Privacy Policy

1. Controller

The controller for processing your personal data under the GDPR is:

Martini & Radl OG
Garnisongasse 4, 1090 Vienna, Austria
[email protected]

2. What we process

2.1 Account data

On registration we store: name, email address, bcrypt hashed password, workspace slug. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

2.2 Usage and content data

Uploaded brand assets (logos, product images, templates), scanned brand URLs, AI generated creatives, prompts, feedback, comments. This data belongs to you; we use it only to provide the service to you.

2.3 Server logs

On each request: IP address (anonymised after 7 days), date, user agent, requested URL. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stability and security).

To protect the public brand scan from abuse, a checksum is formed in the browser from browser type, operating system, screen values and time zone. Only that checksum is transmitted to our server, where it is combined with IP address and user agent into an identifier for the scan limit that cannot be reversed. The individual screen values and the time zone are not stored.

2.4 Cookies

For sign in and session management we set technically necessary cookies from our authentication provider Clerk. With your prior consent we additionally use the Meta pixel and store campaign parameters, a random visitor identifier and Meta identifiers to measure page views, brand scans, registrations, demo bookings and plan purchases. Legal basis: Art. 6(1)(a) GDPR. Declining has no effect on your use of Pablo.

For more reliable measurement the same events are, where possible, additionally transmitted server side via the Meta Conversions API and deduplicated through a shared event identifier. Email addresses are hashed with SHA-256 before transmission. Payment data such as card or account numbers is never transmitted to Meta.

3. AI subprocessors

To deliver the service we transmit content (prompts, uploaded images, scanned URLs) to the following AI providers. We have concluded a data processing agreement with each, or operate on the basis of standard contractual clauses:

• Anthropic PBC (USA): brand intel analysis, AI prompt optimisation, video suggestions. Servers in the USA; data transfer on the basis of SCCs. Anthropic Privacy Policy
• Google LLC (USA): AI image generation for static and overlay generation. Data transfer on the basis of SCCs. Google Privacy Policy
• fal.ai Inc. (USA): video generation (once enabled).
• Stripe Payments Europe Ltd. (Ireland): payment processing. We do not store card data. Stripe Privacy
• Railway Corp. (USA): hosting and storage. Data is held in the us-west1 region.

4. Third party integrations (optional, opt in)

When you actively connect one of these services, we transmit the corresponding data:

• Meta Platforms Ireland Ltd.: after consent, for campaign measurement via Meta pixel and Conversions API, and for social inbox and ad library connections
• Calendly LLC: when opening and booking a demo appointment. Campaign parameters are passed to the booking link so a confirmed booking can be attributed.
• TikTok: for TikTok mentions connections
• Canva: for asset export to Canva

You can disconnect these at any time under settings, integrations.

5. Retention

• Account data: until your account is deleted.
• Asset data: until you delete it or your account is deleted.
• Invoice data: 7 years (commercial and tax retention obligations).
• Server logs: 7 days, then deleted automatically.
• Marketing attribution: at most 180 days after consent. Successfully transmitted technical event payloads are then reduced to event name and event identifier.

6. Your rights (Art. 15–21 GDPR)

• Access (Art. 15): what data we hold about you
• Rectification (Art. 16): correction of incorrect data
• Erasure (Art. 17): the right to be forgotten
• Restriction (Art. 18)
• Data portability (Art. 20): export of your data in a machine readable format
• Objection (Art. 21) to processing

Please send requests to [email protected]. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). In Austria: Datenschutzbehörde.

7. Deleting your account

Write to [email protected] and we will delete your account including all associated assets and workspaces within 7 business days. Invoice data is retained for statutory retention reasons.