPR);
• withdraw analytics consent at any time through “Cookie settings”, without affecting the lawfulness of earlier processing based on consent (Article 7(3) GDPR);
• lodge a complaint with the President of the Polish Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.

To exercise your rights, email [email protected]. We will respond without undue delay and no later than one month.

8. Automated decisions

We do not make decisions with legal or similarly significant effects on you solely by automated means (Article 22 GDPR). Automated safeguards, such as a temporary sign-in lockout after several failed attempts, only protect your account.

9. Security

We use encrypted connections (HTTPS), cryptographic hashes for passwords and installation tokens, session cookies unavailable to scripts, and access controls. Only the Controller and the parties listed in section 4 have access to data.

Cloudflare Turnstile

Registration and sign-in are protected by Cloudflare Turnstile in invisible mode. On these pages, your browser connects to Cloudflare, which processes technical signals such as your IP address, browser information, TLS fingerprint, and website origin to detect bots and improve its bot detection. We do not send your email address or password to Turnstile. This security processing serves our legitimate interest in protecting accounts and preventing abuse.

Details of Cloudflare’s processing and its role are set out in the Turnstile Privacy Addendum and Cloudflare Privacy Policy, including information about international processing and safeguards.

10. Cookies

The service uses essential cookies and browser storage, plus optional analytics cookies if you consent. See the Cookie policy to manage your choice.

Google Analytics

Google Analytics helps us understand which pages and features visitors use so we can improve Apeari. Google's tag is blocked until you allow analytics. Google Signals and advertising personalisation are disabled. You can refuse or withdraw consent through “Cookie settings” in the footer. Details of Google's processing are available in Google's information about partner sites.

11. Policy changes

We will announce material changes to this policy on the website and notify Customers with an account by email.