Privacy Notice

Controller: — ("we", "us"), —, Chamber of Commerce (KvK) no. —. Contact for privacy matters: no-reply@richardgyor.hu.

This notice explains what personal data ProjectDigo collects, why, on what legal basis, who we share it with, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR).

1. What we collect

Data	When	Why
Email address	Registration, waitlist	Account identity, login, verification, transactional email
Spoken/UI language, country/nationality	Registration, waitlist	Localisation; VAT country for billing
Date of birth / age confirmation	Registration	Age assurance (18+ access)
Password (hashed)	Registration	Authentication — stored only as a salted hash, never in clear text
Consent records	Registration, waitlist, settings	Proof of the consents you gave, with timestamps
Generated images/videos and the prompts you write	When you use the generator / play a story	Providing the service; the prompts you type are stored with the result
Roleplay sessions, stories, characters	When you play / create	Providing the roleplay feature
Billing details (name, address, country), invoices, payments	If you purchase	Legal accounting/tax obligations
Technical data: hashed IP address, user agent, approximate country	On certain actions	Security, fraud/abuse prevention, audit trail

We do not sell your personal data.

2. Special-category and adult data

Adult ("18+") content is optional and off by default. If you opt in, that preference is a record of a choice you made; we do not require you to disclose sensitive personal data to use the service. Character and reference images are created only by accounts with creator permissions, not by general users.

3. Legal bases

• Contract (GDPR Art. 6(1)(b)) — operating your account and providing the service.
• Legal obligation (Art. 6(1)(c)) — keeping invoices/accounting records.
• Consent (Art. 6(1)(a)) — optional marketing email and the optional adult-content opt-in. You may withdraw consent at any time in Settings.
• Legitimate interests (Art. 6(1)(f)) — security, abuse prevention and keeping our service working, balanced against your rights.

4. AI processing

Text and image/video generation is performed via our AI provider (see the Sub-processor list). The prompts you write and, for image editing, the images you provide are sent to that provider to produce a result. We do not use your content to train our own models. See the AI Transparency Statement.

5. Who we share data with (sub-processors)

We use a small number of processors that handle data on our behalf under contract — AI generation, email delivery, hosting, and the waitlist site. The current list, including where each one processes data, is published and kept up to date at https://rpadmin.richardgyor.hu/legal/subprocessors. Where a provider processes data outside the EEA, transfers are covered by an appropriate safeguard (e.g. Standard Contractual Clauses); .

6. How long we keep data

• Account data: while your account exists, then deleted (see §8).
• Invoices and accounting records: retained for the statutory period (in the Netherlands generally 7 years) even after account deletion, but stripped of directly-identifying details (name/address/email replaced) where the law allows.
• Security/audit logs: a limited period proportionate to the purpose.
• Waitlist entries that are never converted: removed after they expire.

7. Security

Passwords are stored only as salted hashes. Secrets are encrypted at rest. Access to generated media is authenticated. IP addresses in logs are hashed/redacted. We apply technical and organisational measures appropriate to the risk (GDPR Art. 32).

8. Your rights

You have the right to access, rectify, erase ("right to be forgotten"), restrict, port, and object to the processing of your data (GDPR Art. 15–21). You can exercise the main ones yourself:

• Export — download a copy of your data from Settings → My data.
• Delete — request account deletion from Settings; it is disabled immediately and permanently erased after a 30-day grace period (invoices are kept anonymised as the law requires).

You also have the right to lodge a complaint with a supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens.

9. Children

The service is for adults only and not directed at children. You must be at least 18.

10. Changes

We may update this notice. Material changes will be notified and, where required, will ask for renewed acceptance. The effective date is shown above.

11. Contact

Questions or requests: no-reply@richardgyor.hu.