Effective date: [DATE]

§1. Data Controller

1. The controller of personal data is:
   Smart Concept Design, LLC.
   7 Polna St., 62-006 Kobylnica
   Tax ID (NIP): 7773451990, Business Registration Number (REGON): 542441138, National Court Register (KRS): 0001188119
   Email address: [EMAIL ADDRESS] (hereinafter: „Controller”).
2. For all matters related to the processing of personal data, you may contact the Data Controller at the email address provided in paragraph 1.

§2. Scope of Data Processed

Depending on how you use the Store and the App, the Administrator may process:

1. Account and Order Information: first name, last name, email address, phone number (optional), billing information (company name, address, tax ID), order history, license codes, token balance.
2. Technical Specifications: IP address, device identifiers (HWID), system logs, session data, browser data—to the extent necessary for the operation of licensing and security mechanisms.
3. Image data: Photos taken within the App and photos processed by AI—processed locally and sent to the AI service provider to generate the effect.
4. Data provided when contacting us: the content of messages sent via the contact form or email.

§3. Purposes and Legal Basis for Processing

1. Performance of the Contract (purchase of licenses/tokens, account management, provision of digital content) – Article 6(1)(b) of the GDPR.
2. Issuing and Storing Invoices, and Tax Obligations – Article 6(1)(c) of the GDPR.
3. Handling Complaints and Pursuing Claims – Article 6(1)(f) of the GDPR (legitimate interest).
4. Ensuring Safety and Preventing Abuse (including HWID checks, logs, etc.) – Article 6(1)(f) of the GDPR.
5. Correspondence Handling – Article 6(1)(f) of the GDPR.
6. Image Processing Using AI Features – based on consent / for the purpose of performing a contract (Article 6(1)(a) or (b) of the GDPR). See §7 for details.
7. Marketing (if applicable) – based on consent (Article 6(1)(a) of the GDPR).

§4. Data Recipients

Data may be disclosed to the following categories of recipients, only to the extent necessary:

1. AI Service Provider – platform OpenRouter and the model provider (Google)—to generate stylized images (image data processing).
2. Payment processor – Przelewy24 (PayPro S.A.) – to process payments.
3. Web hosting provider – [cyberfolks.pl / name] – for the purpose of storing the Store's data.
4. Invoicing System – [name, if applicable] – for the purpose of issuing invoices.
5. IT and Technical Support Service Providers – based on data processing agreements.

§5. Transfer of Data Outside the EEA

In connection with the use of an AI provider’s services, data (including images in photographs) may be processed by entities based outside the European Economic Area. In such cases, the transfer is based on appropriate safeguards, in particular the standard contractual clauses approved by the European Commission.

§6. Data Retention Period

1. Contract- and account-related data – for the duration of the contract and, after its termination, for the period during which claims may be brought.
2. Data on invoices—for the period required by tax regulations (generally 5 years).
3. Image data (photos) – for the period necessary to provide the service; originals and results are stored in accordance with the service configuration and are deleted or anonymized upon completion of the service.
4. Data processed based on consent—until such consent is withdrawn.

§7. Photograph and Biometric Data

1. The AI feature processes the images of people in the photos to generate a stylized image.
2. The mere generation of stylized AI images, without a mechanism for unambiguously identifying a person, does not, as a general rule, constitute the processing of biometric data within the meaning of Article 9 of the GDPR. However, if a specific use of the Application were to lead to the processing of biometric data for the purpose of unambiguously identifying a person, such processing would take place solely on the basis of explicit consent (Article 9(2)(a) of the GDPR).
3. The photo booth operator (a customer using the App at an event) is responsible for obtaining the necessary consent from the individuals whose likeness is being captured, if required by law.

§8. Rights of Data Subjects

1. You have the right to: access your data, rectification, erasure, restriction of processing, data portability, to object to processing based on a legitimate interest, and—with respect to data processed on the basis of consent—to withdraw consent at any time (without affecting the lawfulness of the processing prior to withdrawal).
2. You have the right to file a complaint with The President of the Personal Data Protection Office (2 Stawki St., 00-193 Warsaw).
3. To exercise your rights, please contact the Data Controller at the email address provided in §1.

§9. Voluntary Provision of Data

Providing your personal information is voluntary, but necessary for entering into and fulfilling the contract (purchase, account management, delivery of digital content). Failure to provide your personal information will prevent us from fulfilling your order.

§10. Cookies

1. The Store uses cookies (and similar technologies) for the following purposes: to ensure the proper functioning of the Store and user sessions, to manage the shopping cart and the checkout process, for statistical purposes, and—with your consent—for marketing purposes.
2. Customers can manage cookies through their browser settings and the consent banner displayed in the Store.
3. Restricting cookies may affect some of the Store's features.

§11. Changes to the Privacy Policy

The administrator may update the Privacy Policy in the event of changes to regulations or the scope of services provided. The current version is always available in the Store.