PRIVACY POLICY

Data you provide:

• Account data: name, email address, password (stored encrypted, as a hash).
• Billing data: billing name and address. Full card numbers are collected and processed directly by Stripe and are never stored on our servers.
• AI input data: prompts, texts, and files submitted to the AI Features, as well as the results generated for you.
• Integration data: when you connect third-party accounts through the Composio-powered integrations, we receive account identifiers and the content needed to perform the requested actions. OAuth credentials are managed by Composio.
• Communications: messages and support requests sent to hello@daddyfreud.com.

Data collected automatically:

• Usage data: pages viewed, features used, timestamps, referral URLs.
• Log data: IP address, browser type, operating system, device identifiers, approximate location derived from IP.
• Cookies and similar technologies: see Section 4.

We do not sell your personal data. We do not use it for cross-context behavioural advertising.

The AI Features are provided through Claude managed agents using Anthropic’s commercial AI services. When you use the AI Features:

• Prompts, input data, and related metadata are transmitted to Anthropic to generate results, and the results are returned to you.
• Claude inputs and outputs are not used for model training under our commercial AI configuration. Retention for service operation and abuse prevention is separate and governed by the applicable provider agreement.
• The provider's practices may change; its policy governs its processing. Do not transmit confidential or special-category data through the AI Features unless you accept such processing.

We use necessary cookies for authentication, security and payments. Non-essential cookies require consent before activation.

You can block or delete cookies from your browser settings; blocking strictly necessary cookies may affect the functioning of the Service. If we ever add non-essential cookies, we will obtain your consent first through a banner.

We share data with the following sub-processors, each under data protection contractual clauses:

We also disclose data: (a) to comply with the law or legal process; (b) to protect our rights, property, or safety; (c) in connection with a merger, acquisition, or sale of assets, with notice; (d) at your request.

Cloudflare, Supabase and other providers may process data outside the EEA. Transfers are subject to applicable safeguards and data processing agreements. Details are available on request.

• Account data: for the lifetime of the account, plus 30 days after deletion.
• Billing and transaction records: up to 10 years, under Romanian accounting and tax law (Law no. 82/1991).
• AI prompts and results: for the lifetime of the history in your account; provider-level logs for up to ~30 days.
• Server and security logs (Cloudflare, Supabase): up to 30 days.
• Backups: rotating, ~30 days, then overwritten.

We use TLS encryption in transit, encryption at rest where applicable, workspace access controls, Supabase row-level security (RLS) policies, and vendor security reviews. Privileged backend operations are separately authorized. Stripe is PCI DSS Level 1 certified. No system is 100% secure and we cannot guarantee absolute security.

You have the right to:

• access your personal data (Art. 15)
• rectification of inaccurate data (Art. 16)
• erasure of your data (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• object to processing based on legitimate interest (Art. 21)
• withdraw consent at any time, without affecting prior processing (Art. 7(3))

To exercise any right, write to hello@daddyfreud.com. We will verify your identity and respond within one month.

You also have the right to lodge a complaint with our supervisory authority: the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Bucharest, Romania — https://www.dataprotection.ro.

The Service is not directed at children under 16 years of age (the digital age of consent in Romania) and we do not knowingly collect their data. If you believe a child has provided us with data, contact us and we will delete it.

We will publish changes here and update the effective date. Substantial changes affecting your rights will be notified at least 14 days in advance, where required.

DADDY FREUD S.R.L.

Str. Petre Tutea nr. 24, Oradea, Bihor County, Romania

hello@daddyfreud.com