Privacy Policy

1. Definitions

• Controller / Neodigix / We – NEODIGIX SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, a Polish company with its registered office in Kraków, at ul. Szlak 77 lok. 222, 31-153 Kraków, Poland, entered into the National Court Register under KRS number 0001238643, NIP: 6762719046, which determines the purposes and means of the processing of your Personal Data relating to your account and billing.
• User / You – any natural person whose Personal Data we process (e.g., an employee or representative of our B2B Client).
• GDPR – Regulation (EU) 2016/679 (General Data Protection Regulation).
• Service – Product Mapper application available at neodigix.com.

2. Contact Information

If you wish to contact us about any matters related to the processing of Personal Data, you can reach us via:

• Email: [email protected]
• Post: NEODIGIX SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, ul. Szlak 77 lok. 222, 31-153 Kraków, Poland

Data Protection Officer (DPO): We are not required to appoint a DPO under Article 37 of the GDPR, as we do not carry out large-scale processing of special categories of data or systematic monitoring of individuals. All data protection inquiries are handled directly by our management.

3. How We Use the Information Collected from You

The Controller uses the Personal Data collected from you (such as account details and billing information) for the following purposes:

• To provide the Service: Creating accounts and providing access to the platform – legal basis: Article 6(1)(b) of the GDPR (performance of a contract). Providing your email address and account details is a contractual requirement; without it, we cannot create an account or provide the Service.
• Billing and Payments: Handling transactions via Stripe – legal basis: Article 6(1)(b) of the GDPR.
• Communication: Replying to your inquiries and sending technical notifications (e.g., email verification, password reset) – legal basis: Article 6(1)(f) of the GDPR (legitimate interest in servicing users).
• Security & System Integrity: Monitoring logs to prevent abuse, unauthorized access, and improve stability – legal basis: Article 6(1)(f) of the GDPR (legitimate interest in securing the Service).
• Legal Obligations: Accounting and tax records – legal basis: Article 6(1)(c) of the GDPR.

4. Data Sharing and Transfers

We may share your Personal Data and uploaded files with the following entities:

• OpenAI, L.L.C. (USA): We use the OpenAI API to perform AI-based product categorization. Only Input Data (uploaded product files) is sent to OpenAI — your account data (email, billing info) is never shared.
  • Data sent to the OpenAI API is not used to train their models (Zero Data Retention applies to API usage).
  • Transfer secured via: Standard Contractual Clauses (SCC) approved by the European Commission.
• Stripe, Inc. (USA / Ireland): Payment processing infrastructure. Only billing-related data is shared (payment amount, currency, metadata). Transfer secured via: EU–US Data Privacy Framework (DPF) and/or Standard Contractual Clauses.
• Hosting Providers: Our servers are located within the European Economic Area (EEA). If any auxiliary services are located outside the EEA, transfers are secured via Standard Contractual Clauses.

We do not sell, rent, or share your Personal Data with any third parties for marketing purposes.

5. Cookies and Local Storage

5.1 Browser Local Storage (Not Cookies)

The Service uses browser localStorage(not cookies) to store authentication tokens (JWT access and refresh tokens) and user session data. This data is stored locally in your browser and is not transmitted automatically with every request. You can delete this data via your browser's developer tools or by logging out.

5.2 Essential Cookies

We use only strictly necessary cookies essential for the Service to function. These do not require consent under the ePrivacy Directive:

• Admin Panel Cookies: sessionid and csrftoken — used only for administrator authentication in the Django admin panel. Regular users do not receive these cookies.
• Stripe Payment Cookies: When you initiate a payment, Stripe may set its own essential cookies required for secure payment processing. See Stripe's Privacy Policy.

5.3 Analytics and Marketing Cookies

We do NOT use any analytics cookies (such as Google Analytics), marketing cookies, or third-party tracking technologies.

6. How Long We Keep Your Data

• Input Data & Output Data (uploaded files and results): Retained only for as long as necessary to provide the Service. Files are deleted immediately upon account deletion or upon a written deletion request submitted to [email protected], whichever occurs first, unless longer retention is required by applicable law.
• Account Data: Stored until you delete your account or request its deletion.
• Transaction Data: Stored for 5 years from the end of the calendar year in which the tax obligation arose, as required by Polish accounting and tax regulations (ustawa o rachunkowości). This obligation applies even after account deletion.
• Consent Records (ToS acceptance): Retained for the duration of the contractual relationship.

7. Your Rights

Under the GDPR, you have the following rights:

• Right of access (Art. 15) – obtain a copy of your personal data we process.
• Right to rectification (Art. 16) – correct inaccurate or incomplete data.
• Right to erasure (Art. 17) – request deletion of your data ("Right to be forgotten"), subject to legal retention obligations.
• Right to restriction of processing (Art. 18) – request that we limit how we use your data.
• Right to data portability (Art. 20) – receive your data in a structured, machine-readable format.
• Right to object (Art. 21) – object to processing based on legitimate interest (Art. 6(1)(f)).
• Right to lodge a complaint (Art. 77) – with the supervisory authority: President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.

To exercise any of the above rights, please contact us at [email protected]. We will respond to your request within one calendar month of receipt, as required by Article 12(3) of the GDPR. In complex cases, this period may be extended by up to two further months, in which case we will notify you within the first month.

8. Automated Decision-Making

We do not carry out automated decision-making, including profiling, that produces legal or similarly significant effects on individuals within the meaning of Article 22 of the GDPR. The AI-based product categorization performed by the Service operates on product data uploaded by the Client and does not make decisions affecting natural persons.

9. Use of Third-Party Services

9.1 OpenAI

The Controller uses the OpenAI platform as an AI service provider for product categorization. Neodigix is not an official product of, or affiliated with, OpenAI. Please visit openai.com/policies/privacy-policy to learn more about how OpenAI processes data.

9.2 Stripe

The Controller uses the Stripe API as a payment infrastructure provider. Please visit stripe.com/privacy to learn more about how Stripe processes data.

9.3 Google reCAPTCHA

The registration form uses Google reCAPTCHA v2 (Google LLC, USA) to prevent automated abuse. When you interact with the reCAPTCHA widget, Google collects technical data including your IP address and browser information to determine whether you are a human user. This data is processed by Google in accordance with Google's Privacy Policy. The legal basis for this processing is our legitimate interest in protecting the Service from spam and abuse (Article 6(1)(f) of the GDPR). Transfer to the USA is secured via Standard Contractual Clauses.

9.4 SMTP2GO (Email Delivery)

We use SMTP2GO (SMTP2GO Pty Ltd, Australia) to deliver transactional emails (e.g., account verification, password reset). Your email address is transmitted to SMTP2GO solely for the purpose of delivering these messages. SMTP2GO does not use your data for marketing purposes. Transfer is secured via Standard Contractual Clauses. Please visit smtp2go.com/privacy to learn more.

10. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy. For any material changes, we will notify you via email to your registered address at least 14 days before the changes take effect. The current version is always available at this page. Continued use of the Service after changes become effective constitutes acceptance of the revised Policy.