Privacy Policy

§ 1. Who is responsible for your data

1. The controller of personal data is DESEO DESIGN spółka z ograniczoną odpowiedzialnością, registered office in Katowice, al. Korfantego 125a, 40-156 Katowice, Poland, entered in the register of entrepreneurs of the National Court Register under KRS 0000975111, VAT ID (NIP) 9542841278, REGON 522194951 ("we", "the Provider").
2. For anything concerning personal data, write to admin@converterseo.com.
3. We have not appointed a data protection officer — we are not required to. Correspondence is handled directly by the company's management board.
4. This policy covers the three services described in the Terms of Service: the website at converterseo.com together with the free online Converter, the customer panel at app.converterseo.com, and the ConverterSEO Plugin for WordPress.

§ 2. The capacity in which we act

This paragraph is the most important one in the document, because the same

regulation imposes entirely different obligations on a controller and on a

processor.

1. In relation to your own data — email address, company details, company profile, licence keys, subscription data and usage statistics — we are an independent controller. This policy describes how we process it.
2. In relation to the contents of the images you send for description we are a processor, and you remain the controller. We then act solely on your instructions, on the terms of the Data Processing Agreement, which is Annex 2 to the Terms.
3. The line between paragraphs 1 and 2 runs exactly along the edge of the file: what you typed into a form is ours to control; what is visible in the picture stays yours.

§ 3. The four routes by which data reaches us

1. The online Converter at converterseo.com. Conversion happens entirely in your browser, using its own image engine. No file is sent to any server — you can verify this yourself by opening the "Network" tab in your browser's developer tools and converting an image. We receive no data from it.
2. The customer panel at app.converterseo.com. We receive what you type: your email address, your password (stored only as a cryptographic hash), your company details and the company profile from which the instructions for the model are built.
3. The ConverterSEO Plugin for WordPress. When a description is generated, the Plugin sends us the contents of the image and its type, together with the licence key and the address of the site the request comes from. Image compression performed by the Plugin is a separate function and runs on your own server — the files never leave your WordPress installation and never reach us in any form.
4. Payments. All paid plans are sold by Paddle.com Market Ltd acting as merchant of record. Card details, billing address and tax number are given directly to Paddle and never reach our server. All we receive is which plan was paid for and how long it is valid.

§ 4. What we process, why, and on what basis

Providing data is voluntary, but without an email address no account can be

created, and without a company profile the descriptions will be markedly more

generic.

§ 5. What exactly happens to your images

1. On this website: nothing. The image never leaves your computer.
2. Through the Plugin: the image reaches our server in Poland and is passed from there to Anthropic PBC, which performs the image analysis and returns text. The image is not stored by us — it exists only for as long as the request takes and ceases to exist when the request ends.
3. We do not keep the contents of images or the text of generated descriptions. We keep only a record that the operation happened, with its numerical parameters.
4. We do not use your images or descriptions to train any model, and we have secured the same undertaking from our provider.
5. An image may contain personal data — most often the likeness of a person visible in it. You are responsible for having the right to send us such an image for processing; we are responsible for what happens to it afterwards.

§ 6. Who else receives the data

We do not sell data, do not share it with brokers and do not use it for

advertising. Apart from us, only the following entities have access to the data,

to the extent necessary to provide the service:

Google Ireland Limited receives neither your name nor your email address from us,

and the tool does not start until you click to consent on the cookie bar.

Refusing changes nothing about how the service works. See § 4 of the Cookies

Policy.

Data may be disclosed to authorised public authorities where they request it on

a statutory basis.

§ 7. Transfers outside the European Economic Area

1. Image analysis takes place at a provider established in the United States, which constitutes a transfer to a third country.
2. The transfer is based on the standard contractual clauses adopted by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, set out in the Data Processing Addendum of Anthropic PBC, which forms part of our agreement with that entity. Anthropic PBC does not rely in that document on certification under the EU–US Data Privacy Framework.
3. The United Kingdom, where Paddle operates, is covered by a European Commission adequacy decision; that transfer therefore requires no additional safeguard.
4. Google Ireland Limited is established in Ireland, that is within the European Union, but within the Google group statistical data may be sent outside the European Economic Area. The basis is the standard contractual clauses adopted by the same decision (EU) 2021/914, contained in the Google Analytics data processing terms. The transfer happens only if you give consent — without it the tool does not start at all.
5. All remaining operations take place on a server in Poland.
6. We will provide a copy of the standard contractual clauses on request sent to admin@converterseo.com.

§ 8. How long we keep things

You may at any time ask for your account and data to be deleted sooner, except

for data we are required by law to retain.

§ 9. Your rights

1. You have the right to:

• access your data and obtain a copy of it (art. 15 GDPR);
• rectification of inaccurate data (art. 16 GDPR);
• erasure of your data (art. 17 GDPR);
• restriction of processing (art. 18 GDPR);
• portability of your data in a machine-readable format (art. 20 GDPR);
• objection to processing based on our legitimate interest (art. 21 GDPR).

2. A request sent to admin@converterseo.com from the email address attached to the account is enough. We answer within 30 days.
3. If you consider that we process data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.
4. Exercising the right to erasure of account data means terminating the service contract — without account data the account cannot be run.

§ 10. Cookies and browser storage

1. The converterseo.com website and the online Converter contain no advertising scripts and nothing that tracks you outside our own service. Typefaces are served from our own server, not from an external library.
2. The only things we store are:

• pll_language — a cookie remembering the language you chose;
• cseo-zgoda — an entry in the browser's local storage remembering your consent decision;
• converterseo-session and XSRF-TOKEN — customer panel cookies that keep you signed in and protect forms; without them the panel cannot work.

3. All of the above are strictly necessary for the chosen function to work, so they do not require consent.
4. Google Analytics starts only after you have given consent and then writes the _ga and _ga_<identifier> cookies. Until then your browser makes no connection to Google's servers.
5. Paddle's script, needed to display prices in your currency and to take payment, loads by default, because without it the pricing page cannot show a price. It writes no tracking or advertising cookies. After a click on "Essential only" it stops loading.
6. The details are set out in the Cookies Policy.

§ 11. Automated decision-making

We do not take decisions about you based solely on automated processing that

would produce legal effects or similarly significantly affect you. The language

model produces text, not an assessment of you as a person, and we do not

profile users.

§ 12. Security

1. All communication with the website, the panel and our API runs over HTTPS.
2. Passwords are stored only as a cryptographic hash — we do not know them and cannot reconstruct them.
3. Access to the production server is limited to those who need it, with key authentication.
4. A personal data breach likely to result in a high risk to your rights will be notified to you without undue delay, and to the supervisory authority within 72 hours.

§ 13. Children

The service is addressed to businesses and is not intended for persons under the

age of 16. We do not knowingly collect data of such persons.

§ 14. Changes to this Policy

1. We will give notice of any change by email to the address attached to your account at least 14 days before it takes effect.
2. The current version applies from 29 August 2026 and is always available at converterseo.com/privacy/.