Privacy Notice

We collect the email address you sign up with, the words you type into briefs and prompts, and the work the service generates from them. We send your prompts to the AI providers named in section 5 because that is how a mark gets made. We do not advertise, profile you, or sell anything about you to anyone. You can delete your account and your work at any time, and what that actually removes is set out in section 8.

Intelligency B.V., Herengracht 449 A, 1017 BR Amsterdam, the Netherlands, registered with the Dutch Chamber of Commerce under KVK 42159659. We are the data controller.

For anything in this notice, including a request to see or delete your data, write to privacy@intelligency.nl. A person reads that mailbox.

We are not required to appoint a Data Protection Officer and have not appointed one. The address above reaches the people who make these decisions.

To give you an account and run the service. Legal basis: performance of our contract with you.

·Your email address, and a password or the fact that you signed in with Google. We never see your Google password.

·Everything you make. Brand names, briefs, positioning and tone of voice, the prompts you write, and the marks, colourways, typography, mockups and messaging generated from them.

·Reference images you upload, and a record that you uploaded them.

·Your credit balance and the history of credits bought and spent.

To answer an enquiry about hiring us. Legal basis: steps you asked us to take before entering into a contract.

·The brief you sendfrom a “Request a quote” or “Talk to a brand manager” button: your name, email address, optionally your company and website, and your answers about the project, its timeline and budget. Nothing is stored until you press Send. If you then book a call, that booking is made in Google Calendar. We use it to reply to you and to prepare a quote, and you receive a copy by email.

To take payment and keep our books. Legal basis: contract, and legal obligation for the tax records.

·Order records: what was bought, when, for how much, and the email address it was bought with. Card details go to Stripe and never reach us.

To keep the service working and pay for it. Legal basis: our legitimate interest in running a service that stays up and does not lose money.

·Usage records: which generator you used, when, and what the underlying API call cost us. This is how credits are priced and how capacity is planned.

·Technical logs kept by our hosting provider: IP address, browser, and the pages requested.

To tell you when something is wrong, and to hear it from you. Legal basis: your consent for status emails, and our legitimate interest in fixing what is broken for reports.

·Status updates by email. If you ask for updates on our status page, we keep your email address to tell you when an incident starts, changes and ends, and before planned maintenance. Nothing is sent until you confirm from the email we send you, and every update carries a link to stop them.

·Problems you report.If you use “Report a problem” while signed in, we keep what you wrote, which part of the platform it was about, your account and email address, the page you came from and your browser type, so we can find the fault and reply to you. A report never appears on the status page.

To prove what was agreed, and to act on misuse. Legal basis: our legitimate interest in being able to establish and defend a legal claim.

·Consent records: which version of our terms and upload conditions you accepted, when, and a cryptographic hash of the exact words that were on screen.

·Flagged prompts.If a prompt appears to name someone else's brand, the text is recorded so a person can look at it. Nothing is blocked automatically and nothing is decided about you by software alone.

We do not ask for and do not want any special category data: nothing about your health, beliefs, politics, ethnicity, or sex life belongs in a brand brief. We do not knowingly collect data from anyone under 18, and the Terms require you to be 18 or older.

·We do not sell your personal data, and we do not share it for advertising.

·We do not use your briefs, prompts or generated work to train our own models. We have no models of our own.

·We do not build a profile of you, and no decision about you is made by software alone.

·We do not put your work in the marketplace. Marks offered for sale there come from our own library, never from a customer's account.

The service is assembled from other companies' infrastructure, so some of your data necessarily reaches them. Each one acts on our instructions, for the single purpose listed, under a data processing agreement. This is the complete list.

On the AI providers and training. We send them your prompt to do one job, and we grant them no licence to do anything else with it. What each provider may retain, and for how long, is governed by its own terms, and those terms differ between them. We are asking each for its position in writing and will name it here rather than summarise it for them.

Transfers outside the EU.Most of the companies above are established in the United States. Where data reaches them we rely on the European Commission's Standard Contractual Clauses, and on the EU-US Data Privacy Framework where the provider is certified under it. You can ask us for the details that apply to a particular provider.

We will also disclose data where the law requires it, and to our accountant and professional advisers where they need it to do their work.

·Your account and your work: until you delete it, or until you ask us to.

·Reference images you upload: 30 days, then the file is deleted automatically. The record that an upload happened is kept, because it is what lets us answer a rights holder about an upload from last year.

·A brief you sent us: if it does not become a project, it is deleted automatically 12 months after we last acted on it. If it does, it becomes part of the client record.

·Status updates by email: until you unsubscribe. An address that was never confirmed is deleted after 7 days.

·Problems you report: deleted automatically 12 months after you send them.

·Orders and invoices: seven years. Dutch tax law requires it and we have no discretion here.

·Consent records and flagged prompts: as long as a claim arising from them could still be brought, then deleted.

·Usage and cost records: kept for accounting, with your account identifier removed when your account is deleted. What remains is a record of an API call, not of a person.

·Technical logs: as long as our hosting provider keeps them, which is a matter of weeks.

Today the service sets only what it needs to work: a cookie that keeps you signed in, and one that remembers you have been given early access while the site is still behind a holding page. Neither tracks you and neither needs your consent.

There is no analytics, advertising or social media script anywhere in the service. We intend to add our own analytics, and when we do you will be asked first, in a banner where refusing is exactly as easy as accepting. Until that banner exists, nothing is measuring you.

There is a delete button in your account settings. It does not queue a request for someone to action later; it runs immediately. This section describes exactly what it does, because a vague promise here is the easiest kind to break.

Deleted straight away:

·Your sign-in, your profile, and your email address. You will not be able to log in again, and we will not be able to identify you.

·Every brand, mark, palette, typography choice, mockup and piece of messaging you made, including the ones in the library and the ones you never used.

·Your reference uploads, your credit balance, and your credit history. Any unspent credits are gone and cannot be recovered or refunded.

·Your entry on the waiting list, any brief you sent us, and any status email subscription, if you used the same address.

·Any problems you reported from the status page.

·The generated image and vector files themselves, which are removed from storage within a day. They are scheduled the moment you press delete; an account can hold tens of thousands of files, and doing that inside the button press would risk stopping halfway.

Kept, and this is the whole list:

·Invoices for anything you bought, for seven years, because Dutch tax law requires it.

·The record that you accepted our terms and upload conditions. That record exists to protect both of us, and deleting the evidence at the moment a dispute becomes possible would help neither.

·Any flagged prompts. Otherwise closing an account would be a way to clear a record, which is the one thing those flags exist to prevent.

·Your usage and cost rows, with your identifier stripped out. The money has to reconcile. What is left does not say who spent it.

If anything in that first list is still there after you delete, that is a fault and we want to know. Write to privacy@intelligency.nl.

Under the GDPR you can ask us to:

·Give you a copy of the personal data we hold about you.

·Correct anything that is wrong.

·Delete it, which the button in your settings does immediately.

·Export what you have given us in a portable form. Your marks and files are downloadable from the app at any time.

·Stop or restrict a particular use, including anything we do on the basis of legitimate interest.

Email privacy@intelligency.nl. We will answer within a month, and sooner in practice. There is no charge. If we need to check who you are before handing over a copy of your data, we will ask for as little as possible to do it.

If you are not satisfied with how we have handled something, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl. We would rather you gave us the chance to fix it first.

Data is encrypted in transit and at rest. Access to the production database is limited to people who need it, and the tables holding your work are readable only by your own account. Payment card details never touch our systems.

No service is immune. If a breach happens that puts you at risk, we will tell the Autoriteit Persoonsgegevens within 72 hours and tell you without undue delay, in plain language, including what we do not yet know.

The version date is at the top of this page. If we change something that affects you, we will say so in the app rather than quietly editing the page, and the version date will move. Adding a processor, adding a tracking script, or changing how long we keep something all count as affecting you.