Privacy Notice

If you use the app, we hold your email address, the words you type into briefs and prompts, and the work generated from them, and we send your prompts to the AI providers named in section 5 because that is how a mark gets made. If you buy from the marketplace, we hold your email address and your order. If you ask us about services, we hold the brief you send. We do not advertise, profile you, or sell anything about you to anyone. You can delete your account and your work at any time, and what that actually removes is set out in section 8.

Intelligency B.V., Herengracht 449 A, 1017 BR Amsterdam, the Netherlands, registered with the Dutch Chamber of Commerce under KVK 42159659. We are the data controller.

For anything in this notice, including a request to see or delete your data, write to privacy@intelligency.nl. A person reads that mailbox.

We are not required to appoint a Data Protection Officer and have not appointed one. The address above reaches the people who make these decisions.

To give you an account and run the service. Legal basis: performance of our contract with you.

·Your email address, and a password or the fact that you signed in with Google, in which case Google tells us your name and email address. We never see your Google password.

·Everything you make. Brand names, briefs, positioning and tone of voice, the prompts you write, and the marks, colourways, typography, mockups and messaging generated from them.

·Reference images you upload, and a record that you uploaded them.

·Your credit balance and the history of credits bought and spent.

·Four questions when you start: your role, what you want to use the app for, how you heard about us, and how much you expect to make. They shape what the app shows you first.

To answer an enquiry about hiring us. Legal basis: steps you asked us to take before entering into a contract.

·The brief you send from a “Request a quote” or “Talk to a brand manager” button: your name, email address, optionally your company and website, and your answers about the project, its timeline and budget. Nothing is stored until you press Send. If you then book a call, that booking is made in Google Calendar. We use it to reply to you and to prepare a quote, and you receive a copy by email.

·A project you buy from us. Your name, email address and company, the brief, and a record of the work: each set of options generated, the time your brand manager worked, the rounds, your notes and any refund. You see that record on your private project link, which works for anyone who has it, so keep it to yourself. Legal basis: performance of our contract with you.

To tell you when something opens, because you asked. Legal basis: your consent.

·The waiting list: your email address, which list you joined, and the optional note you leave. We use it to tell you when the app or the marketplace opens. Ask us to remove it at any time.

To answer you when you write to us. Legal basis: steps you asked us to take, and our legitimate interest in answering questions about our services.

·Emails and WhatsApp messages you send us, with your email address or phone number and WhatsApp profile name. On WhatsApp the first replies may come from an automated assistant, which reads your messages to answer them and passes the conversation to a person when one is needed. Nothing it decides about you has legal or similar effect without a person.

To take payment and keep our books. Legal basis: contract, and legal obligation for the tax records.

·Order records: what was bought, when, for how much, and the email address it was bought with, including marketplace purchases made without an account. We use that address to send your files and, if you later create an account with it, to put the purchase in your account. Card details go to Stripe and never reach us; Stripe processes the payment as merchant of record and is responsible for the payment data it collects under its own privacy policy.

·Your consent to immediate delivery: when you buy from the marketplace, the time you ticked the box giving up the 14-day right to cancel, and the IP address it was ticked from. Legal basis: our legitimate interest in being able to show that the consent the law requires was given.

To keep the service working and pay for it. Legal basis: our legitimate interest in running a service that stays up and does not lose money.

·Usage records: which generator you used, when, and what the underlying API call cost us. This is how credits are priced and how capacity is planned.

·Technical logs kept by our hosting provider: IP address, browser, and the pages requested.

To tell you when something is wrong, and to hear it from you. Legal basis: your consent for status emails, and our legitimate interest in fixing what is broken for reports.

·Status updates by email. If you ask for updates on our status page, we keep your email address to tell you when an incident starts, changes and ends, and before planned maintenance. Nothing is sent until you confirm from the email we send you, and every update carries a link to stop them.

·Problems you report. If you use “Report a problem” while signed in, we keep what you wrote, which part of the platform it was about, your account and email address, the page you came from and your browser type, so we can find the fault and reply to you. A report never appears on the status page. When we investigate a fault, the text of your report and the page it came from may be read by the AI assistant named in section 5 (Anthropic); your name and email address are not sent.

·Feedback you send from the app. If you use the Feedback tab, we keep what you wrote, a picture of your screen at that moment (unless you remove it or replace it with your own), the page and stage you were on, the brand you had open, your screen size and browser, the last errors the page had and the labels of the last buttons you pressed. Nothing you typed into the app is included, and none of it is sent until you press Send. We use it to find faults, see where the app is unclear, and reply to you. Each report, with its picture, is read by the AI assistant named in section 5 (Anthropic) to sort it and draft a reply that a person checks before anything is sent; your name and email address are not sent to it.

To prove what was agreed, and to act on misuse. Legal basis: our legitimate interest in being able to establish and defend a legal claim.

·Consent records: which version of our terms and upload conditions you accepted, when, a cryptographic hash of the exact words that were on screen, and the IP address and browser it was accepted from.

·Infringement notices: if you report that something infringes your rights, your name, email address, organisation, the details and signature in your notice, and the IP address and browser it was sent from. We use them to assess the notice, and we may tell the affected user who complained where that is needed to resolve it. Legal basis: our legal obligations as a provider of a hosting service, and our legitimate interest in handling claims.

·Flagged prompts. If a prompt appears to name someone else's brand, the text is recorded so a person can look at it. Nothing is blocked automatically and nothing is decided about you by software alone.

We do not ask for and do not want any special category data: nothing about your health, beliefs, politics, ethnicity, or sex life belongs in a brand brief. We do not knowingly collect data from anyone under 18, and the Terms require you to be 18 or older.

·We do not sell your personal data, and we do not share it for advertising.

·We do not use your briefs, prompts or generated work to train our own models. We have no models of our own.

·We do not build a profile of you, and no decision about you is made by software alone.

·We do not put your work in the marketplace. Marks offered for sale there come from our own library, never from a customer's account.

The service is assembled from other companies' infrastructure, so some of your data necessarily reaches them. Each one acts on our instructions, for the single purpose listed, under a data processing agreement. This is the complete list.

On the AI providers and training. We send them your prompt to do one job, and we grant them no licence to do anything else with it. What each provider may retain, and for how long, is governed by its own terms, and those terms differ between them. We are asking each for its position in writing and will name it here rather than summarise it for them.

Transfers outside the EU. Most of the companies above are established in the United States. Where data reaches them we rely on the European Commission's Standard Contractual Clauses, and on the EU-US Data Privacy Framework where the provider is certified under it. You can ask us for the details that apply to a particular provider.

We will also disclose data where the law requires it, and to our accountant and professional advisers where they need it to do their work.

·Your account and your work: until you delete it, or until you ask us to.

·Reference images you upload: 30 days, then the file is deleted automatically. The record that an upload happened is kept, because it is what lets us answer a rights holder about an upload from last year.

·A brief you sent us: if it does not become a project, it is deleted automatically 12 months after we last acted on it. If it does, it becomes part of the client record.

·The waiting list: until the thing you signed up for opens and we have told you, or until you ask us to remove you, whichever comes first.

·Emails and WhatsApp conversations: for as long as we need them to help you, and no longer than 12 months after the conversation ends, unless they become part of a client or order record.

·Infringement notices: for as long as a claim arising from them could still be brought.

·Status updates by email: until you unsubscribe. An address that was never confirmed is deleted after 7 days.

·Problems you report: deleted automatically 12 months after you send them.

·Feedback you send from the app: deleted automatically, with its screen picture, 12 months after you send it.

·A project you bought: seven years from delivery, because it is the record behind an invoice.

·Orders and invoices: seven years, including the record of your consent to immediate delivery. Dutch tax law requires it and we have no discretion here.

·Consent records and flagged prompts: as long as a claim arising from them could still be brought, then deleted.

·Usage and cost records: kept for accounting, with your account identifier removed when your account is deleted. What remains is a record of an API call, not of a person.

·Technical logs: as long as our hosting provider keeps them, which is a matter of weeks.

We store only what the service needs to work, and none of it tracks you or needs your consent:

·A sign-in cookie that keeps you signed in, shared between intelligency.nl and the app so you sign in once. It lasts up to 400 days, or until you sign out.

·An early-access cookie that remembers you have been let past the holding page while parts of the site are not yet open. It lasts 30 days.

·Preferences kept in your browser (local storage): light or dark mode, and in the app where you left off, such as the brand and stage you had open and drafts you have not saved. They stay on your device and are never sent to us.

There is no analytics, advertising or social media script anywhere in the service, and the typefaces on our pages are served from our own domain rather than by Google. The WhatsApp buttons are plain links: nothing from WhatsApp loads until you tap one. We intend to add our own analytics, and when we do you will be asked first, in a banner where refusing is exactly as easy as accepting. Until that banner exists, nothing is measuring you.

There is a delete button in your account settings. It does not queue a request for someone to action later; it runs immediately. This section describes exactly what it does, because a vague promise here is the easiest kind to break.

Deleted straight away:

·Your sign-in, your profile, and your email address. You will not be able to log in again, and we will not be able to identify you.

·Every brand, mark, palette, typography choice, mockup and piece of messaging you made, including the ones in the library and the ones you never used.

·Your reference uploads, your credit balance, and your credit history. Any unspent credits are gone and cannot be recovered or refunded.

·Your entry on the waiting list, any brief you sent us, and any status email subscription, if you used the same address.

·Any problems you reported from the status page.

·The generated image and vector files themselves, which are removed from storage within a day. They are scheduled the moment you press delete; an account can hold tens of thousands of files, and doing that inside the button press would risk stopping halfway.

Kept, and this is the whole list:

·Invoices for anything you bought, for seven years, because Dutch tax law requires it.

·The record that you accepted our terms and upload conditions. That record exists to protect both of us, and deleting the evidence at the moment a dispute becomes possible would help neither.

·Any flagged prompts. Otherwise closing an account would be a way to clear a record, which is the one thing those flags exist to prevent.

·Your usage and cost rows, with your identifier stripped out. The money has to reconcile. What is left does not say who spent it.

If anything in that first list is still there after you delete, that is a fault and we want to know. Write to privacy@intelligency.nl.

Under the GDPR you can ask us to:

·Give you a copy of the personal data we hold about you.

·Correct anything that is wrong.

·Delete it, which the button in your settings does immediately.

·Export what you have given us in a portable form. Your marks and files are downloadable from the app at any time.

·Stop or restrict a particular use, including anything we do on the basis of legitimate interest.

Email privacy@intelligency.nl. We will answer within a month, and sooner in practice. There is no charge. If we need to check who you are before handing over a copy of your data, we will ask for as little as possible to do it.

If you are not satisfied with how we have handled something, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl. We would rather you gave us the chance to fix it first.

Data is encrypted in transit and at rest. Access to the production database is limited to people who need it, and the tables holding your work are readable only by your own account. Payment card details never touch our systems.

No service is immune. If a breach happens that puts you at risk, we will tell the Autoriteit Persoonsgegevens within 72 hours and tell you without undue delay, in plain language, including what we do not yet know.

The version date is at the top of this page. If we change something that affects you, we will say so in the app rather than quietly editing the page, and the version date will move. Adding a processor, adding a tracking script, or changing how long we keep something all count as affecting you.