Privacy Policy

1. Introduction

atelierR design studio Kft. ("we", "us", or "our") operates PersonaHive (the "Service") and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share personal data when you use our website and Service, in accordance with the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA), and other applicable laws. This policy covers our website personahive.ai and the PersonaHive app at app.personahive.ai.

2. Data Controller

The Data Controller for personal data processed through the Service is:

3. What Data We Collect

• Account data: name, work email, company and organization, when you create an account or submit a form. Sign-in is handled by our identity provider WorkOS; if you use a password, it is stored only as a hash.
• Customer Content: the inputs and calibration data you submit to the Service.
• Billing data: processed by Polar (see Section 7). Polar sends us order and subscription details, which can include your name, email address, billing address and tax ID. We never receive card details.
• Website usage: counts of clicks on our sign-up and log-in buttons and page views, recording the page, the previous page on our site, the device type, the website you came from and any campaign tags, with no identifier. With your consent, we also use Google Analytics, Microsoft Clarity and a random visitor ID in our click and page view logs (see the Cookie Policy).
• Advertising (with your consent): Google's tags on our website, including Google Analytics when you also accept analytics, receive the cookie identifiers they set, the pages you visit on our website, the ad you clicked, your IP address and browser information. Google uses this to measure our ads and to show our ads to people who have visited our website. We do not send Google your name, your email address or anything from the app.
• App usage analytics: if you accept analytics, we record selected app page views, interface controls used and usage events, with their timestamps. When you are signed in, these events are linked to your account. We do not create a separate analytics identifier or record keystrokes or session replays.
• Service and support diagnostics: our servers record requests and background job activity to operate the app and investigate problems. These records may include account and organization identifiers, account email, request and job identifiers, the operation requested, timestamps, response status, processing duration and job outcome. They continue when analytics is off.
• Authentication and security data: sign-in session records, IP addresses and browser information used to sign you in and protect the service, processed by WorkOS. This is separate from analytics.
• Consent records: each privacy choice made on the website or in the app, with the banner version and time. These records contain no account identifier, email address, IP address or visitor identifier. When you are signed in, we also keep a record of your choices with your account; a rejection in your browser always takes precedence.
• Assistant chat: the questions you type into the site assistant are sent to an AI model so it can answer them. We do not store the conversation. To protect the assistant from abuse, we use your IP address and browser information to limit how many messages can be sent. We keep this only until the end of the day. We keep a record of blocked messages (the reason and the time only) for 90 days.
• Technical data: IP address, device type and browser information, processed by our hosting and identity providers to deliver the service and keep it secure.

The analytics events and diagnostic records described above are limited to operational metadata. They exclude free-text form values, study content, prompts, generated responses, passwords and payment-card details. Content you submit to use the service is processed separately as Customer Content.

4. Legal Basis for Processing (GDPR Art. 6)

• Contract performance: to provide the Service you have requested.
• Consent: analytics cookies and identifiers on the website (Google Analytics, Microsoft Clarity and the visitor ID in our click and page view logs), advertising cookies and signals on our website (Google Ads), app usage analytics, and marketing communications. You can withdraw consent at any time under Cookie settings; withdrawal stops future collection and does not affect processing before it.
• Legitimate interests: to secure the Service and prevent fraud and abuse; to count website button clicks and page views without identifiers; to keep limited server request and job records so we can run a reliable service and resolve problems you report; to remember interface settings you choose; and to keep records of privacy choices. We limit these records to operational metadata and restrict access to authorized personnel. You can object by writing to founders@personahive.ai.
• Legal obligation: tax, accounting and lawful requests from competent authorities.

5. How We Use Your Data

• Operate and secure the service, investigate failed or delayed requests and background jobs, and help with support requests.
• With your consent, understand how the website and app are used and improve them.
• With your consent, measure the results of our ads and show our ads to people who have visited our website.
• Remember, apply and record your privacy choices.
• Respond to demo requests and early-access registrations.
• Send transactional emails (account, billing, security notices).
• Send product updates and marketing only with your consent (you can unsubscribe at any time).
• Detect and prevent abuse, fraud, and security incidents.
• Comply with legal and regulatory obligations.

Cookie choices do not subscribe you to marketing emails.

6. AI Processing & Synthetic Personas

The Service generates synthetic personas and simulated responses using models delivered through Microsoft Azure AI Foundry under enterprise terms. The following commitments apply:

• Synthetic personas are statistical constructs and do not represent identifiable individuals.
• We do not use Customer Content to train foundation models, our own or third-party.
• Provider processing and any abuse-monitoring retention follow Microsoft's applicable enterprise terms and the configuration of the production resource. We do not claim zero retention unless that setting is verified for the resource in use.
• You should not submit special category personal data (Art. 9 GDPR) or other PII as inputs unless you have a lawful basis to do so.

7. Payments: Polar as Merchant of Record

All paid subscriptions and one-time purchases are processed by Polar Software, Inc. ("Polar"), 3500 South DuPont Highway, Dover, DE 19901, United States, which acts as the Merchant of Record and authorized reseller and is the data controller for payment data (card details, billing address, tax identifiers). Polar sends us order and subscription events so we can provision and manage your purchase. These events can include your name, email address, billing address and tax ID; they never include card details. We keep only the fields needed to reconcile purchases (plan, price, amount, currency, country, tax, status, dates, and order, subscription and customer IDs) and discard the rest once the event is processed. Polar's processing is governed by Polar's Privacy Policy and Buyer Terms and Conditions.

As disclosed by Polar, payment card authorization and settlement are performed by Stripe, Inc. and Stripe Payments Europe, Ltd as Polar's payment processor. Polar publishes its full sub-processor list and Data Processing Addendum. Neither party uses your payment information to train AI models.

8. Subprocessors

We engage the following subprocessors to deliver the Service. All are bound by data processing agreements that include appropriate confidentiality, security, and (where applicable) Standard Contractual Clauses for international transfers.

Microsoft Clarity. With your consent, the website uses Microsoft Clarity to record how pages are used: clicks, scrolling and page movement, with typed text masked. For Clarity data, Microsoft acts as a separate data controller. EU users' data is handled by Microsoft Ireland Operations Limited and stored in Microsoft Azure, with Standard Contractual Clauses for transfers to Microsoft Corporation. Microsoft keeps recordings for 30 days and can delete Clarity data only for a whole website, not for one person. See Microsoft's privacy statement.

Advertising partner, only with your consent: Google, through its European company named in its privacy policy. Google decides how it uses the data its tags collect, under its own privacy policy; we decide whether its tags run on our website. Google may transfer data outside the European Economic Area under its own safeguards, such as the EU-US Data Privacy Framework or Standard Contractual Clauses.

9. Data Retention

To delete your account, write to founders@personahive.ai from the email address on the account. We delete it within one month of your request, together with your sign-in identity at our identity provider WorkOS, the analytics events, the record of your consent choices linked to the account and the copied identity in diagnostic records. We keep billing records for as long as Hungarian accounting law requires. Copies in our encrypted database backups are overwritten within 35 days. Polar keeps its own payment records as merchant of record under its privacy policy. Consent records have no identifier and follow their own schedule.

10. Your Rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Request rectification of inaccurate or incomplete data.
• Request erasure ("right to be forgotten").
• Restrict or object to processing based on legitimate interest.
• Receive your data in a portable, machine-readable format.
• Withdraw consent at any time for consent-based processing.
• Lodge a complaint with a supervisory authority (see Section 16).
• For California residents: opt out of any "sale" or "sharing" of personal information (we do not sell personal data) and limit the use of sensitive personal information.

You can accept, reject or change analytics and advertising at any time under Cookie settings on our website, signed in or signed out; in the app you can change analytics under Cookie settings or Account, Privacy Preferences. Your browser's choice controls analytics even if your account recorded a different choice earlier. Rejecting analytics never stops you from using the service. Changing a cookie choice does not delete records already held on our servers; to ask for that, write to founders@personahive.ai.

To exercise any right, email founders@personahive.ai. We respond within 30 days.

11. Data Security

We implement appropriate technical and organizational measures including encryption in transit and at rest, least-privilege access controls, and regular security reviews. No system is perfectly secure; we will notify affected users and authorities of any qualifying breach within the timelines required by law.

12. International Transfers

Some subprocessors are located outside the European Economic Area. Where applicable we rely on the European Commission's Standard Contractual Clauses (SCCs), supplementary measures, and adequacy decisions. A copy of the relevant safeguards is available on request.

13. Cookies

See our Cookie Policy for details on the cookies we set and how you can manage your preferences.

14. Children

The Service is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or in-product notice. The "Last updated" date at the top of this page reflects the most recent revision.

16. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection supervisory authority. In Hungary, this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH).

17. Contact