Semantio Platform Privacy Policy

This document sets out the principles for the processing and protection of personal data of visitors to the website semantio.pro and users (subscribers) of the application app.semantio.pro (hereinafter collectively referred to as the "Platform").

1. Who is the controller of your data?

The controller of your personal data collected in connection with the use of the Platform is Brand Semantics Prosta Spółka Akcyjna with its registered office in Warsaw, at ul. Puławska 77, 02-595 Warsaw, registered under KRS number: 0001222755, using NIP number: 5214154430 (hereinafter "the Company" or "the Controller").

For all matters related to the processing of personal data and to exercise your rights, you can contact us at the e-mail address: office@brandsemantics.eu.

2. What data do we process, for what purpose, and on what legal basis?

The rules for processing your data vary depending on the relationship you have with us:

Providing data in the application registration form is a condition for concluding a service agreement (SaaS subscription). Failure to provide basic data (including payment requirements) results in the inability to open an account. In contact forms, providing data other than an email address is always optional.

3. To whom do we transfer your data (Sub-processors)?

The Semantio Platform is an advanced technological service. To ensure the highest quality, reliability, and analytical capabilities (including AI), we entrust data processing to specialised third parties (Sub-processors):

• Supabase, Inc. / Vercel, Inc. – providers of the core server infrastructure (databases, code execution environments, hosting), ensuring the continuity of application operation and information storage.

• Stripe, Inc. – certified payment service operator handling the subscription model and invoicing. Brand Semantics does not directly collect or store your payment card data.

• LLM model providers (e.g., Google LLC, OpenAI, Anthropic) – entities providing generative artificial intelligence programming interfaces, analysing submitted messages (prompts) to create analytical reports (while adhering to policies guaranteeing that this data is not used to train public models).

• GitHub, Inc. / Resend / Mailchimp – providers of systems for managing transactional and marketing email notifications and operational support.

• Other companies providing us with marketing and analytical tools (based on your consent to cookies).

Data transfers to third countries (outside the EU/EEA)
Due to the global nature of our technology providers (including cloud service providers based in the USA), your personal data may be transferred to countries outside the European Economic Area. The Company guarantees that such transfers take place with strict protection measures. The legal basis for transfers to entities in the USA is primarily the European Commission's adequacy decision issued under the Data Privacy Framework (DPF) programme. In other cases or for entities outside the DPF framework, the transfer is secured by implementing binding Standard Contractual Clauses (SCCs) issued by the European Commission.

4. Data Retention Period

We store data for as long as necessary to achieve the purposes for which it was collected:

• In the case of a SaaS agreement – for the duration of account activity, and then, if suspended, until permanent deletion. We have implemented innovative Data Wipe mechanisms on the platform, deleting monitoring history and identifiers after 90 days of non-payment. Full account deletion, if not requested by you earlier, is carried out systemically after 24 months of complete inactivity.

• For marketing purposes (Newsletter) – until consent is withdrawn or an objection is raised. Subscriber addresses that have not opened any messages for over 18 months may be systematically removed from contact databases.

• NOTE – Anti-Abuse Registry (Trial Abuse Registry): To protect against repeated, unlawful use of the free trial period, based on a legitimate legal interest (Article 6(1)(f) GDPR), we store unique hashes (cryptographic digests) of email addresses and Stripe payment identifiers for a period of 36 months from the moment the account is deleted. During this time, this data is used exclusively for backend verification during attempts at subsequent registration.

5. Cookies, Cross-Domain Tracking, and Profiling

Our Platform uses cookies (small text files) and similar technologies. Our consent management system operates across domains (Cross-Domain) within the common ecosystem of the marketing website and the application environment itself, meaning that your chosen privacy preferences are maintained when seamlessly transitioning between systems.

We collect cookies categorised as follows:

1. Essential cookies: Mechanisms guaranteeing basic defence against network attacks (e.g., Cloudflare CAPTCHA verification, query limiting), files maintaining secure user sessions in the application (generated by the authorisation system), and consent manager scripts. These files cannot be disabled.

2. Statistical analytics (Google Analytics, Microsoft Clarity): Collect anonymised information (based on, among other things, a truncated IP address) allowing us to understand how users navigate pages (heatmaps, number of visits), thereby improving the Platform's UX architecture.

3. Marketing and Social Media (Meta Pixel, OpenAI Ads, Google Ads, LinkedIn Insight Tag, X Pixel): Tools used for remarketing and behavioural advertising purposes. They inform global social media platforms about visits to specific areas of the Semantio Platform, allowing us to display more relevant advertisements in other parts of the Internet. The respective advertising platforms use this data for profiling, matching advertisements to profiles identified in their systems.

4. Embedded content (e.g., YouTube): The display of videos embedded from external portals on the Semantio Platform is subject to a "placeholder" system. Until you actively consent to their playback (by clicking the activation component), we do not send any video logs to external corporations. Consent given to display a video involves the storage of tracking cookies from that portal on your device.

Report and research statistics (server log, no cookies)
On report and semantic map pages (addresses containing /reports/) and when report files are downloaded (PDF, media materials, open data), we record the following events on our server: page view, file download, share (name of the network), use of the "Summarise in" button (name of the AI assistant) and a click on the contact or research-order button. With each event we record the country (derived from the IP address without storing the address itself), the browser type and family, the domain of the page you came from, campaign parameters (UTM) and a hash of a visitor identifier. The hash is created with a random key that changes every day, so it cannot link visits from different days. We do not store the IP address, the full browser identifier or any cookies. Visits by robots, e.g. search engines, are counted separately.

Purpose: statistics on the reach of our reports and protection of the files against abuse. Legal basis: the legitimate interest of the Controller (Article 6(1)(f) GDPR). Detailed data is kept for up to 25 months; after that only daily aggregate totals remain.

Hosting provider logs. Vercel, Inc. records technical request logs (including the IP address, time and page address). They serve the operation and security of the website, including limiting the number of file downloads from a single address. Vercel keeps them according to its own retention periods.

Google Analytics and Microsoft Clarity run only after you consent to analytics cookies. Google Consent Mode v2 is used, so all signals stay off until you consent. After consent, Google Analytics sets the _ga and _ga_<id> cookies (up to 2 years) and Microsoft Clarity sets _clck and _clsk. Report events, such as a file download or opening the map, contain no personal data. Your cookie choice is stored in the semantio_gdpr_consent cookie for 12 months.

Meta Pixel (Facebook and Instagram) runs only after you consent to this tool. Until then the Meta script is not downloaded. After consent, the tool tells Meta which pages of the Platform you visited (the page address with campaign parameters, the time of the visit, technical browser data) and sets the _fbp cookie and, when you arrive from an ad, the _fbc cookie (up to 90 days). Meta may link this information to your Facebook or Instagram profile. This lets us measure how our ads perform and show them to people who have visited the Platform (remarketing). We receive only aggregate statistics from Meta. The recipient of the data is Meta Platforms Ireland Limited (Ireland), which may transfer data to the USA.

OpenAI Ads measurement pixel (advertising in ChatGPT) runs only after you consent to this tool. Until then the OpenAI script is not downloaded. The tool shows which ads in ChatGPT lead to visits to the Platform and to actions such as downloading a report, sending the contact form or registering. After consent it sets the cookies __oppref (ad click identifier, 30 days) and __obref (browser identifier, 365 days), and adds the full page address with its parameters and these identifiers to every event. The OpenAI tool may also read data typed into forms (e-mail address, phone number, first and last name) and send it to OpenAI as a SHA-256 hash, together with an approximate location (country, city, region, postcode); this function is controlled by OpenAI. The recipient of the data is OpenAI Ireland Limited (Ireland), which may transfer data to OpenAI group companies in the USA on the basis of standard contractual clauses.

The legal basis for both tools is your consent (Article 6(1)(a) GDPR). We introduce these tools in stages. The current list of tools running on the Platform is always available in the privacy settings (the “Manage cookies” link in the footer); a tool that is not listed there is not in use.

How to manage cookie consents?
You can return to the preferences expressed during your first visit at any time, modifying or rejecting individual sets of cookies. Simply click the "Manage cookies" link located in the footer of every page of our Platform. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

Legal note on automated processing: Your personal data may be subject to profiling for the purpose of personalising marketing content sent, however, it will not be used to make decisions based solely on automated processing that could produce significant legal effects concerning you.

6. Your Rights

In accordance with GDPR requirements, we guarantee you the ability to exercise the following rights free of charge:

• Right of access: You can request information about the data processed about you.

• Right to rectification: You can update your data at any time, either through the application or by contacting us.

• Right to erasure (right to be forgotten): If we do not have a strong, alternative legal basis for retaining them (e.g., the aforementioned fraud registry or accounting obligations).

• Right to restriction of processing and data portability.

• Right to object: To the processing of data based on our legitimate interest (including against the use of email for informational and offer communication or against profiling).

• Complaint to the Supervisory Authority: You have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO) if you believe that our actions violate applicable legal standards.