Privacy Policy

Effective date: November 5, 2026. Version 2026-11-05.

This Privacy Policy describes how Kertészné Martonosi Éva E.V. (sole trader) (registered address: 7621 Pécs, Majorossy Imre utca 4., Hungary; registration number: 56716942 (Hungarian sole trader registration number); tax number: 58086791-1-27), acting as controller, processes personal data associated with Biocrafty (biocrafty.com). The legal bases, purposes, recipients, retention limits and rights below apply independently of your acceptance of the Terms of Service.

1. Controller and privacy contact

1.1 Controller responsibility. The Operator decides the purposes and means of processing for accounts, usage, content and transactions. Send privacy questions, deletion requests and other rights requests to support@biocrafty.com or to the Operator's registered address.

Data protection officer: Not appointed (not required for this Operator).
EU representative (GDPR Article 27): Not applicable (the Operator is established in the EU).
Supervisory authority for the Operator's establishment: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), Hungary, www.naih.hu.

2. Personal data and sources

2.1 Data categories. When you register, buy Credits, submit content, generate bios or contact support, we process:

• Email address: used for passwordless sign-in, service messages (sign-in codes, purchase confirmations), account administration and support. Sign-in codes are stored only as one-way hashes and expire after 10 minutes.
• Acceptance record: the time and version of the Terms you accepted.
• Session cookies: an identifier that keeps you signed in. The server stores only a one-way hash of it.
• Usage and technical data: Credit deductions, restorations and balances; counters for usage limits, stored under a one-way hash of your IP address for up to 24 hours; standard server logs kept by our hosting provider (such as IP address, time and requested page).
• Payment information: purchase amount, currency, date, Stripe transaction references, payment status, refunds, and the email address given at checkout. We do not receive or store your card number; see Section 5.
• User-generated content: the texts you submit and the bios generated for you. Bios generated while you are signed in are saved in your account history until you delete them or your account; audit texts are not saved.
• Waitlist: if you join the waitlist for paid generation, your email address and the time of your consent. We use it only to tell you when paid generation launches. The legal basis is your consent (Art. 6(1)(a)); you can withdraw it at any time, free of charge, by emailing support@biocrafty.com, and we will remove you. We do not share the waitlist with third parties other than our hosting and email providers.
• Support communications: messages and account or transaction information you send us.

2.2 Sources and minimization. Data comes from you, from your browser's interaction with the Service, and from payment confirmations from Stripe. We store no account passwords or account-holder names. Please avoid entering names of third parties, health information, genetic data or other sensitive personal data in Inputs or support messages unless strictly necessary and lawful.

3. Purposes and GDPR legal bases

3.1 Contract performance (Art. 6(1)(b)). To authenticate your account, maintain sessions, run Generations, deliver and save Outputs, administer Credits and their expiry, restore Credits after failures, process purchases, communicate about transactions, and handle service-related support and account closure.

3.2 Legitimate interests (Art. 6(1)(f)). To protect accounts and platform security, prevent and investigate abuse (including usage-limit counters), diagnose failures, keep the Service reliable, and establish, exercise or defend legal claims. We weigh these interests against your rights and reasonable expectations. We do not share your data for third-party analytics or marketing.

3.3 Legal obligations and consent (Art. 6(1)(c), 6(1)(a)). For necessary accounting, tax and regulatory records and legally required disclosures. Where a separate optional purpose requires consent, we will name it and obtain consent before processing; you can withdraw consent at any time without affecting earlier lawful processing. Agreeing to the Terms is not consent under GDPR Article 9 for special-category data.

3.4 Required data and automated processing. An email address and a working session are necessary for account access; payment information is necessary for purchases; Inputs are necessary for Generations. Without them the feature cannot work. AI generation and automated Credit accounting are operational processing, not decisions intended to produce legal or similarly significant effects under GDPR Article 22. Any future qualifying decision-making would require a separate notice, valid legal basis and safeguards.

4. Cookies and session information

4.1 Essential session cookie. Biocrafty uses a session cookie for passwordless sign-in, keeping you logged in, and associating usage and Credit activity with your account. It is strictly necessary to provide the service you request and is used under the national implementation of Article 5(3) of Directive 2002/58/EC. This exemption from cookie consent does not remove GDPR requirements for the associated personal data.

4.2 Cookie particulars. Authentication cookie name: bc_sess. Provider: Biocrafty (biocrafty.com, first party). Duration: up to 30 days, or until you sign out (flags: HttpOnly, SameSite=Lax, Secure). We set no other cookies.

4.3 Controls and optional cookies. You can manage or delete cookies in your browser, although essential functionality may then stop working. Non-essential analytics, advertising or tracking cookies would require a separate notice and prior consent; none are used.

5. Recipients and service providers

5.1 Payment processing. We share data with Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (United States) to complete and confirm payments, run legally required payment checks and handle payment disputes. Payment processor privacy notice: https://stripe.com/privacy. Card details you enter at checkout go directly to the processor and are governed by its handling and security arrangements.

5.2 AI provider. To produce a bio or an audit, the text you submit is sent to Anthropic (the Claude API), which processes it on our behalf as a processor under its commercial terms. We do not use your texts for model training.

5.3 Hosting and email. The Service is hosted by Hostinger, which also runs the mailbox used to send sign-in codes and purchase confirmations. Both act as our processors.

5.4 Page resources. Your browser loads the page's scripts and fonts from content-delivery providers (for example Google Fonts, cdnjs and the Tailwind CDN), which can see your IP address and browser details when they serve those files.

5.5 Recipient responsibilities. Where a provider acts as our processor, a GDPR Article 28 agreement governs its processing. Where it acts as an independent controller (for example Stripe for payment, fraud-prevention and regulatory purposes), its own privacy notice applies. We do not sell personal data or disclose it to third parties for advertising, marketing or analytics.

5.6 Compelled disclosure. We may disclose personal data to a competent authority or court where a binding legal obligation requires it, after assessing the scope and validity of the request, and only to the extent legally required.

6. International transfers

6.1 Transfer safeguards. Some of our providers, in particular Anthropic and Stripe, process data in the United States or other countries outside the European Economic Area. Such transfers rely on an adequacy decision under GDPR Article 45 (for example the EU-US Data Privacy Framework for certified recipients) or on appropriate safeguards under Article 46, such as the European Commission's standard contractual clauses, with transfer assessments and supplementary measures where necessary. Article 49 derogations are used only within their narrow legal conditions.

6.2 Transfer details. Destination countries and recipients: United States (Anthropic, Stripe). Transfer mechanism: EU-US Data Privacy Framework where the recipient is certified, otherwise European Commission standard contractual clauses. You may ask for information about the safeguards and a copy of the relevant contractual safeguards through the privacy contact, subject to proportionate redaction of protected information.

7. Retention and deletion

7.1 Principles. We keep personal data only as long as reasonably necessary for the stated purpose, a binding legal retention duty, or a specific and proportionate legal-claims need. Credit expiry does not by itself require deleting records that remain necessary to explain a transaction or meet a legal obligation.

7.2 Category-specific criteria. Email and account records: while the account is active, then only as needed for closure, security or legal purposes. Sessions: until the cookie expires (30 days), you sign out, or the account is deleted. Sign-in codes: 10 minutes. Waitlist: until you withdraw consent, until we have sent the launch notice, or at most 12 months after you joined, whichever comes first. Usage-limit counters: up to 24 hours. Usage records: while needed for Credit administration, failure resolution, security and disputes. Payment records: for the statutory accounting and tax period. Saved bios: until you delete them or your account.

7.3 Deletion requests and residual copies. You can delete single bios, all bios, or your whole account in the account panel, or ask us by email. After verification we erase eligible data without undue delay and identify any lawful exception. When an account is deleted, payment records stay without a link to an account for as long as the law requires. Backups containing deleted data remain access-restricted and are removed through the applicable backup cycle; a restored backup must reapply the deletion. Statutory transaction retention period: 8 years from the end of the year of the transaction (Hungarian accounting rules). Backup deletion cycle: up to 30 days.

8. Security and personal-data breaches

8.1 Security measures. Biocrafty protects personal data with encrypted connections (HTTPS), hashed sign-in codes and session identifiers, access controls limited to operational need, and restricted server configuration. Measures are assessed against the processing risks and GDPR Article 32. No technical system can guarantee absolute security.

8.2 Breach response. We investigate suspected personal-data breaches and take containment and remediation measures. Where GDPR Article 33 requires it, we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware. Where Article 34 requires notification because of a likely high risk, we inform the affected individuals without undue delay.

9. Your data-protection rights

9.1 Available rights. Subject to applicable conditions and exemptions, GDPR gives you:

• Access: confirmation of processing, information and a copy of your personal data.
• Rectification: correction of inaccurate data and completion of incomplete data.
• Erasure: deletion where a ground under Article 17 applies.
• Restriction: limited processing in the circumstances of Article 18.
• Portability: receive qualifying data you provided in a structured, commonly used, machine-readable format.
• Objection: object on grounds relating to your situation to processing based on legitimate interests; we must stop unless we establish compelling legitimate grounds.
• Consent withdrawal: withdraw any optional consent as easily as it was given.
• Complaint and judicial remedy: complain to a supervisory authority, particularly in your country of habitual residence, workplace or the place of the alleged infringement, and pursue judicial remedies.

9.2 Requests and timing. Send requests to support@biocrafty.com, preferably from your account email. We may ask for additional information only where reasonably necessary to verify your identity. We respond without undue delay and within one month of receipt; where permitted because of complexity or the number of requests, this may be extended by two further months, with notice and reasons within the first month. Requests are ordinarily free; charges or refusal are limited to the circumstances allowed by GDPR Article 12.

10. Children, updates and interpretation

10.1 Adults only. Biocrafty is restricted to users aged 18 and older. If we learn that a minor opened an account, we will restrict the account and handle deletion and transaction records in line with applicable law. A parent or guardian may notify support of suspected underage use.

10.2 Policy updates. We publish updated versions with their effective dates and give direct notice of material changes where appropriate. A materially different processing purpose requires the information required by GDPR Articles 13 or 14 before the new processing begins and a separate valid legal basis. Continued use alone is not consent where GDPR requires consent.

10.3 Applicable privacy law. GDPR and applicable EU Member State data-protection and electronic-communications laws govern processing within their scope. This Policy is interpreted consistently with those laws and cannot waive anyone's statutory rights. A conflict between commercial terms and mandatory data-protection requirements is resolved in favor of the mandatory requirements.