Privacy Policy - Underpaint

Rockon sp. z o.o., ul. gen. Józefa Zajączka 30/1, 01-510 Warszawa, Poland, KRS 0000467123, NIP 5252557058, is the controller of personal data in Underpaint. Write to privacy@underpaint.io for anything in this policy. 1. What we process Account data: email, name, and the profile photo from Google if you use Google to sign in. Billing data: Stripe holds the card and the invoice. We store the plan, the seat count and the payment status. We do not store card numbers. Content: messages, files, brand notes, project knowledge and the names you ask us to hide. Technical data: logs with a shortened IP address, and usage records (who called which model, and the cost). 2. Why, and the legal basis To provide the workspace you asked for: contract, GDPR article 6(1)(b). To keep invoices: legal duty, article 6(1)(c). To keep the service secure and to stop abuse: legitimate interest, article 6(1)(f). You can object. Email marketing only if you opt in, with the box unticked by default: consent, article 6(1)(a). You can withdraw consent at any time. 3. Who is controller, who is processor On a Solo plan we are the controller of the content you upload. On a Team or Agency plan you are the controller of personal data inside your client content, and we are the processor. The data processing agreement applies to that content. We remain the controller of your account, billing and security logs. 4. Anonymisation before a model Every model call goes through the same step. Names you add to a client's hide list are replaced with placeholders. The filter also replaces contact details it recognises: email addresses, phone numbers, IBANs and card numbers. The model receives the text with those placeholders. When the answer comes back, the placeholders are turned back into the original words, and that is the answer you read. The rest of the sentence goes to the model as you wrote it. The hide list and the contact-detail filter are the layer in front of the model. 5. Where the data sits The application, the database and the files are hosted in the European Union. A model call is sent to the provider that runs that model, through OpenRouter. Some of those providers process the call outside the European Economic Area, including in the United States. Where the provider is certified under the EU-US Data Privacy Framework, we rely on that certification. Otherwise we rely on the standard contractual clauses. The providers are listed on the subprocessors page. 6. Who else receives data Stripe, for payments. Brevo, for transactional email (sign-in links, invitations, billing notices). Google, if you sign in with Google. OpenRouter and the model providers, for the model call after the step in section 4. The EU host of the application, database and files. The list, with country and purpose, is the subprocessors page. 7. How long we keep it The account, until you delete it. Workspace content, until you delete it, or 30 days after the workspace closes. Invoices, for 5 years. Logs and backups, for 30 days. 8. Your rights You can ask for access, correction, deletion, restriction, and a copy of the data you provided. You can object to processing based on legitimate interest. You can complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa. Export and account deletion are in Settings. Write to privacy@underpaint.io if you need help with a request. 9. Training We do not train models on your content. The OpenRouter account is set to skip providers that train on customer inputs, where that setting is available for the model in use.