1. Who is responsible
UGESI (the "controller") operates this site and decides how personal data is processed. Privacy contact: support@ugesi.com. This policy applies to the website, the tools, the API and our emails.
2. What we collect
Account data: email address, password hash, language, plan and credit balance. Billing data: handled by our payment processor. We receive the transaction status and an invoice reference, never full card numbers. Content data: prompts, AI chat messages and the answers of the models. It also covers uploaded files, reference images and audio, and the outputs you generate. Technical data: IP address, browser and device details, request logs, error reports. Usage data: which tools you open, which jobs succeed or fail, and credit movements.
Webinar registration data: email address, consents given, the chosen screening time and questions sent through the form. It also covers whether the room, the recording and the order page were opened. The campaign source of your visit (utm parameters in the link).
Free AI certificate: the name you type for the certificate. It also covers the test result (score, number of correct answers, level) and the test language. Finally, it covers the date of issue and a one-way hash of your network address. No email address or account is needed. Your answers in the test are checked on our server and are not stored.
3. Why and on what legal basis
To provide the service you request and meter your credits: performance of a contract. To keep the service secure and prevent abuse: our legitimate interest in running a safe platform. The same applies to enforcing consent rules for face and voice tools. To issue invoices and keep accounting records: legal obligation. To send lifecycle emails about your account and credits: performance of a contract. To send news about new models: only with your consent, revocable in one click. To improve the product using aggregated, non-identifying statistics: legitimate interest.
The AI webinar (link, reminders, emails after the webinar): the consent you give when registering. Offer emails after the webinar: a separate, optional consent. Statistics with a visit identifier and campaign source in a cookie: your consent in the cookie notice. The same applies to Meta ad measurement (Pixel and Conversions API). You can withdraw this consent at any time. The campaign source sent with the webinar registration form: our legitimate interest in assessing how campaigns perform.
Free AI certificate: the consent you give in the certificate form. This consent covers issuing the certificate and showing your name, level, score and date on its public verification page. The hashed network address: our legitimate interest in preventing abuse of a free service. We apply a daily limit of certificates per network.
4. Processors and recipients
We use processors bound by data processing agreements. These are AI model providers who run your generation (currently Replicate and the model vendors behind it). They also include our payment processor (Paddle, acting as merchant of record) and our hosting provider. The others are our transactional email provider and an error monitoring service. Each receives only the data needed for its task. We never sell personal data and we never share your prompts or outputs with advertisers.
With marketing consent, data about visits and events (webinar sign-up, purchase) is received by Meta Platforms Ireland Ltd. Meta also processes it for its own advertising purposes under its privacy policy. The webinar video player is provided by YouTube (Google Ireland Ltd.) and loads only after you click.
5. Training on your data
We do not use your prompts, uploads or outputs to train AI models, on any plan. Inputs are passed to the model provider only for the duration of your job. Where a provider offers a contractual no-training guarantee, we rely on it. Where it does not, we choose providers whose published terms exclude training on API inputs.
6. International transfers
Some processors are located outside the European Economic Area, notably in the United States. Transfers rely on the European Commission's adequacy decision under the EU-US Data Privacy Framework where the recipient is certified. Otherwise, they rely on Standard Contractual Clauses. You can request a copy of the safeguards in place.
7. How long we keep data
Prompts and uploads in the tools: until the job completes, then deleted from our systems within 24 hours. Outputs: kept in your account for 30 days so you can download them, then deleted. AI chat conversations: kept in your account until you delete them. They are deleted automatically after 90 days without a new message. Account data: for the life of your account and 30 days after deletion. Invoices and accounting records: as long as tax law requires, typically 5 to 10 years.
Server logs: 30 days. Consent confirmations for face and voice tools: 3 years, because they document that a run was lawful. Webinar registration data: until you unsubscribe from webinar emails and 12 months after that. Without unsubscribing, we delete it after 24 months of inactivity. Records of choices in the cookie notice: 3 years, so we can demonstrate consent. Campaign source: as long as the account or registration it belongs to. For purchases, it is kept together with the transaction records.
Free AI certificates: until you ask us to delete them. The verification page has to keep working for whoever you show the certificate to. Write to support@ugesi.com with the certificate ID. The hashed network address: removed from the certificate record after 2 days.
8. Your rights
Under the GDPR you can ask for access, rectification, erasure, restriction, portability and objection. You can also withdraw consent at any time without affecting past processing. Write to support@ugesi.com from the address on your account. We answer within one month. You can also lodge a complaint with your supervisory authority. For Poland that is the President of the Personal Data Protection Office (UODO).
9. Cookies and analytics
Strictly necessary cookies keep you signed in, protect forms and remember your choice; they need no consent. Statistics (visit identifier, campaign source) and marketing (Meta Pixel, Conversions API) need consent. They run only after you consent in the cookie notice. Without it, events are counted anonymously. You can change or withdraw consent with the “Cookie settings” button in the footer. Details and the list of cookies are on the cookie page.
For visit statistics we use StatCounter (Ireland) and Clicky (USA) on every page. The basis is our legitimate interest in knowing how the site is used. The choice in the cookie notice does not switch them off. Transfers to the USA follow section 6.
10. Security
Data travels over TLS. Passwords are stored as salted hashes. Uploads are served from private storage with expiring links. Access to production data is limited to staff who need it, with logging. If a breach is likely to put you at risk, we will inform you and the supervisory authority. We do so as the law requires.
11. Children
UGESI is for adults. We do not knowingly collect data from anyone under 18, and accounts found to belong to minors are closed. Our tools must never be used to depict minors in a sexual or harmful way; such use is reported.
12. Changes
We update this policy when the service or the law changes. The date of the current version is shown below. Material changes are announced by email to account holders at least 14 days before they apply.
