Privacy notice

1. Controller and contact

For website operation, account administration, service security and our own support, the controller is Kacper Zaremba, ul. Łowicka 52 m. 1, 02-531 Warszawa, Poland. Contact contact@gexna.com for privacy requests. This notice covers gexna.com and the operation of GEXNA at app.gexna.com.

If a business customer asks us to process personal data solely on its behalf, the roles and any necessary Article 28 GDPR processing agreement must be settled before that use. This public notice is not a substitute for a required data-processing agreement. Do not upload sensitive datasets while that arrangement is unresolved.

2. Data and purposes

• Website requests can expose IP address, time, requested address, browser/device information and error details to hosting and security systems. We use the necessary information to deliver pages, investigate faults and protect the service.
• Account data includes email, an internal account identifier, password hash, verification and reset records, settings and authentication events. We use it to create and secure the account and send essential account messages.
• Workspace data can include selected sources and article material, projects, draft posts, edits, usage counters and publication history. We use it to provide the features you request and maintain their continuity.
• Connecting X involves account identifiers, authorisation tokens and publication-related information. Selected content and instructions are transmitted to the AI provider when you request generation or analysis. Media chosen for publication is transmitted when the corresponding action is requested.
• If you contact support, we process the details you send and our correspondence to answer the request and document its resolution.
• When paid sales are actually enabled, we may receive order, subscription, transaction status and entitlement identifiers. The hosted payment provider handles the payment details collected by its checkout; we do not ask you to send card details to support.

When you create an account, we also record the version and language of the Terms of Service you accept, the server-recorded acceptance time and the version of the privacy notice shown. These records document the account agreement and help establish or defend legal claims; they are not consent to optional marketing or all personal-data processing. Retention follows the contract and claims criteria described below.

3. Legal bases and legitimate interests

We rely on Article 6(1)(b) GDPR for steps requested before a contract and processing necessary to provide an account or service to an individual. Article 6(1)(c) covers applicable legal obligations. Under Article 6(1)(f), our interests include secure service operation, preventing fraud, establishing and defending legal claims, and communicating with authorised business contacts. We assess those interests against people’s rights.

Where optional tracking or marketing requires consent, Article 6(1)(a) and the relevant electronic-communications rules apply; consent must be obtained before that activity. Accepting service terms is not consent to all processing. Essential account messages are separate from optional marketing.

4. Recipients and external services

OVHcloud infrastructure is used for hosting and operational email. Requested AI operations use OpenAI services. Connecting or publishing to X shares the information necessary for those actions with X. The recipients’ roles depend on the service and applicable agreements; some act as independent controllers for their own purposes.

Paid sales have not started. A selected payment/Merchant of Record entity will be identified in checkout and the relevant updated privacy information before payment data is collected for live purchases. No current payment-provider authorisation is implied.

We may also share necessary records with advisers, competent authorities or others where law requires it or a lawful claim justifies it. We do not publish private workspace content as marketing material without a separate lawful basis. External n8n pages are independent websites; following a link subjects that visit to their notices.

5. Where information comes from

Account and support information normally comes from you or an authorised business contact. Workspace material can come from your inputs, the sources and RSS feeds you select, and public publishers; it may include authors’ names or people mentioned in articles. Connected X supplies information when you authorise the integration. Data is not treated as free of privacy obligations merely because a source is public. Where additional notice is required for data obtained indirectly, the applicable GDPR duties and lawful exceptions must be assessed.

6. International transfers

Using external services can involve processing outside the EEA. Such processing must have a valid GDPR transfer basis, such as a currently applicable adequacy decision or appropriate contractual safeguards, including standard contractual clauses where required. The applicable mechanism depends on the actual recipient and contracted service; we do not promise that all data remains in Poland or the EU.

You may contact us for information about relevant recipients and safeguards or to request a copy of safeguards that can lawfully be provided. We do not treat use of the application as blanket consent to a transfer.

7. Retention and deletion

Account and active workspace information is kept while needed to provide the account and requested features. After a verified closure or erasure request, records no longer needed are deleted or anonymised; limited information may remain where a legal duty, an unresolved transaction, a security investigation or establishing or defending a claim justifies retention. These exceptions do not authorise keeping all workspace content indefinitely.

Retention depends on the record’s purpose: correspondence for the time needed to resolve it and applicable claims; financial documents for the legally required period; incident evidence until the incident and related legal need end. We reassess necessity rather than retaining data merely because storage is available.

Authentication records are time-limited. The current application design uses a ten-minute anonymous authentication window, thirty-minute authenticated inactivity window and seven-day absolute authenticated window. Reset links expire after thirty minutes and confirmation links after twenty-four hours. Expired records are eligible for cleanup. Browser session cookies and server-side records have different lifecycles.

Detailed editorial history can be compacted after a 32-day inactivity window, while daily totals, active/pending items and publication evidence can remain for their separate purposes. This is not a promise that all data is erased after 32 days. Browser caches can remain until removed by the browser or user; clearing them does not itself delete server records.

Backup copies may retain earlier data temporarily. We restrict access and do not restore erased personal data to normal use without applying the relevant deletion instructions again. Ask us about the retention applying to a particular record and for erasure where the legal conditions are met.

8. Security and your choices

The service uses HTTPS and authentication controls. Passwords are stored as hashes, and connected-account credentials are protected rather than published in the browser. No internet service can guarantee absolute security. Use a unique password, secure your email and X account, and do not share private data through public support channels.

You can choose not to connect X or request an AI operation. Those corresponding features will then be unavailable. Account information necessary for authentication cannot be omitted while still using an authenticated feature. Avoid entering special-category personal data, credentials, financial account details, children’s data or confidential material you are not entitled to process.

9. Your rights and complaints

Where the GDPR applies and its conditions are met, you may request access, correction, erasure, restriction and portability, object to legitimate-interest processing, and withdraw consent for consent-based activity. Withdrawal does not invalidate earlier lawful processing. We may need proportionate information to verify the requester; do not send an ID document unsolicited.

We respond to rights requests without undue delay and normally within one month. Any lawful extension and its reason will be explained within that period. You can complain to the Polish President of the Personal Data Protection Office (UODO), uodo.gov.pl, or another competent data-protection authority, including in your EEA country of residence or work.

Editorial scores and draft suggestions are not intended as solely automated decisions producing legal or similarly significant effects about an individual. We do not offer this service for automated eligibility, employment, credit or other high-impact decisions.

10. Updates and browser storage

See Cookies & browser storage for storage used by the site and app. We update this notice when actual processing materially changes and give additional notice where required. A new notice does not itself create a new legal basis or waive your rights.