1. Who is responsible for your data Daniil Filatov, IČO: 22534156, Prague, Czech Republic Contact: hello@filatov.design

2. What data we collect — Name and email address (provided at checkout or sign-in) — Payment information (processed by Stripe — we never see your full card details) — Usage data (pages visited, prompts viewed — collected anonymously) — Email address provided for newsletter subscription (if you chose to subscribe) — Access records for paid content: when a signed-in account opens or copies a paid prompt or Web System, we record the account, the item, the time, a one-way hash of the IP address and the browser type — Likes: the prompts, collections and Web Systems you like (shown to you as your bookmarks; only the total number of likes on an item is public)

3. Why we collect it — To provide and manage your subscription access — To send you account-related emails (receipts, access confirmation, subscription updates) — To send newsletter updates if you subscribed (you can unsubscribe anytime) — To improve the platform — To protect paid content from bulk copying and apply the daily Web System limit — To show your likes and the public like counts

4. Legal basis (GDPR) — Contract performance: processing your payment and providing access — Legitimate interest: improving the service and protecting paid content from abuse — Consent: newsletter emails

5. Who has access to your data We share your data only with the following processors: — Stripe — payment processing (stripe.com/privacy) — FramerAuth — authentication and access management (framerauth.com) — Framer — website hosting (framer.com/privacy) — Cloudflare — content delivery and file storage, including encrypted database backups (cloudflare.com/privacypolicy) — Supabase — database and server functions (supabase.com/privacy) — Resend — sending emails (resend.com/legal/privacy-policy)

We do not sell your data. Ever.

6. How long we keep your data — Account data: as long as your account is active plus 3 years after deletion — Payment records: 10 years (legal requirement in Czech Republic) — Newsletter data: until you unsubscribe — Access records: 90 days — Likes: until you remove them or delete your account — Database backups: 90 days

7. Your rights (GDPR) You have the right to: — Access the data we hold about you — Correct inaccurate data — Delete your data (“right to be forgotten”) — Export your data in a portable format — Object to processing — Withdraw consent for newsletter at any time

To exercise any of these rights, email hello@filatov.design. We will respond within 30 days.

8. Cookies We use essential cookies for authentication (keeping you logged in). We do not use tracking or advertising cookies.

9. Data transfers Some of our processors (Stripe, Cloudflare, Supabase, Resend) may process data outside the EU. They are certified under appropriate safeguards including Standard Contractual Clauses.

10. Changes to this policy We may update this policy. If we make significant changes we will notify you by email.

11. Complaints If you believe we are handling your data incorrectly you have the right to lodge a complaint with the Czech Data Protection Authority (ÚOOÚ) at uoou.cz.