Privacy Policy

PRIVACY POLICY

Effective date: April 29, 2026

This Privacy Policy (“Policy”) explains how we collect, use, disclose and protect personal data when you access or use BuyFollows and related pages, applications and services (the “Service”). This Policy is intended to meet transparency requirements under the EU General Data Protection Regulation (EU GDPR), the UK General Data Protection Regulation (UK GDPR) and applicable Slovak and EU data protection law. We process your personal data in compliance with the EU GDPR and the UK GDPR.

If you do not agree with this Policy, please do not use the Service.

1)    What personal data we collect

We collect personal data in the following categories (depending on how you use the Service).

 Account and profile data:

·      name (if provided), email address, login credentials (stored in hashed form where applicable), account settings and preferences;

·      basic account information you provide through onboarding (including quiz answers).

Subscription and transaction data:

·      subscription status, plan type, billing cycle, purchase history and timestamps;

·      payment confirmation identifiers (e.g., transaction IDs) and limited billing-related metadata;

·      we do not store full payment card details; payment card processing is handled by our payment providers.

Service usage data:

·      log data and device information: IP address, device type, browser type, operating system, language and approximate location derived from IP;

·      usage events and diagnostics: pages viewed, features used, clicks, session data and error logs.

User content:

·      prompts, text and other information you submit to AI tools (“Inputs”).

·      content generated by the Service (“Outputs”), where stored in your account or necessary to provide the Service.

Communications

·      support requests and correspondence via email or in-app channels.

·      feedback and survey responses (if you choose to provide them).

Cookies and similar technologies: cookie identifiers and related data as described in our Cookie Policy.

2)    How we use your personal data

We process personal data for the following purposes:

·      provide and operate the Service (account creation, authentication, course access, AI tool functionality and personalization);

·      manage subscriptions and payments (plan activation, renewals, cancellations, fraud prevention and accounting);

·      customer support (responding to requests, troubleshooting and service-related communications);

·      improve and maintain the Service (analytics, performance monitoring, bug fixes and product development);

·      security and fraud prevention (preventing abuse, enforcing our Terms, protecting infrastructure);

·      legal and compliance (meeting legal obligations and responding to lawful requests);

·      marketing communications (where permitted by law and subject to your choices; opt-out available).

3)    Legal bases for processing (EU GDPR / UK GDPR)

We rely on the following legal bases under the EU GDPR and UK GDPR, depending on the activity:

·      contract performance (Art. 6(1)(b)): to provide the Service and deliver paid features;

·      legal obligation (Art. 6(1)(c)): tax/accounting and compliance;

·      legitimate interests (Art. 6(1)(f)): security, fraud prevention, analytics and improvement (balanced against your rights);

·      consent (Art. 6(1)(a)): where required (e.g., certain cookies/marketing). You may withdraw consent at any time.

4)    AI tools and content processing

We process your Inputs and Outputs to provide AI features.

Please do not include sensitive personal data in prompts unless strictly necessary.

Outputs may be inaccurate or incomplete; you are responsible for reviewing them before use.

We do not sell your Inputs or Outputs.

Improving the Service. By default, we process Inputs/Outputs to deliver functionality, prevent abuse and troubleshoot. Where we use any content to improve the Service (for example, reviewing limited samples to diagnose issues or enhance performance), we do so with appropriate safeguards and access controls. Where required by law, we will obtain consent or provide an opt-out mechanism.

5)    How we share personal data

We may share personal data with:

·       service providers (“processors”). Vendors that help us operate the Service (hosting, infrastructure, analytics, customer support tools, email delivery, payment processing). They process data under contractual obligations and only as instructed by us;

·       payment providers. To process payments, manage chargebacks and prevent fraud. We receive limited transaction metadata; full card details are handled by the payment provider;

·       legal and safety disclosures. Where required by law, court order or lawful request; or where necessary to protect rights, security and the integrity of the Service;

·       business transfers. If we are involved in a merger, acquisition, financing, reorganization or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate safeguards.

6)    International transfers

We are based in Slovakia and primarily process data in the EU/EEA. Some service providers may process data outside the EU/EEA. Where personal data is transferred internationally, we use appropriate safeguards required by the EU GDPR and UK GDPR, such as:

·      an adequacy decision (where applicable); or

·      Standard Contractual Clauses (SCCs) and, where needed, additional measures.

7)    Data retention

We retain personal data only as long as necessary for the purposes described in this Policy:

·      account data: while your account is active; after deletion, limited data may be retained for legal, security and dispute-resolution purposes;

·      subscription and transaction data: as required by applicable tax/accounting laws and to handle disputes and chargebacks;

·      support communications: for a reasonable period to manage support history and quality;

·      logs and security records: for security, fraud prevention and system integrity for a limited period.

Retention periods may vary depending on legal requirements and the nature of the data.

8)    Your rights (EU GDPR / UK GDPR)

If the EU GDPR or UK GDPR applies to you, you have the right to:

·      access your personal data;

·      rectify inaccurate data;

·      request erasure (where applicable);

·      restrict processing;

·      object to processing based on legitimate interests;

·      data portability (for data processed under contract/consent in an automated manner);

·      withdraw consent (where processing is based on consent);

·      lodge a complaint with a supervisory authority.

You can exercise your rights by contacting us at support@smbpanel.net. We may ask you to verify your identity before responding.

9)    Cookies and similar technologies

We use cookies and similar technologies for essential functionality, security and (where enabled) analytics and marketing. Details are described in our Cookie Policy, including how you can manage preferences and consent.

10)    Security

We implement appropriate technical and organizational measures to protect personal data, including access controls, encryption where appropriate and monitoring. However, no method of transmission or storage is 100% secure.

11)     Children’s privacy

The Service is intended for users 18+. Users aged 16-17 may use the Service only with involvement/consent of a parent or legal guardian.

We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided personal data, contact us and we will take appropriate steps.

12)    Automated decision-making

We may use automated processing to personalize recommendations (for example, based on your quiz answers and usage patterns). We do not use solely automated decision-making that produces legal effects or similarly significant effects on you, unless permitted by law and with appropriate safeguards.

13)    Changes to this Policy

We may update this Policy from time to time. Where required by law, we will provide notice of changes in the manner and within the timeframe prescribed by law. Unless notice is required, it is your responsibility to review this Policy periodically. The “Effective date” at the top indicates when the latest version took.

14)    Data controller and contact

Data Controller: Adam Dithalm – SMB (IČO/Business ID: 56 387 288; DIČ/Tax ID: 1129953462).

Аddress: Severná 1290/15, 900 26 Slovenský Grob, Slovakia

Email: support@smbpanel.net.