Privacy Policy

I. Identification of the Controller

• Company name: PS:Digital, s.r.o.
• Registered office: Šustekova 5, Bratislava – Petržalka 851 04, Slovak Republic
• Company ID (IČO): 47 585 439
• Tax ID (DIČ): 2024008140
• VAT ID (IČ DPH): SK2024008140
• Registration: Commercial Register of the Municipal Court Bratislava III, Section: Sro, File No.: 95596/B
• Email: team@avocaido.com
• Phone: +421 910 760 011
• Web: https://avocaido.com

II. Who This Policy Is For

This Policy is intended for:

• representatives of our B2B clients (marketing agencies, graphic studios),
• individual creators and designers (users of the Service),
• natural persons using the Service as consumers (B2C),
• visitors to the website https://avocaido.com.

The Service is intended exclusively for persons aged 16 or older. This age restriction arises from Art. 8 of the GDPR, according to which persons under 16 require the consent of a legal guardian for the processing of their personal data in the context of information society services. Due to the administrative and technical complexity of verifying such consent, we do not provide the Service to persons under 16.

III. Purposes, Legal Bases, and Retention Periods

We process your data only to the extent necessary for the following purposes:

The retention period for content uploaded and generated within the Service varies depending on the type:

• Reference photographs for style analysis: retained for the duration of the account.
• Reference photographs for image generation: automatically deleted 14 days after upload.
• Generated content (images): retained for the duration of the account.

IV. Data Processing Through AI Models (Transparency)

In accordance with the EU AI Act and the principle of transparency, we inform you that AvocAIdo uses third-party artificial intelligence (AI) systems for content analysis and generation. Your inputs (text prompts and reference photographs) are sent to AI processors (primarily OpenAI, Google, Replicate, and Kie.ai) solely for the purpose of providing the Service.

Important safeguards:

• Model training: According to the published terms of OpenAI, Google, and Kie.ai, data sent through their production API interfaces is not used by default to train their models. For Replicate, we rely on their published terms and direct communication with the provider.
• AI content labelling: All outputs generated by the Service contain an "AI Generated" tag in the metadata (EXIF) in accordance with Art. 50(2) of the AI Act. The system also indicates that the content was generated via avocaido.com and identifies the specific AI model used.
• Human oversight: AI systems generate outputs based on your instructions. AvocAIdo does not perform automated decision-making that would have legal effects on you.
• Classification under the AI Act: AvocAIdo is not a high-risk AI system within the meaning of Annex I or Annex III of the AI Act. It is a generative AI system with so-called "limited risk," subject exclusively to transparency obligations under Art. 50 of the AI Act.

V. Sub-Processors (Data Recipients)

In providing the Service, we use the following sub-processors, with whom we have entered into data processing agreements:

Stripe acts as an independent controller within the meaning of the GDPR with respect to payment card data, and simultaneously as the Merchant of Record for payment processing and VAT remittance purposes. Payment card details are not accessible to us.

The transfer of personal data outside the European Economic Area is carried out exclusively in accordance with Chapter V of the GDPR, on the basis of the EU-US Data Privacy Framework or Standard Contractual Clauses (SCCs) approved by the European Commission.

VI. Google Login (Google OAuth)

If you choose to register or log in via Google, Google Ireland Limited will provide us with your name, email address, language preferences, and profile picture. We use this data exclusively for the creation and personalisation of your AvocAIdo account.

VII. Cookies and Tracking Technologies

1. Essential technical cookies (session cookies): Managed via Supabase Auth, these are necessary to ensure your login session and the basic functionality of the Service. These cookies do not require your consent.
2. Analytical and marketing cookies (Google Tag Manager): For measuring website traffic and evaluating website effectiveness, we use Google Tag Manager operated by Google Ireland Limited. These cookies are activated exclusively on the basis of your explicit consent given via the cookie banner upon your first visit. You may withdraw your consent at any time in the cookie settings.

VIII. Data Security

We have implemented strict technical and organisational measures:

• Encryption: All communication is carried out via the encrypted SSL/TLS protocol.
• Authentication: Passwords are hashed and managed via Supabase Auth (bcrypt).
• Data isolation: We use Row Level Security (RLS) at the database level, ensuring that only you have access to your data.
• Access: Access to backend systems is restricted to authorised personnel of the Controller only.

IX. Retention Periods and Data Deletion After Account Cancellation

We retain your personal data only for the period necessary to fulfil the purpose for which it was collected, or for the period required by law.

After the cancellation of your account, data deletion proceeds as follows:

1. Immediate deletion from production systems: Upon receipt of an account cancellation request, your personal data (email, prompts, reference photographs for style analysis, generated images, style library, generation history) is deleted without undue delay from the active database and storage. Reference photographs for image generation that have not yet been automatically deleted under the 14-day retention period are deleted together with the account. The account is deactivated and access to the Service is blocked.
2. Backup copies (up to 7 days): Our infrastructure creates automatic daily database backups with a 7-day retention. Your data may remain in these encrypted backups for a maximum of 7 days from its deletion from the production environment, after which it is permanently overwritten through the standard backup rotation.
3. Statutory exceptions: Data that we are required to retain under specific legislation remains stored for the applicable statutory period:
   • accounting documents (invoices, transactions): 10 years pursuant to Act No. 431/2002 Coll. on Accounting
   • data necessary for the enforcement or defence of legal claims: until the final conclusion of proceedings

You may submit a data deletion request at any time by emailing team@avocaido.com.

X. Rights of Data Subjects

In connection with the processing of personal data, you have the following rights:

• Right of access: You have the right to know what data we process about you.
• Right to rectification: You have the right to correct inaccurate or supplement incomplete data.
• Right to erasure ("right to be forgotten"): You may request the deletion of data if it is no longer needed or if you withdraw consent.
• Right to restriction of processing: In specific cases, we may temporarily restrict processing.
• Right to data portability: You have the right to receive your data in a structured format and transfer it to another controller.
• Right to object: You have the right to object to processing based on our legitimate interest.
• Right to withdraw consent: If we process data based on consent, you may withdraw it at any time in your profile settings, cookie settings, or by clicking the link in an email.

You may exercise your rights by sending a request to: team@avocaido.com. We will respond within 30 days of receipt.

If you believe your rights are being infringed, you have the right to file a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, web: https://dataprotection.gov.sk, email: statny.dozor@pdp.gov.sk.

XI. Automated Decision-Making and Profiling

The Controller does not perform automated individual decision-making with legal effects pursuant to Art. 22 of the GDPR. AI image generation is a creative tool and does not constitute profiling or decision-making with legal impact on the User.

XII. Changes to This Policy

We may update this Policy from time to time (e.g., upon adding new AI sub-processors, changing analytical tools, or changes in legislation). We will inform you of material changes by email or directly in the AvocAIdo application.