Privacy Policy

1. Introduction

Welcome to Grafics ("we," "us," or "our"). Grafics is a product of Reeply B.V., a company registered in the Netherlands. We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website grafics.io and our services.

We comply with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Data Controller

The data controller responsible for the processing of your data is:

3. Information We Collect

We collect and process the following types of information:

3.1 Personal Data You Provide

• Account Information: When you register, we collect your name, email address, and authentication credentials (via Clerk).
• Payment Information: If you make a purchase, our payment processor (Stripe) collects your payment details. We do not store full credit card numbers on our servers.
• Content Data: Text prompts, images, and other content you upload or generate using our AI services.
• Communication: Data you provide when you contact our support team (via Crisp or email).

3.2 Automatically Collected Data

• Usage Data: Information about how you interact with our platform, including pages visited, time spent, and features used (via PostHog).
• Technical Data: IP address, browser type, device information, and operating system.
• Cookies and Pixels: We use cookies and tracking pixels (such as Meta Pixel) to improve our service and for marketing purposes.

4. How We Use Your Data

We process your data for the following purposes and legal bases:

5. Third-Party Services and Processors

We use trusted third-party service providers to operate our platform. These providers may process your data on our behalf. We ensure that data processing agreements (DPAs) are in place with these providers.

• Hosting & Infrastructure: Vercel Inc. (USA) - Website hosting.
• Authentication: Clerk (USA) - User authentication and identity management.
• Database: MongoDB Atlas (EU region) – Data storage. Primary databases are hosted within the European Union.
• File Storage: Uploadthing (EU region) – File uploads and storage. Files are stored within the European Union.
• Payments: Stripe (USA/EU) - Payment processing.
• Analytics: PostHog (USA/EU) - Product analytics and usage tracking.
• Marketing: Meta Platforms Ireland Ltd. (Meta Pixel) - Advertising and conversion tracking.
• AI Content Generation: Google LLC (Gemini API via Google Cloud) – AI image and content generation. When using paid Gemini API services, Google processes prompts and outputs as a data processor and does not use them to train or improve its models.
• AI Text Generation: OpenAI (USA) – AI-powered text generation for content assistance.
• Email: Resend / Nodemailer - Transactional emails.
• Customer Support: Crisp IM SARL (France) - Chat support.

Primary infrastructure and databases are hosted within the European Union. Some service providers (e.g. Vercel, Clerk, OpenAI) are located outside the European Economic Area (EEA). In such cases, we ensure appropriate safeguards are in place, including the EU-US Data Privacy Framework, Standard Contractual Clauses (SCCs), and Data Processing Addendums (DPAs). For paid Gemini API services, Google processes data under its Data Processing Addendum and applicable Standard Contractual Clauses (SCCs) where required.

6. Analytics and Tracking Tools

6.1 PostHog

We use PostHog to understand how users interact with our website. PostHog collects data such as page views, button clicks, and session duration. This helps us improve the user experience.

6.2 Meta Pixel

We use the Meta Pixel (Facebook Pixel) to track the effectiveness of our advertising campaigns and to show you relevant ads on Meta platforms (Facebook, Instagram). This involves the collection of data such as your IP address and browser information. You can manage your advertising preferences in your Facebook settings.

7. Your Rights (GDPR)

As a user in the EEA, you have the following rights:

• Right of Access: You can request a copy of your personal data.
• Right to Rectification: You can request correction of inaccurate data.
• Right to Erasure: You can request deletion of your data ("Right to be forgotten").
• Right to Restriction: You can request us to limit the processing of your data.
• Right to Data Portability: You can receive your data in a structured, machine-readable format.
• Right to Object: You can object to processing based on legitimate interests or for direct marketing.
• Right to Withdraw Consent: Where processing is based on consent, you can withdraw it at any time.

To exercise these rights, please contact us at contact@reeply.net.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, or reporting requirements. When your account is deleted, we will remove your personal data from our active databases, though some data may be retained for legal obligations. Prompts and AI-generated content are stored only for the duration necessary to provide the service and are not used for model training by us or our AI providers under paid API agreements.

9. Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet is 100% secure.

10. Updates to this Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on this page and updating the "Last updated" date.

11. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: