Spellwand Privacy Policy
Effective date: 17.08.2026 · Version: 2026-08-17
1. Who controls your data
Uladzislau Pavlowski, a sole proprietorship (jednoosobowa działalność gospodarcza) registered in Poland at woj. dolnośląskie, pow. Wrocław, gm. Wrocław, Wrocław, ul. Heleny Motykówny 3-5, lok. 6, 51-209, Poland, tax identification number NIP 8943194890 and statistical registration number REGON 523108534 (“Spellwand”), is controller for account, submitted content, usage, security, and product subscription-state data. Website: spellwand.ai. Privacy contact: support@spellwand.ai.
Sold through Link, LLC and applicable Stripe entities act as separate controllers and Merchant of Record for payment, billing, indirect tax, fraud, disputes, refunds, and transaction support. Their privacy notices govern that processing.
2. Chrome extension behaviour
The extension detects editable fields locally so it can show user-triggered writing controls. It does not send general page content or browsing history to Spellwand. Only text you explicitly submit for improvement, rewriting, translation, or chat is sent to our API and OpenAI. The extension uses Chrome identity for Google sign-in and redirect callbacks, and storage for the local session and settings.
3. Data, purpose, legal basis, recipients, and retention
| Data | Purpose and GDPR basis | Recipients | Retention |
|---|---|---|---|
| Google name, email, and Google ID | Create and secure the account; perform the contract. | Google; Railway | Until account deletion, then identity is removed and the user row pseudonymised. |
| Submitted prompts, selected text, chats, messages, and AI outputs | Provide writing and chat features; perform the contract. | Railway; OpenAI | Until you delete an item or the account. |
| Weekly usage and product subscription status | Enforce Free/Paid allowances and provide access; perform the contract and prevent abuse as a legitimate interest. | Railway; Stripe/Link for payment status | Until account deletion, except minimal legal records. |
| Billing address, payment method, transaction, invoice, tax, fraud, and dispute data | Managed Payments sale, tax, fraud, support, and legal obligations. Link/Stripe determine their applicable bases. | Link and Stripe entities | Under Stripe/Link policies and mandatory financial, tax, dispute, and anti-fraud periods. Spellwand does not receive full card details. |
| Raw verified Stripe webhook payload | Synchronise entitlement, investigate delivery failures, prevent duplication; contract and legitimate interests. | Railway; Stripe/Link | 90 days, then raw JSON and detailed error are redacted while event/object IDs and timestamps remain for deduplication/audit. |
| Application, security, and Caddy access logs, IP address, request ID, timestamps | Security, reliability, incident response; legitimate interests. | Railway | Up to 30 days. |
| Database backups | Resilience and disaster recovery; legitimate interests. | Railway | Up to 30 days, then overwritten. |
| Terms acceptance, Privacy acknowledgement, and minimal subscription/legal records | Prove the agreement and comply with accounting, tax, and legal duties. | Railway; professional advisers and authorities where required | Six years after account closure, or longer where a specific law or live dispute requires it. |
| OpenAI abuse-monitoring logs containing submitted content/output | AI inference security and abuse prevention. | OpenAI and its subprocessors | Up to 30 days in the standard API data mode. Training opt-in is disabled. |
4. Providers and recipients
| Provider | Role and purpose | Data | Region, transfer, retention |
|---|---|---|---|
| Railway Corporation — DPA executed 16.08.2026 | Processor: API, PostgreSQL, backups, operational logs. | Account, content, technical, usage, and subscription state. | EU West Amsterdam; possible support transfers under the DPA/SCC/DPF. Logs/backups up to 30 days. |
| OpenAI Ireland Ltd. — OpenAI DPA applicable to the Polish business organization | Processor: AI inference. | Prompt/chat context and generated output; email is not deliberately sent. | Approved OpenAI infrastructure/subprocessors; SCC where needed. Abuse monitoring up to 30 days; no training opt-in. |
| Sold through Link, LLC; Stripe Payments Europe, Limited; and Stripe Technology Europe, Limited — Managed Payments Terms accepted 16.08.2026 | Independent controller/Merchant of Record and applicable payment-service providers: billing, tax, fraud, disputes, refunds, communications, transaction support. | Contact, address, payment, tax, subscription, invoice, and antifraud data. | Global Stripe infrastructure under its Data Privacy Framework/SCC and policies; legal retention set by Link/Stripe. |
| Google entity applicable to your region | Independent controller: OAuth identity and Chrome Web Store distribution. | Name, email, Google ID, authentication, store, and device technical data. | Under Google policies and transfer mechanisms. |
Caddy is software running inside our hosting environment, not a subprocessor. Spellwand does not use Cloudflare, advertising, analytics, or an external monitoring provider in this MVP.
5. Managed Payments and Link deletion requests
Link directly collects payment method and billing address data. Spellwand receives identifiers and payment/subscription status needed for access, but not full card details. Link may independently delete Stripe transaction/customer objects and cancel a Managed Payments subscription after a verified customer deletion request. Stripe may notify Spellwand by email; we follow an operational runbook to verify the notice, synchronise local entitlement, and complete or schedule local account deletion.
6. International transfers
Where data leaves the EEA, providers use an adequacy decision, the EU-US Data Privacy Framework where applicable, Standard Contractual Clauses, and supplementary safeguards described in their DPAs. You may request information about the relevant safeguard from us.
7. Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw a consent where consent is actually used, without affecting prior processing. Contract and legal-obligation processing does not depend on accepting this Privacy Policy as “consent”.
You can request account deletion by emailing support@spellwand.ai from the email address associated with your account. Free/cancelled accounts are erased promptly; active Paid accounts are scheduled for the paid period end and may be unscheduled before then by contacting the same address. Contact us for other data-rights requests as well. We may verify identity and normally respond within one month.
You may complain to the President of the Polish Personal Data Protection Office (UODO), uodo.gov.pl, or your local EEA supervisory authority.
8. No sale, advertising, or significant automated decisions
We do not sell personal data, use it for targeted advertising, or make decisions producing legal or similarly significant effects solely by automated means. We do not intentionally collect precise location, health data, or browsing history.
9. Chrome Web Store Limited Use
Use and transfer of information received from Google APIs complies with the Chrome Web Store User Data Policy, including Limited Use requirements. Data is used only to provide or improve the prominent user-facing writing functionality, is not transferred for advertising, creditworthiness, or unrelated profiling, and is not accessed by humans except with permission for support, for security/abuse investigation, or where law requires it.
10. Security and children
We use encrypted transport, least-privilege access, hashed rotating refresh tokens, short-lived access tokens, restricted secrets, database backups, dependency and secret scanning, and structured logs that exclude prompts, tokens, AI output, and Stripe payloads. No system is completely secure. Notify us at support@spellwand.ai if you suspect an incident.
The Service is not intended for children under 16. If local law requires a higher minimum age or parental authorisation, that rule applies. Contact us if you believe a child provided data unlawfully.
11. Changes and contact
We version this Policy and announce material changes. A material update requires a new acknowledgement where appropriate; accepting the Terms and acknowledging this Policy are recorded separately.
Uladzislau Pavlowski
woj. dolnośląskie, pow. Wrocław, gm. Wrocław
Wrocław, ul. Heleny Motykówny 3-5, lok. 6
51-209, Poland
NIP: 8943194890
REGON: 523108534
spellwand.ai
support@spellwand.ai