Privacy Policy

1.1Leonlogic s. r. o. ("ProduktShot", "we", "us", "our") protects your privacy. This policy explains how we handle personal data when you use ProduktShot at produktshot.com (the "Platform").

1.2It applies to visitors of our public pages, to account holders and to anyone who writes to us.

2.1The controller of your personal data is Leonlogic s. r. o., Osadná 2033, 991 26 Nenince, Slovak Republic, Company ID 52 514 901. Email: info@produktshot.com. You can also write to us through the contact page.

2.2As a company established in the European Union, we are subject to the General Data Protection Regulation (GDPR).

3.1Information you give us:

• Account: your name, email address, whether it is confirmed, your password (stored only as a hash), how you sign in (password, Google, email code, passkeys, two-factor authentication) and your language.
• Your content: the product photos you upload, the product pages you import and what they say, your prompts, settings and brand kit, and the images and other results we make.
• Billing: your plan and its billing period, and your Stripe customer number. Stripe holds your payment details; we never see your full card number.
• Messages: what you send through the contact form, with your name and email address.

3.2Information collected automatically:

• Credits: your balance and every credit spent, refunded, granted or bought.
• Devices and security: for each signed-in device, its IP address, browser and when it was last used; your IP address when you use a form or start an action, for rate limits and to stop abuse.
• Error reports: when something breaks, a technical report of the error, which can include your account ID and your IP address.
• How you use your account: which results you download, when an action needed more credits than you had, your visits to the Credits & plan page, the checkouts you start and the free trial steps. We keep this in our own database with your account, set no cookie for it and share it with no one.
• How you found us: when you create an account, we note the first of our pages you opened that day or the day before, which website sent you there (its address only, for example a search engine) and any campaign tags in the link, and the page you signed up from. To connect your visit and your sign-up without a cookie or anything stored in your browser, each public page reports its visit under a code computed from that day's random key, your IP address and your browser; we never store the IP address, and we delete the keys and the visits after two days, after which a code can no longer be tied to anyone. We skip this when your browser sends Do Not Track or Global Privacy Control. The note stays with your account and is deleted with it.
• Visit statistics, only if you accept analytics cookies in the cookie notice: which pages you visit, your device type and where you came from (Google Analytics).
• Ad measurement, only if you say yes to it in the cookie notice: whether you came to us by clicking one of our Google ads, and whether that click led to a sign-up or a purchase; for a purchase, the amount paid and an order number. Google receives this with the ad click identifier, your IP address and your browser's details (Google Ads). We send Google no name, email address or other contact details.

3.3We do not record your sessions, we use no retargeting and we do not personalise ads. Which cookies we set is on the Cookie Policy page.

• To provide the Platform: your account, your products, running the actions you start, and storing your results (performance of our contract with you).
• To bill you: plans, credit packs, invoices and your credit history (contract), and to keep invoices and payment records for as long as accounting and tax law requires (legal obligation).
• To keep the Platform secure and working: rate limits, abuse checks, error reports and fixing bugs (our legitimate interest in a secure, working service).
• To improve the Platform: seeing which results people download and where they run out of credits (our legitimate interest in a useful product; you can object at any time).
• To learn which of our pages help people find us: how you found us, noted once at sign-up (our legitimate interest in knowing what brings people to the Platform; you can object at any time).
• To answer you: support requests and contact messages (legitimate interest, or the contract when it is about your account).
• To send service emails: sign-in codes, email confirmation, receipts and notices about your account (contract). We send no marketing emails without your consent.
• To understand how the public pages are used, with Google Analytics, only if you say yes (consent). You can withdraw it at any time with Cookie settings in the footer.
• To learn whether our Google ads lead to sign-ups and purchases, with Google Ads conversion measurement, only if you say yes to ad measurement (consent). You can withdraw it at any time with Cookie settings in the footer or on Account › Data & privacy; we then delete its cookies in your browser.

4.1No decision with legal or similarly important effects on you is made by automated means alone.

5.1When you start an action, we send the photos, text and settings it needs to an AI provider, which runs the model and returns the result. Before an action runs, a language model checks the request against our rules.

5.2Our AI providers run models built by AI model makers, some of them in the USA; a request may reach the maker of the model it runs. We do not use your photos or results to train AI models, and our providers process them only to return the result.

5.3Your uploads and results are stored in private storage so you can find them in your library. They are deleted when you delete them or your account.

6.1We do not sell your personal data. We share it only with the recipients below, which process it on our behalf under a data processing agreement, and only as far as each one needs it. AI providers are listed by category; you can ask us which company each one is through the contact page.

Hetzner Online

What it does for us
Servers that run the site, the database and the background jobs

Where
Germany (EU)

Cloudflare

What it does for us
The network in front of the site (security, bot checks, the Turnstile check on forms), file storage (R2) for your uploads and results, and sending account emails and contact-form messages

Where
Cloudflare, Inc., USA; a global network

Stripe

What it does for us
Payments, subscriptions and invoices

Where
Stripe Payments Europe, Ireland (EU); transfers to the USA under the Data Privacy Framework

Sentry

What it does for us
Error reports from the site and the background jobs

Where
Germany (Sentry's EU data region)

Google (Google Analytics)

What it does for us
Visit statistics, only after you accept analytics cookies

Where
Google Ireland, Ireland (EU); processing in the USA under the Data Privacy Framework

An AI model hosting provider

What it does for us
Runs the AI models that make and edit images, videos and voices from your photos and prompts

Where
USA

An AI video model hosting provider

What it does for us
Runs the AI video models

Where
Singapore; processing in Malaysia, Indonesia or the EU

An AI language model provider

What it does for us
Runs the language models that write texts, read product labels and check requests against our rules

Where
USA

6.2Google Ads: if you say yes to ad measurement, Google Ireland Limited (Ireland) receives the ad measurement data described in section 3. Google uses it to report to us which ads led to sign-ups and purchases, under its own terms and privacy policy; it explains how it uses data from sites that use its services at policies.google.com/technologies/partner-sites. Google may process it in the USA under the EU–US Data Privacy Framework.

6.3Business customers can ask us for our data processing agreement through the contact page.

7.1Some of our processors (Cloudflare, Google (Google Analytics), an AI model hosting provider, an AI video model hosting provider, an AI language model provider) process data outside the European Economic Area. We protect these transfers with the European Commission's Standard Contractual Clauses, which are part of each provider's data processing agreement, and for US companies certified under it, the EU–US Data Privacy Framework. You can ask us for a copy of the safeguards.

• Data travels encrypted (HTTPS/TLS).
• Passwords are stored only as hashes. You can turn on two-factor authentication and passkeys under Account › Security.
• Your files sit in private storage and open only through links we create for your account, which expire.
• Only the people who run the Platform can reach its systems, and only as far as their work needs.

8.1No way of sending or storing data over the internet is completely secure, so we cannot promise absolute security. If a breach puts your rights at risk, we tell you and the authority as the law requires.

• Your account, content and results: as long as your account exists. When you ask us to delete your account, we delete them within 30 days.
• Invoices, payments and the credit history that belongs to them: 10 years after the year they relate to, because accounting and tax law requires it.
• Signed-in devices: a session ends after 7 days without use, or when you sign it out under Account › Security.
• IP addresses in rate limits: about one day.
• Server logs and error reports: up to 90 days.
• Contact messages: up to 24 months after the conversation ends.
• Google Analytics: up to 14 months, and only if you said yes.
• Google Ads cookies in your browser: 90 days, and only if you said yes to ad measurement.

• Access and portability: download your data yourself under Account › Data & privacy (Download my data), as a JSON file you can take to another service.
• Rectification: change your name and email under Account › Profile.
• Erasure: write to us through the contact page from the email address of your account.
• Restriction and objection: ask us to limit or stop processing we base on our legitimate interest.
• Withdrawing consent: change your answer at any time with Cookie settings in the footer, or on Account › Data & privacy. This does not affect what happened before.
• Complaint: you can complain to a data protection authority, in particular in the EU country where you live or work. Ours is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Galvaniho 7/B, 821 04 Bratislava, www.dataprotection.gov.sk.

10.1To use any of these rights, write to us at info@produktshot.com. We answer within one month.

11.1The Platform is for businesses and adults. Accounts are for people aged 18 or over, and we do not knowingly collect data from children. If we learn that we have, we delete it.

12.1We update this policy when what we collect or who we share it with changes. We tell you about important changes by email. The date of the last change is at the top of this page.

13.1Questions about your data: write to us through the contact page or at info@produktshot.com. Leonlogic s. r. o., Osadná 2033, 991 26 Nenince, Slovak Republic.