Privacy notice

The GEXNA service provider and operator is Kacper Zaremba, ul. Łowicka 52 m. 1, 02-531 Warszawa, Poland; email: contact@gexna.com. GEXNA is the service name, not a separate incorporated company. The trading model is unregistered activity in Poland, only while the applicable legal and tax conditions are met. This model does not remove consumer, tax or data-protection obligations. No nonexistent business registration or VAT exemption is claimed.

For account operation, security, contracts and the operator’s own support, the operator is the controller. Where processing takes place solely on a business customer’s behalf, the relevant roles and any required processing agreement must be settled before that use. Do not submit datasets requiring such an agreement before it is in place.

- Website requests can expose IP address, time, requested address, browser/device information and error details to hosting and security systems. We use the necessary information to deliver pages, investigate faults and protect the service.

- Account data includes email, an internal account identifier, password hash, verification and reset records, settings and authentication events. We use it to create and secure the account and send essential account messages.

- Workspace data can include selected sources and article material, projects, draft posts, edits, usage counters and publication history. We use it to provide the features you request and maintain their continuity.

- Connecting X involves account identifiers, authorisation tokens and publication-related information. Selected content and instructions are transmitted to the AI provider when you request generation of post variants. Media chosen for publication is transmitted when the corresponding action is requested.

- If you contact support, we process the details you send and our correspondence to answer the request and document its resolution.

When you request an enabled paid purchase, payment-related processing can involve your account reference, email, selected product, order and subscription identifiers, amount, currency, tax information, payment status, paid-through date, package expiry, refunds and disputes. We use the information needed to link verified payment to the correct account, provide access and allowances, reconcile billing and resolve problems. Stripe/Link collects the payment and billing information required by its hosted payment service. GEXNA does not operate a card-entry form or require you to send card details to support. Processing and storage by the payment provider are also described in its own privacy information.

Refund and entitlement records can include the original transaction, refund amount and status, the affected paid period or package, the reason and scope of a resolution, and the resulting access or credit adjustments. We use these records to apply the resolution consistently, avoid duplicate corrections, investigate errors and meet the relevant legal or claim-related requirements. We do not need full card numbers or unrelated private workspace content for this accounting. Complaint and refund assessment can require relevant purchase, usage and correspondence records. The absence of a voluntary refund offer does not remove your data-protection rights. We do not reuse refund correspondence for marketing merely because you requested support.

We record your purchase-terms version and acknowledgment, withdrawal or complaint statement, receipt timestamp and confirmation-delivery status to document the transaction and respond to legal notices. No marketing consent is inferred.

Purchase admission also records the necessary country/subdivision and a reference to reviewed location evidence. Identity documents are not collected routinely. The country check serves legal/tax compliance and fraud prevention, using the applicable contract, legal obligation or legitimate-interest basis.

We rely on Article 6(1)(b) GDPR for steps requested before a contract and processing necessary to provide an account or service to an individual. Article 6(1)(c) covers applicable legal obligations. Under Article 6(1)(f), our interests include secure service operation, preventing fraud, establishing and defending legal claims, and communicating with authorised business contacts. We assess those interests against people’s rights.

For our account, entitlement and purchase-administration activities, the applicable basis depends on the purpose: performance of a contract or requested pre-contract steps, compliance with a legal obligation, or legitimate interests such as preventing billing abuse, maintaining transaction security and establishing or defending claims. Where we rely on legitimate interests, your applicable objection rights remain available. Stripe/Link determines its own legal bases for activities for which it acts as an independent controller. Accepting GEXNA's Terms is not blanket consent to payment-data processing or international transfers.

Where optional tracking or marketing requires consent, Article 6(1)(a) and the relevant electronic-communications rules apply; consent must be obtained before that activity. Accepting service terms is not consent to all processing. Essential account messages are separate from optional marketing.

In the prepared infrastructure model, hosting and operational email are assigned to OVHcloud; the current email configuration points to an OVH server. The contracted legal entity, service locations and processing-agreement scope require confirmation before this policy is published. OpenAI receives source material and instructions needed for requested generation of variants. Analysis uses application data and does not send it to OpenAI to prepare its report. X receives data needed for authorisation and requested publication. Stripe/Link receives data needed for payments, taxes, fraud prevention, refunds and disputes. Authorised support, accounting, advisers and competent authorities may receive necessary data. Provider roles depend on the particular service and agreements; Stripe acts as an independent controller for its own payment and compliance purposes, not as controller of all GEXNA projects. We do not sell private workspace content for advertising.

Account and support information normally comes from you or an authorised business contact. Workspace material can come from your inputs, the sources and RSS feeds you select, and public publishers; it may include authors’ names or people mentioned in articles. Connected X supplies information when you authorise the integration. Data is not treated as free of privacy obligations merely because a source is public. Where additional notice is required for data obtained indirectly, the applicable GDPR duties and lawful exceptions must be assessed.

Provider operations may involve transfers outside the EEA. The recipients, countries, transfer basis and any supplementary measures must match the actual service and be confirmed before a transfer for which GEXNA is responsible is enabled. Listing a provider in this policy does not confirm execution of Standard Contractual Clauses, applicability of an adequacy decision or EU data storage. Accepting the Terms is not blanket transfer consent. Contact contact@gexna.com for applicable safeguards and access to copies. Stripe describes its own processing at https://stripe.com/privacy.

Account data and working content are retained while needed to provide the service. Account-closure and erasure requests are accepted at contact@gexna.com; no automatic deletion button or single unverified deadline is promised. Following an effective request, data no longer needed are erased or anonymised. Transaction records are retained to the extent and for the period required by the applicable legal duty; correspondence and claim evidence are retained as needed to handle the matter and applicable legal periods. This does not justify keeping entire projects for the retention period of a financial record. Logs and security evidence are limited to the necessary purpose. Actual backup, log and provider-deletion schedules require confirmation; no unverified numbers or automatic provider deletion are claimed. Restoring a backup requires reapplying completed erasure requests. Disconnecting X stops further use of the integration in GEXNA but does not delete posts or data processed independently by X.

The threshold for compacting detailed editorial history is 32 days. It is checked when workspace state is saved or Analysis data is read, rather than by a separate job deleting all history every 32 days. Entries qualify when their update and recorded events are older than the threshold; active queue items and items with pending, unresolved or recent publication attempts are excluded. Detailed entries are replaced with daily totals; publication-attempt records remain. This is not a deletion deadline for the account, projects, all post text or purchase documents.

The service uses HTTPS and authentication controls. Passwords are stored as hashes, and connected-account credentials are protected rather than published in the browser. No internet service can guarantee absolute security. Use a unique password, secure your email and X account, and do not share private data through public support channels.

You can choose not to connect X or request an AI operation. Those corresponding features will then be unavailable. Account information necessary for authentication cannot be omitted while still using an authenticated feature. Avoid entering special-category personal data, credentials, financial account details, children’s data or confidential material you are not entitled to process.

Where the GDPR applies and its conditions are met, you may request access, correction, erasure, restriction and portability, object to legitimate-interest processing, and withdraw consent for consent-based activity. Withdrawal does not invalidate earlier lawful processing. We may need proportionate information to verify the requester; do not send an ID document unsolicited.

We respond to rights requests without undue delay and normally within one month. Any lawful extension and its reason will be explained within that period. You can complain to the Polish President of the Personal Data Protection Office (UODO), uodo.gov.pl, or another competent data-protection authority, including in your EEA country of residence or work.

Editorial scores and draft suggestions are not intended as solely automated decisions producing legal or similarly significant effects about an individual. We do not offer this service for automated eligibility, employment, credit or other high-impact decisions.

See Cookies & browser storage for storage used by the site and app. We update this notice when actual processing materially changes and give additional notice where required. A new notice does not itself create a new legal basis or waive your rights.

An authenticated session expires after 30 minutes of inactivity or, at the latest, 7 days after the session was created. Activity handled with session refresh extends the inactivity deadline but not the 7-day maximum. An anonymous authentication session lasts up to 10 minutes. Logout or revocation may end a session earlier. These are server-side access lifetimes, not deletion deadlines for all account data. The authentication cookie is a browser-session cookie. Expired or revoked session records become eligible for periodic cleanup; physical deletion exactly at expiry is not promised.