Privacy policy

Under the General Data Protection Regulation (EU) 2016/679 we explain how personal data is processed at 9o.pl.

1. Controller

Tomasz Benert, Trachslauerstrasse 6B, 8840 Einsiedeln, CH. Contact for data protection matters: admin@9o.pl

2. What data we process

Account data: e-mail address, encrypted password (hash), time of registration and confirmation, role in the system.
Image descriptions (prompts): the text you enter to create an image.
Created images together with model, format, file size and time of creation.
Billing data: top-ups and charges to your balance, amounts, currency, PayPal transaction reference.
Technical data: failed login attempts and error messages. We do not store IP addresses in plain text – for security and statistics we use only a hash value (SHA-256).

3. Purposes and legal bases

Providing the service, running your account and billing – Art. 6(1)(b) GDPR (performance of a contract).
Security (limiting login attempts, detecting abuse) – Art. 6(1)(f) GDPR (legitimate interest).
Accounting and tax obligations – Art. 6(1)(c) GDPR (legal obligation).

4. Recipients and transfers outside the EEA

To create an image, your description is transmitted to the AI provider you select:

Google Ireland Ltd. / Google LLC (Imagen models)
OpenAI Ireland Ltd. / OpenAI, L.L.C. (GPT Image models)

This involves a transfer to the USA, based on the European Commission's standard contractual clauses and, where the provider is certified, the EU-US Data Privacy Framework. The providers process the descriptions in order to generate the image; under their terms for programming interfaces they do not use them to train their models. We do not pass on your e-mail address or account data.

Payments are handled by PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. PayPal receives the data required for the payment; we neither receive nor store your card details.

E-mails are sent via the mail server of [hosting provider name]. The service is hosted at [hosting company, country].

5. Retention periods

Images and descriptions: for the period configured in the service (30 days by default), after which they are deleted automatically and permanently together with the file.
Account data: until the account is deleted.
Billing data: for the period required by tax law (in Poland generally 5 years) – also after account deletion, then without a link to your person.
Failed logins: only briefly, for the purpose of the lockout.

6. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability, and objection to processing based on a legitimate interest. A message to admin@9o.pl is sufficient.

You also have the right to lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw).

7. Cookies

We use strictly necessary cookies only: session identifier (login), a token protecting forms, an optional "stay signed in" cookie, and the settings for language and colour scheme. We use no analytics or advertising cookies and do not track you across other sites. That is why we show no consent banner – it is not required for necessary cookies.

8. Automated decisions

There is no solely automated decision-making producing legal effects concerning you. Image generation carries out your instruction; it does not evaluate you as a person.