DRAFT. Not legal advice. This text is pending review by a lawyer; text in [brackets] marks open decisions.
Privacy Policy
Last updated: [DATE]
1.1 Who we are
Amavolo ("we", "us") is operated by [LEGAL ENTITY NAME], [ADDRESS], [REGISTRATION / NIP NUMBER]. We are the controller of personal data described in this policy, except where we act as a processor for the images and product data you upload (see 1.6). Contact: [PRIVACY EMAIL]. [EU/UK REPRESENTATIVE, IF REQUIRED: lawyer to confirm].
1.2 What data we collect
| Category | Examples | Source |
|---|---|---|
| Contact data | email address, name, company, phone if you give it | you, via forms |
| Order inputs | Amazon ASIN or listing link, product photos and files you upload, instructions, feedback on results | you |
| Call data | answers in the pre-call questionnaire, time zone, call scheduling details | you, via the scheduling tool |
| Payment data | payment status, amount, billing country, tax ID if required. We do not receive or store full card numbers; the payment provider [PAYMENT PROVIDER] handles them | you, payment provider |
| Technical data | IP address, device and browser type, pages viewed, referrer, UTM parameters, events (e.g. form submitted) | automatically, only after consent where required |
| Advertising data | click identifiers, ad campaign data | ad platforms, only after consent where required |
| Communications | emails and messages you send us | you |
1.3 Why we use it, and the legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Deliver the service you ordered, send results, support | Contract (Art. 6(1)(b)) |
| Take payment, keep tax and accounting records | Contract; legal obligation (Art. 6(1)(c)) |
| Reply to enquiries, schedule calls, send the checklist you requested | Contract / our legitimate interest in answering you (Art. 6(1)(f)) |
| Product emails related to your request | Legitimate interest [OR consent: lawyer to decide for B2B email rules] |
| Analytics and measuring ad performance | Consent (Art. 6(1)(a)); you can withdraw it any time via "Cookie settings" |
| Security, fraud and abuse prevention | Legitimate interest |
1.4 How long we keep it
[RETENTION: lawyer/accountant to confirm. Proposed starting point for discussion] - Uploaded photos and generated images: deleted [90] days after delivery unless you ask us to delete sooner or we need them for a refund/dispute. [If a client has agreed to a case study, the approved before/after images are kept as long as the permission lasts.] - Contact and enquiry data: [24] months after last contact. - Invoices and payment records: as long as tax law requires ([5] years in Poland: accountant to confirm). - Analytics data: [14] months or per tool settings.
1.5 Who we share data with
We share data only with providers who help us run the service, under contract: - Hosting and infrastructure: [HOSTING PROVIDER] - Email and forms: [EMAIL / FORM TOOL] - Scheduling: [CALENDAR TOOL] - Payments: [PAYMENT PROVIDER] - Analytics and advertising measurement: [ANALYTICS TOOL], Google (Google Ads), Meta, only after consent - Image generation and processing: [AI / IMAGE PROVIDERS: names needed; see assumption 4] - Professional advisers (lawyers, accountants) where needed. We do not sell your personal data. [Lawyer to check against US state-law definitions of "sale/sharing" once ad tags are active: advertising cookies can count as "sharing" under some US state laws.]
1.6 Your images and product files
- We use files you upload only to produce your order, handle revisions, and resolve disputes.
- [OPTION A, recommended] We do not use your files to train or improve AI models, ours or anyone else's. [This must be true for every provider in 1.5: verify.]
- [OPTION B] We may use your files to improve our service unless you opt out.
- You confirm you have the rights to the files you upload (see Terms).
- Where your files contain personal data (e.g. people in photos), we process them on your instructions as a processor; a data processing addendum is available on request [prepare if B2B clients ask].
1.7 International transfers
We are based in [COUNTRY, EU]; many of our customers and providers are in the United States and elsewhere. When personal data leaves the EEA/UK, we rely on [adequacy decisions (e.g. EU–US Data Privacy Framework participants) / Standard Contractual Clauses]: [lawyer to confirm for each provider].
1.8 Your rights
Depending on where you live (EEA/UK, California and other US states), you may have the right to access, correct, delete, restrict or object to processing, receive a copy of your data (portability), withdraw consent, opt out of targeted advertising or "sale/sharing", and not be discriminated against for using these rights. To use them, write to [PRIVACY EMAIL]; we reply within [30] days. EEA/UK residents can also complain to their data protection authority; for Poland that is the President of the Personal Data Protection Office (UODO).
1.9 Cookies
See our Cookie Policy. You can change your choice at any time via "Cookie settings" in the footer.
1.10 Children
The service is for businesses and is not directed at people under 16 [lawyer: 13 for US COPPA, 16 for GDPR default]. We do not knowingly collect their data.
1.11 Security
We use reasonable technical and organisational measures [LIST ACTUAL MEASURES BEFORE CLAIMING ANY: e.g. encryption in transit, access controls]. No system is perfectly secure.
1.12 Changes
We will post updates here and change the date above. For material changes we will notify you by email where we have your address.