1. Data Controller Information
Data Controller
Marduk.ai sp. z o.o. with registered office in Warsaw (02-367), at ul. Grójecka 104/9, entered into the register of entrepreneurs kept by the District Court for the Capital City of Warsaw under KRS number 0001182086, Tax ID (NIP): 7011268052, REGON: 54215647800000 (hereinafter: "Controller" or "we").
Contact details:
2. General Information
This Privacy Policy defines the rules for processing personal data of users of the Marduk.ai mobile application (hereinafter: "Application"). The Application has an educational and supportive nature in the scope of limiting or eliminating alcohol consumption.
Important: The Application does not constitute medical advice and is not a medical device within the meaning of applicable regulations. The content contained in the Application is for educational and informational purposes only.
Business Model: The Application is available exclusively in a paid subscription model. Using the Application requires payment of a subscription.
3. Legal Basis for Processing
The processing of personal data is carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR).
4. Data Processed by the Application
4.1 Data Required to Use the Application
Registration data (required):
- First name
- Email address
- Password (stored in hashed form)
Payment data (required for subscription, processed by Stripe.com):
- Full name (from payment card)
- Payment card details
- Transaction and payment history
- Billing address (if required)
Providing this data is necessary for:
- Creating and maintaining a user account
- Processing paid subscription
- Ensuring account security
- Communication regarding subscription matters
4.2 Technical Data
The Application automatically collects the following technical data:
- Device IP address
- Device model and operating system
- Application version
- Activity logs in the Application
- Device identifier
- Data concerning the use of Application features
4.3 Data from AI Assistant Interactions
Communication with AI Assistant:
- Content of conversations with the AI assistant
- Interaction history
- Preferences expressed during conversations
Important: The Application does not control or limit what data the user shares with the AI assistant. The user independently decides on the scope of information shared during interaction with the AI system.
4.4 Invoicing Data (Optional)
In case of requesting a VAT invoice:
- Full invoicing data (first name, last name)
- Billing address
- Email address for invoice delivery
5. Purposes and Legal Basis for Processing
5.1 Table of Purposes and Legal Basis
| Processing Purpose | Data Category | Legal Basis (Art. 6 GDPR) | Retention Period |
|---|
| Provision of educational services (paid subscription) | Email, password, optional data | Art. 6(1)(b) (contract performance) | Until subscription termination |
| Subscription payment processing | Payment data, transaction history | Art. 6(1)(b) (contract performance) + Art. 6(1)(c) (legal obligation) | Until subscription termination + 5 years |
| User communication | Email, first name | Art. 6(1)(b) (contract performance) | Until subscription termination |
| Security assurance | Technical data, logs | Art. 6(1)(f) (legitimate interest) | 12 months |
| Functionality improvement | Technical data, usage history | Art. 6(1)(f) (legitimate interest) | Until subscription termination |
| Content personalization | Optional data, preferences | Art. 6(1)(a) (consent) | Until consent withdrawal or subscription termination |
| AI assistant operation | Conversation content, interaction history | Art. 6(1)(b) (contract performance) | Until subscription termination |
| Direct marketing | Email | Art. 6(1)(a) (consent) | Until consent withdrawal |
| VAT invoice issuance | Invoicing data | Art. 6(1)(a) (consent) or Art. 6(1)(c) (legal obligation) | 5 years |
5.2 Controller's Legitimate Interest
Data processing based on legitimate interest concerns:
- Ensuring security and stability of Application operation
- Detecting and preventing abuse
- Analyzing and improving Application functionality
- Developing new educational features
6. Data Minimization and Purpose Limitation
In accordance with GDPR principles, we adhere to the following principles:
Minimization principle: We process only personal data that is adequate, relevant, and limited to what is necessary.
Purpose limitation principle: Data is collected for specific, explicit, and legally justified purposes.
The scope of necessary data has been determined based on the analysis of Application functionality and legal requirements.
7. Transfer of Personal Data
7.1 Data Processors
Data may be transferred to the following categories of recipients:
Payment service providers:
- Stripe Inc.
- Data transferred: payment data necessary for transaction processing
Technical service providers:
- Hosting service providers
- Cloud service providers
- Analytics system providers
AI service providers:
- OpenAI or other language model providers
- Data transferred: conversation content necessary for AI assistant operation
7.2 Transfer to Third Countries
In case of data transfer to countries outside the European Economic Area, we ensure appropriate safeguards in accordance with Art. 44-49 GDPR.
7.3 We Do Not Sell Data
Users' personal data is not sold to third parties for commercial purposes.
8. Data Retention Period
8.1 General Retention Principles
We store personal data in accordance with the storage limitation principle:
- Only for the period necessary to achieve the processing purpose
- No longer than required by law
- Taking into account the user's right to data deletion
8.2 Specific Retention Periods
User account and subscription data:
- Active subscription: for the duration of the subscription
- After subscription cancellation: immediate deletion of all data (except data required by law)
Payment data:
- Payment history: 5 years from the last transaction (accounting requirements)
- Payment card data: stored by payment providers according to their policies
Technical data and logs:
- Security logs: 12 months
- Analytics data: until subscription termination
AI conversation history:
- Stored until subscription cancellation
- Automatic deletion after subscription cancellation
Invoicing data:
- 5 years from invoice issuance (accounting requirements)
9. User Rights
9.1 Rights Catalog
In accordance with GDPR, you have the following rights:
Right of access (Art. 15 GDPR):
- Confirmation whether we process your data
- Access to your personal data
- Information about the processing method
Right to rectification (Art. 16 GDPR):
- Correction of inaccurate data
- Completion of incomplete data
Right to erasure (Art. 17 GDPR):
- Deletion of data in specified cases
- "Right to be forgotten"
Right to restriction of processing (Art. 18 GDPR):
- Restriction of data usage method
Right to data portability (Art. 20 GDPR):
- Receiving data in machine-readable format
- Transferring data to another controller
Right to object (Art. 21 GDPR):
- Objection to processing based on legitimate interest
Right to withdraw consent:
- In case of processing based on consent
9.2 Method of Exercising Rights
Submitting requests:
Processing time: Up to 30 days from receiving the request
Identity verification: To ensure security, we may require verification of the identity of the person submitting the request.
Important: Due to the application's business model (paid subscription), subscription cancellation results in automatic deletion of most personal data.
10. Data Security
10.1 Technical and Organizational Measures
We have implemented appropriate security measures:
- Data encryption during transmission (TLS)
- Database encryption
- Regular backups
- Access control to data
- System security monitoring
- Regular security updates
10.2 Data Access
Access to personal data is granted only to authorized persons who:
- Have been trained in personal data protection
- Have signed a confidentiality commitment
- Have a justified need to access the data
10.3 Data Breach
In case of a personal data breach:
- We will notify the supervisory authority within 72 hours
- We will inform users when the breach may pose a high risk
- We will take corrective actions
11. Cookies and Tracking Technologies
11.1 Technologies Used
The Application may use:
- Cookies necessary for operation
- Local data storage
- Device identifiers
11.2 Purposes of Use
- Maintaining user session
- Ensuring security
- Remembering user preferences
- Analyzing Application usage
11.3 Cookie Management
Users can manage cookies through device or browser settings.
12. Intellectual Property
12.1 Copyright
- The Application and its content are protected by copyright
- The user obtains a non-exclusive license to use the Application in accordance with the Terms of Service
- It is forbidden to:
- Copy Application content
- Decompile source code
- Create derivative works
- Reverse engineer
13. Application Languages
The Application is available in Polish and English versions. In case of discrepancies between language versions, the Polish version is binding.
14. Privacy Policy Changes
14.1 Updates
The Privacy Policy may be updated in case of:
- Changes in legal regulations
- Introduction of new functionalities
- Changes in data processing methods
14.2 Notification of Changes
We will notify about significant changes:
- Through notification in the Application
- By email to the address provided in the account
- On the website
Changes take effect 14 days after notification, unless new consent is required.
15. Complaint to Supervisory Authority
If you believe that personal data processing violates GDPR provisions, you have the right to file a complaint with the President of the Personal Data Protection Office:
17. Final Provisions
17.1 Effectiveness
This Privacy Policy is effective from December 15, 2025 and supersedes previous versions.
17.2 Legal Compliance
The Privacy Policy complies with:
- GDPR Regulation (EU) 2016/679
- Personal Data Protection Act of May 10, 2018
- Other applicable provisions of Polish and EU law