Privacy Policy

This Privacy Policy explains how Grymala Sp. z o.o., ul. Nowogrodzka 31/414, 00-511 Warsaw, Poland ("Grymala", "we", "us") collects, uses, shares, stores and protects personal data when users use our mobile applications, websites and related services.

This Policy applies to all mobile applications, websites, digital products, features, content, tools and related services published, operated or made available by Grymala, unless a separate privacy policy is provided for a specific product or service.

1. Who is responsible for data processing

Grymala Sp. z o.o. is the data controller for personal data processed under this Policy.

Users can contact us about privacy matters at grymala.pl@gmail.com.

If we appoint a Data Protection Officer or another privacy representative, we will provide the relevant contact details in this Policy.

2. Data we may process

Depending on the product, app, device, platform, country, account type, subscription status and features used, we may process the following categories of data:

Account and contact data, such as name, email address, account identifiers, sign-in provider information, authentication information, subscription status, support messages, contact forms, feedback and related communications.

User content, such as photos, videos, audio recordings, documents, scans, text, notes, prompts, AI requests, AI outputs, generated content, projects, files and other materials uploaded, imported, created, saved, processed or shared through our products.

Device and technical data, such as device model, operating system, app version, language, region, IP address, app installation identifiers, anonymous app identifiers, device identifiers, advertising identifiers where permitted, crash logs, diagnostics, performance data, configuration data and security logs.

App usage data, such as feature usage, onboarding events, screen views, user actions, project actions, subscription screen interactions, purchase status, ad interactions, attribution events, errors, session information and other product interaction data.

Permission-based data, such as camera, microphone, photos, files, location, motion, depth, augmented reality, sensor or similar data, where needed for the feature the user chooses to use.

Purchase and subscription data, such as product identifiers, offering information, purchase tokens, receipts, entitlement status, renewal or cancellation status and transaction identifiers received from app stores or subscription infrastructure providers.

Advertising, attribution and consent data, such as ad requests, impressions, clicks, install attribution, campaign parameters, consent choices, privacy settings and advertising identifiers where allowed by the user, platform rules and applicable law.

Wellness, educational, productivity, design, creative or other feature-related data, where relevant to products that provide related functionality. Such features are for informational purposes and should not be treated as professional advice unless expressly stated otherwise.

3. How we collect data

We collect data when users provide it directly, create or upload content, scan or record content, use AI or cloud features, create or access an account, purchase or restore a subscription, contact support, interact with ads, or use product features that generate technical, analytics, crash, diagnostic or attribution data.

Some data is processed locally on the device. Some data may be transmitted off the device when required to provide a selected feature, such as cloud sync, backup, AI processing, content processing, analytics, crash reporting, security, advertising, attribution, push messaging, subscription management or customer support.

Some products may operate without a named user account but may still use anonymous or pseudonymous identifiers for subscriptions, analytics, attribution, ads, fraud prevention, app settings and product functionality.

4. Why we use data

We use data to provide, maintain, secure and improve our products; deliver requested features, content, tools and services; process, analyze, generate, store, sync, export or share content; manage accounts and subscriptions; provide support; analyze performance; test and configure product features; fix bugs; prevent fraud and abuse; measure marketing performance; show ads where permitted; and comply with legal obligations.

5. Legal bases under GDPR

Where the General Data Protection Regulation (GDPR) applies, we rely on one or more legal bases depending on the context: performance of a contract, consent, legitimate interests and legal obligations.

Performance of a contract means processing needed to provide the product or a feature requested by the user. Consent means the user has agreed to optional processing, such as certain permissions, tracking, personalized advertising or AI/cloud processing where consent is required. Legitimate interests may include security, fraud prevention, diagnostics, non-personalized analytics, attribution, product improvement and responding to user requests. Legal obligation means processing required by law, accounting, tax, platform or regulatory obligations.

Users may withdraw consent where processing is based on consent. Withdrawal does not affect processing that happened before consent was withdrawn.

6. AI, cloud and on-device processing

Many product features process data locally on the user's device. Local processing means the relevant data may remain on the device unless the user chooses a feature that requires sharing, cloud storage, AI processing, support, backup, export or another off-device action.

Some features may send user content to external AI, cloud, content-processing, storage, database, hosting or infrastructure providers. This may include photos, audio, video, documents, text, prompts, metadata, generated content and other outputs.

These providers may include, depending on the product and feature used, providers such as Google/Firebase, Google Gemini, OpenAI, cloud storage providers, app store providers, subscription infrastructure providers and other technical service providers.

We use these providers to deliver the features requested by the user, such as content analysis, content generation, automation, file processing, cloud storage, synchronization, export, account access, support and other product functionality.

We do not sell user content. We require service providers to protect data and use it only to provide services to us, unless users are clearly informed otherwise and applicable consent is obtained.

Users should not upload content they are not allowed to share or content that contains sensitive personal data unless they understand and accept that it may be processed by external providers for the selected feature.

AI-generated results may be inaccurate, incomplete or unsuitable for important decisions. They should not be treated as professional, medical, legal, financial, architectural, engineering, educational, safety or other expert advice.

6.1 Third-party AI consent

Some AI-powered features may require sharing certain user data with a third-party AI provider or another external processing provider in order to provide the feature requested by the user.

Where required, before sending personal data to a third-party AI provider, the app will show a consent notice that explains the categories of data that may be sent, the provider or type of provider that may receive it, and the purpose of the processing.

If the user does not give consent, the app will not send the relevant data to the third-party AI provider for that feature, and AI-powered features that require such processing may not be available.

Where available, users may manage or withdraw AI processing consent through in-app settings or by contacting us.

We do not share payment information with third-party AI providers.

7. Sharing with third parties

We may share data with categories of third parties that help us operate, secure, analyze, monetize and improve our products. These may include cloud and infrastructure providers, AI and content-processing providers, analytics and diagnostics providers, attribution and marketing analytics providers, advertising networks and mediation partners, consent-management providers, app stores and payment platforms, subscription-management providers, push notification or messaging providers, support and communication providers, legal advisors, auditors and authorities where required by law.

Examples of providers or platforms that may be used in our products include Google/Firebase services, Google Play, Apple services, RevenueCat, advertising partners, attribution partners and AI providers such as OpenAI or Google Gemini, depending on the product, platform, country, version and feature.

The exact providers may vary by product, platform, country, version and feature. We aim to keep our App Store and Google Play privacy disclosures consistent with the data practices of each product.

8. International transfers

We are based in Poland. Some providers may process data in other countries, including outside the European Economic Area. Where required, we rely on appropriate safeguards such as adequacy decisions, Standard Contractual Clauses, data processing agreements or other lawful transfer mechanisms.

9. Retention

We keep personal data only for as long as reasonably necessary to provide the services, fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, enforce our agreements, maintain security, prevent fraud, support business operations and as otherwise permitted by applicable law.

Retention periods may vary depending on the type of data, the product or feature used, account status, subscription status, user choices, provider requirements, backup cycles, legal requirements and technical limitations.

Some user content may remain on the user's device until the user deletes it, clears app data or uninstalls the app. Content saved to the user's gallery, exported files, shared copies or recipient apps may remain under the user's or recipient's control and may not be deleted when data is deleted inside our products.

When personal data is no longer needed, we delete, anonymize or aggregate it in accordance with our retention practices and technical limitations.

10. Deletion and account deletion

Users may delete certain files, projects or product content inside the app where this functionality is available.

If a product allows account creation, users may request deletion of their account and associated data through the product where available, by contacting us, or through a web resource that we provide for account/data deletion requests.

Even where a product does not provide a named user account, users may contact us to request deletion of personal data associated with support requests, cloud records, subscription identifiers, analytics identifiers or other data we can reasonably locate and delete.

Deletion may not remove data that we are required or allowed to keep for legal, security, fraud prevention, accounting, tax, dispute-resolution, backup or technical reasons. Where we retain such data, we keep it only for the relevant purpose and period.

11. User rights

Depending on the user's location, users may have rights to access, correct, delete, restrict or object to processing of their personal data, receive a portable copy of data, withdraw consent, opt out of certain advertising or tracking, and lodge a complaint with a data protection authority.

Users in Poland or the European Union may contact the Polish supervisory authority, Prezes Urzedu Ochrony Danych Osobowych (UODO), or another competent EU supervisory authority.

12. Permissions and privacy choices

Users can control many data practices through iOS or Android permission settings, App Tracking Transparency settings on iOS, advertising ID settings, consent or privacy forms where available, in-app privacy/account/subscription settings, Apple App Store or Google Play account settings, and by contacting us.

If a user denies a permission, some features may not work. We aim to request permissions only when they are relevant to the feature being used.

13. Security

We use reasonable technical and organizational measures designed to protect personal data, including encryption in transit, access controls, security monitoring and provider security controls. No system is completely secure, and we cannot guarantee absolute security.

14. Ads, analytics, attribution and tracking

Some products may use analytics, attribution, advertising, consent-management or similar technologies. These technologies help us understand product performance, improve features, measure marketing campaigns, detect issues, manage subscriptions and show ads where permitted.

Where required, we ask for consent before personalized advertising, tracking or access to advertising identifiers. If users decline, they may still see non-personalized ads or limited measurement may still occur where permitted by law and platform rules.

Some product versions may use advertising networks, mediation partners, attribution providers or platform attribution technologies to measure installs, sessions, purchases, trials, subscriptions, ad impressions, clicks and similar events.

We do not sell personal and sensitive user data as defined by Google Play policies.

15. Product-specific differences

Not every product, app or feature collects or processes every category of data described in this Policy. Data practices may vary depending on the product, app version, platform, country, account type, subscription status, permissions, consent choices and features used.

Some products may process data locally on the device, while others may use cloud, AI, analytics, advertising, attribution, subscription, storage, support or other service providers to deliver selected functionality.

16. Children

Our products are not intended for children under the age required by applicable law without parental consent. We do not knowingly collect children's personal data where prohibited. If we learn that we have collected such data without required consent, we will take appropriate steps to delete it.

17. Changes

We may update this Policy when our products, providers, laws or data practices change. We will post the updated version on this page and update the Last updated date. Where required, we will notify users or request consent before material changes take effect.

18. Contact

Grymala Sp. z o.o., ul. Nowogrodzka 31/414, 00-511 Warsaw, Poland. Privacy contact: grymala.pl@gmail.com. Website: https://www.grymalaltd.com.