This policy explains what personal data Barmo Piotr Owczarczak, ul. Napoleona 28, 05-270 Marki, Poland, NIP 1251817130, REGON 545966574 ("Peridot", "we", "us"), the controller of your data, collects when you use our website and AI workspace, why we collect it, and the choices you have. You can reach us at [email protected].
Data we collect
We only collect what is needed to run the service:
Account data: your email address, display name, and either a salted password hash (never your password itself) or, if you sign in with Google, your Google account ID, name and profile picture URL.
Usage data: for each request to an AI model we record your account, the model used, the number of input and output tokens and the time. We use this to enforce limits and to keep the service running.
Chat history: we save your conversations (the messages you send and the AI replies) so you can come back to them. You can delete any conversation at any time.
Billing data: if you buy a plan, your name, billing address, optional company name and your Stripe customer ID. Card details are entered directly into Stripe's form and never reach our servers.
Contact messages: if you write to us through the contact form, we store your name, email, company (optional) and message.
Preferences stored in your browser: your sign-in session and your chosen language (see Cookie settings).
How we use your data
To create and secure your account and keep you signed in.
To provide the AI features, show you your chat history and apply usage limits.
To take payments for plans and keep the accounting records required by tax law.
To answer your messages and provide support.
To monitor, debug and improve reliability and security.
We do not sell your personal data and we do not use it for advertising.
Legal bases
Giving us your data is voluntary, but without account data we cannot create an account, and without billing data we cannot sell you a plan.
Performing our contract with you: your account, chats, usage limits and paid plans (art. 6(1)(b) GDPR).
Legal obligations: accounting and tax records for payments (art. 6(1)(c) GDPR).
Our legitimate interests: securing and debugging the service, and establishing or defending legal claims (art. 6(1)(f) GDPR).
Your consent, where we ask for it (art. 6(1)(a) GDPR). You can withdraw consent at any time without affecting earlier processing.
Service providers and third parties
We rely on a small number of providers who process data on our behalf or that you interact with directly:
Anthropic: AI models (Claude API) process the content of your prompts to generate answers. Google: AI models (Gemini API) do the same; Google Sign-In authenticates you if you choose it; Google Fonts delivers typefaces.
Stripe (Stripe Payments Europe, Ireland): processes payments, card details and invoices for paid plans.
Cloudflare: delivers and protects the website, and sees your IP address and the requests you make.
Iconify: interface icons are loaded from the Iconify public API, which receives your IP address with each request.
Hosting: our servers and database run on a virtual server in Frankfurt, Germany (European Union).
International transfers
Some providers (Anthropic, Google, Cloudflare, Stripe) may process data outside the European Economic Area, mainly in the United States. These transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses.
How long we keep data
Account data and chat history: until you delete a conversation or your account, then removed within 30 days unless we must keep it by law.
Usage records: while your account exists, to apply limits and keep statistics; they are detached from your account when it is deleted.
Billing records and invoices: 5 years from the end of the calendar year in which the tax obligation arose, as required by Polish tax law.
Contact messages: as long as needed to answer you and keep a record of the conversation, and no longer than 3 years.
Your rights
You have the right to access, correct, delete or export your personal data, to restrict its processing, to object to processing based on our legitimate interests, and to withdraw consent. To exercise these rights, write to [email protected]. We answer within one month.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or with the data protection authority where you live.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
Security
Passwords are stored as salted hashes, sign-in uses signed tokens that expire after seven days, and Google tokens are verified before access is granted. No system is perfectly secure, so please use a strong, unique password and tell us if you suspect a problem.
Children
Peridot is not intended for children under 16 and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
We may update this policy as the service evolves. The date at the top shows the latest version, and we will give notice of material changes.
Contact
Questions about privacy? Write to [email protected] with "Privacy" in the subject, or by post to Barmo Piotr Owczarczak, ul. Napoleona 28, 05-270 Marki, Poland.