Privacy notice Version 0.4 — effective 2026-09-02, last updated 2026-09-02 Draft — pending legal review How Vielendark handles personal data it decides about itself: accounts, billing, support, operations and the AI feature. What this notice covers, and what it does not This notice is about data where Vielendark is the controller: the people who hold Popfinch accounts, the people they invite, the people who write to us, and the operational records of running the service. It is not about the data your widgets collect from your visitors. There you are the controller and we are your processor, on the terms in the data processing addendum. A visitor with a question about a form on your website should ask you, and we will say so if they ask us. Account users and invited members What: your email address, a hashed password or a Google sign-in identity, the organisation and role you hold, and the projects, widgets and settings you create. Required — there is no account without them. Why: to give you an account, to enforce who may see and change what, and to record who did what. Legal basis: performance of the contract, and our legitimate interest in a usable record of administrative actions. How long: until you delete the account, which deletes all of it. An invitation that is never accepted expires by itself. Billing contacts What: the company name, registration and VAT numbers, billing address and billing email you enter. Optional today — nothing is charged — and required once a plan is paid for. Why: to issue an invoice that names the right company. Legal basis: performance of the contract, and legal obligation for records that tax law requires to be kept. How long: for as long as the account exists, and afterwards for the period tax law requires an invoice to be retained. Recipient: Stripe, which processes the payment. What you type on their checkout page — the card, the billing address, a VAT number — is given to Stripe by you, not passed on by us: we never see a card number and do not store one. What comes back to us is which plan is running and whether it is paid. Support contacts What: your address and whatever you write to us, including anything you choose to include in a screenshot. Why: to answer you. Legal basis: performance of the contract, or our legitimate interest in replying to somebody who wrote to us but is not a customer. How long: as long as the correspondence is useful, and then deleted. Please do not send passwords or API keys; if you do, we will ask you to rotate them. Operational and security records What: the record of administrative actions in your organisation, a queue of operational emails and their delivery outcome, heartbeats from scheduled jobs, and the request logs our hosting provider keeps, which include IP addresses. Why: to keep the service running, to investigate an incident, and to be able to show who changed what. Legal basis: our legitimate interest in operating the service securely. How long: the activity record for as long as the organisation exists; the email queue until its entries expire, within days; provider request logs for the period that provider keeps them. One record outlives an account: that a termination happened, with the organisation's identifier, the date and how much was removed. It holds no name, address or user identifier, and it is kept so that a closure can be accounted for without keeping the person who asked for it. The AI designer What: the instruction you type, a summary of the widget, and any screenshot you attach. Why: to produce the draft you asked for. Legal basis: performance of the contract, on your request. It runs only when used. Recipient: Anthropic PBC in the United States, under standard contractual clauses. What Popfinch itself keeps is the model, the token counts and the cost, so the plan's allowance can be enforced — not the prompt, the screenshot or the output. The AI feature notice has the detail. Email we send you What: your address and the text of the notice — a failed delivery, a widget that has gone quiet, a daily operator digest. Why: to tell you about your own account. Legal basis: performance of the contract. These are operational rather than marketing. Which of them you receive is a setting in your account. No marketing email is sent, and no marketing consent is bundled into accepting the terms. Images and content you publish Images uploaded for a widget are stored in a public bucket and are readable by anyone holding the URL. Content you publish in a widget is shown to visitors of your website by design. Neither is private, and neither should carry personal data you did not intend to make public. Who receives data Not nobody. The service runs on other companies' infrastructure, and each is named with what reaches it in the subprocessor list: hosting, the database and sign-in, the AI feature when used, and email delivery. Beyond those, data is disclosed only where the law requires it, and we will tell you when that happens unless we are forbidden to. Nothing is sold, and nothing is used to train a model. Transfers outside the European Economic Area The database is in Ireland and the application's functions run in Dublin. Even so, data is not guaranteed to stay inside the EEA: the network that serves the widget script answers from wherever a visitor is, and the AI feature sends its input to the United States when used. Those transfers rely on the European Commission's standard contractual clauses. Your rights You can ask for a copy of your data, ask for it to be corrected or deleted, object to processing based on legitimate interest, ask for processing to be restricted, and ask for a portable copy. Write to privacy@popfinch.com. Most of it is faster to do yourself: the account screen deletes the account, the export button produces the leads as CSV, and the export and termination policy lists what is not yet exportable in a file. You can complain to the supervisory authority in the country where you live or work. In Slovakia that is the Office for Personal Data Protection, whose address is at the end of this notice. Automated decisions None. No decision producing legal or similarly significant effects is made about you or about your visitors by automated means. The AI designer writes drafts of widgets, which a person then publishes or does not. Changes This notice has a version and an effective date. A material change raises the version and account owners are told by email before it takes effect. --- Operator: Vielendark s. r. o., Cyprichova 2477/24, 831 53 Bratislava - mestská časť Rača, Slovakia. Registration number 55121250, tax number 2121872962, VAT number SK2121872962, registered in the Commercial Register of the Municipal Court Bratislava III, Section Sro, Insert No. 167007/B. Contact: hello@popfinch.com. Privacy: privacy@popfinch.com. Security: security@popfinch.com. Abuse: abuse@popfinch.com. Owner verification outstanding: these register details have not yet been checked against a current extract from the Commercial Register.