Datenschutzrichtlinie

Boldly AI S.R.L. (“Boldly”, “we”, “us”) is the controller of personal data processed through boldlywithai.com and related Studio products (the “Services”). Contact: hello@boldlywithai.com · Privacy: privacy@boldlywithai.com Registered office and company identifiers are listed on our Legal Notice / Impressum page (Bucharest, Romania). This Privacy Policy explains what we collect, why we process it, how long we keep it, with whom we share it, and your rights under the EU General Data Protection Regulation (GDPR) and applicable Romanian law.

Depending on how you use the Services, we may process: • Account data: name, email address, password hash or auth identifiers, language/locale preferences, role flags • Billing data: plan, order history, partial payment identifiers from Stripe/PayPal (we do not store full card numbers) • Usage data: feature usage, credit ledger entries, generation job metadata, approximate device/browser information, IP address, and security logs • Content you upload: images, videos, audio, text prompts, and similar inputs needed to run generations • Communications: support messages, email correspondence, and form submissions • Cookies and similar technologies: session, preference, and (where consented) analytics cookies — see our cookie controls on the site We do not intentionally collect special-category data. Please do not upload sensitive personal data unless it is necessary and lawful for your use case.

We process personal data to: • Provide and secure the Services, authenticate users, and maintain credit balances (contract / Art. 6(1)(b) GDPR) • Process payments, invoices, and tax records (contract and legal obligation) • Improve reliability, prevent fraud/abuse, and debug generation failures (legitimate interests) • Send transactional email (account, receipts, security). Marketing email only with consent or soft-opt-in where permitted, with unsubscribe • Comply with law, respond to lawful requests, and establish/exercise/defend legal claims (legal obligation / legitimate interests) Where we rely on consent (for example non-essential cookies), you may withdraw it at any time without affecting prior lawful processing.

To generate images, video, audio, or other outputs, we transmit your prompts and media inputs to infrastructure and model providers that perform inference on our behalf (subprocessors). Those providers process data under our instructions and their security commitments, subject to our agreements with them. Generation outputs and inputs may be stored temporarily or longer so you can retrieve results in your library, for abuse review, billing audits, and service improvement. You control what you upload; avoid uploading content you are not allowed to process.

We do not sell your personal data. We share data with processors and service providers who help us operate the Services, for example: • Hosting, CDN, and object storage (e.g. cloud infrastructure / Cloudflare R2 or similar) • Database and authentication (e.g. Supabase) • Payments (Stripe, PayPal) • AI inference providers (e.g. fal.ai and other model APIs used by specific Studio tools) • Email and transactional messaging providers • Analytics tools, where enabled and consented We may also disclose data if required by law, to protect rights and safety, or in connection with a merger, acquisition, or asset transfer (with appropriate safeguards).

Some subprocessors may process data outside the European Economic Area. Where that occurs, we use appropriate safeguards such as EU Standard Contractual Clauses and supplementary measures as required, unless an adequacy decision applies.

We keep personal data only as long as needed for the purposes above: • Account data: for the life of the account, then deleted or anonymized within a reasonable period after closure (unless longer retention is required) • Billing and invoice records: typically up to the period required by Romanian tax and accounting rules • Credit ledger and security logs: retained for auditing, fraud prevention, and dispute handling • Uploaded media and generation assets: retained while needed for your library and operations; we may purge inactive or orphaned files on a schedule • Support tickets: retained as needed to resolve issues and for limited follow-up Exact periods may vary by product; you can request deletion subject to legal exceptions (see Your Rights).

We use industry-standard measures appropriate to the risk, including encrypted transport (HTTPS), access controls, and least-privilege service credentials. No method of transmission or storage is 100% secure; please use a strong unique password and protect your login.

We use essential cookies required for login, security, and core site functions. Analytics or preference cookies are used according to your consent choices where required. You can manage non-essential cookies via our on-site preference banner (where shown) and via browser settings. Blocking essential cookies may break parts of the Services.

If you are in the EEA/UK (or otherwise protected by GDPR-equivalent rules), you may have the right to: • Access your personal data • Rectify inaccurate data • Erase data (“right to be forgotten”) in certain cases • Restrict or object to certain processing • Data portability for data you provided • Withdraw consent where processing is consent-based • Lodge a complaint with a supervisory authority (in Romania: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal — ANSPDCP) To exercise rights, email privacy@boldlywithai.com or hello@boldlywithai.com with enough detail for us to verify your identity and respond. We may need to retain some records where the law requires it (for example invoices).

The Services are directed to adults. We do not knowingly collect personal data from children under 16 (or a higher age required locally). If you believe a child provided data, contact us and we will take appropriate steps to delete it.

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. For material changes, we may provide additional notice (for example via email or an in-product message). Continued use after the effective date means you acknowledge the updated Policy, except where mandatory law requires explicit consent.

Privacy questions and GDPR requests: privacy@boldlywithai.com General contact: hello@boldlywithai.com Postal address: see Legal Notice / Impressum.