We care about your data as much as we care about your projects. Below we explain what personal data veedeck processes, for what purpose, on what legal basis, and what rights you are entitled to.
This Privacy Policy sets out the rules for processing the personal data of Users of the veedeck platform, available at veedeck.com, including the data of people using the contact forms on the site.
The Policy was developed based on:
The rules for using cookie files are described in a separate Cookie Policy.
The Policy also covers features based on artificial intelligence: the AI Agent (point 4.8), voice dictation (point 4.9), and Veezard and AI summaries (point 4.10).
The controller of personal data is Daniel Rychlik, a sole trader operating under the business name Daniel Rychlik Management, with a permanent place of business at ul. Młynarska 2A/17, 51-116 Wrocław, Poland, NIP: 8943229341, REGON: 527749980, hereinafter referred to as the "Controller". Due to the nature and scale of the business, the Controller has not appointed a Data Protection Officer.
For matters concerning the processing of personal data, including the exercise of rights, you may contact the Controller at the e-mail address contact@veedeck.com.
The Policy applies in particular to:
The Policy also applies to people whose data the User enters into the Platform as part of their business (e.g. the designer's clients and contractors), including when that data is processed by the AI Agent. With regard to such data, the User is the controller, and the Platform Controller processes it on the User's behalf as a processor, under the terms set out in the Data Processing Agreement, which forms part of the Terms of Service.
Payments are handled by Stripe (Stripe Payments Europe, Limited, using Stripe, Inc. infrastructure), including the BLIK and Przelewy24 methods. The Controller does not store full payment-card numbers - these are processed exclusively by the payment operator.
Providing the data is voluntary but necessary to receive a reply. Data from the form is not used for other purposes (e.g. marketing) without separate consent.
Consent can be withdrawn at any time, e.g. via a link in the message content or by contacting the Controller.
The veedeck.com website uses Google Analytics 4, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). The tool is loaded only after the User gives consent in the cookie banner (using the Google Consent Mode v2 mechanism). Google processes data including the pages visited, referral source, approximate location (with IP address anonymisation), and device and browser type. Data in Google Analytics is stored for the period set by the Controller (up to 14 months), after which it is automatically deleted or aggregated. For details on cookie files, see the Cookie Policy.
Google Analytics 4 runs only on the veedeck.com website, after consent is given in the cookie banner. In the Platform (designer panel, client panel, contractor panel, share links) we do not use Google Analytics or any other third-party analytics tools.
Internal Platform usage analytics. In the Platform we run our own product usage analytics, without any third-party tools. The data is stored in the Platform's database (OVH hosting, EEA) and is available only to the Controller in the admin panel.
You may object to this processing at any time by writing to contact@veedeck.com.
Under all plans (Solo, Studio, Office) the platform provides the Veepick extension - a browser extension used to retrieve product data from supplier/store websites indicated by the User, for use in projects and client presentations.
The extension processes data about products, not the personal data of third parties - except where the User themselves enters such data into the project content. In that case, the User is responsible as the controller of that data.
Detailed information on the scope of data read and processed by the Veepick extension (including data stored locally in the browser and the product page URL) can be found in the dedicated Veepick Privacy Policy.
A bug report can also be sent from within the AI Agent. The report contains the bug number, date, workspace and module; the content of the conversation with the AI Agent is attached only if the User consents to this in the report form.
The Platform offers an AI Agent – a chat assistant that answers the User's questions, prepares summaries and – after the User confirms – performs actions in the Platform's modules (e.g. adds a client, creates a project, drafts a message). The AI Agent uses the Claude language model provided by Anthropic. When you talk to the AI Agent, you are talking to an artificial intelligence system, not a human.
Data scope:
Recipient: Anthropic (Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland) as a processor under a data-processing agreement. Under its terms of service, Anthropic does not use data sent through the API to train its models, and as a rule deletes inputs and outputs within 30 days, with exceptions provided for in the agreement (e.g. legal obligations, abuse prevention).
No automated decisions: the AI Agent does not make decisions that produce legal effects concerning anyone or similarly significantly affect them (Art. 22 GDPR). Every action that changes data or is visible to a client or contractor requires the User's confirmation.
AI answers: the AI Agent's answers are generated automatically and may contain errors. They should be verified before being used with clients.
The User may voluntarily dictate a command by voice instead of typing it; using dictation is not a condition of using the AI Agent or the Platform. After clicking the microphone button, audio is streamed live, while speaking, to the speech-recognition provider (ElevenLabs), which converts it into text displayed in the command field; the text is then passed to the AI Agent (point 4.8). Recording lasts only from clicking the microphone button until it is stopped, is indicated in the interface, and requires the browser's permission to access the microphone.
Recipient: Eleven Labs Inc., 169 Madison Ave #2484, New York, NY 10016, USA as a processor, acting under a data processing agreement (DPA) that forms part of the provider's terms of service. Use of recordings to train the provider's models is disabled in veedeck's account settings with the provider.
Transfers outside the EEA: dictation data is stored in the United States. The transfer is based on the standard contractual clauses included in the provider's DPA; the provider also participates in the EU-US Data Privacy Framework.
Retention: veedeck does not store recordings; only the transcript is saved, as part of the conversation with the AI Agent (period – point 7). The provider saves the recording and transcript of each dictation session. The provider does not specify a retention period for this service and does not offer a way to delete an individual session, so the data is kept for as long as veedeck uses the provider's service. After the relationship ends, it is deleted in accordance with the agreement with the provider; deleted data may remain in the provider's backups for up to 30 days.
Veezard is a set of AI tools for working with visualisations: quality enhancement, relighting, adding people, editing a selected area, generating 3D models, and a chat that helps prepare a prompt. The Platform also offers AI summaries of comments on visualisations and of survey responses.
Data scope:
Recipients: Replicate, LLC (USA) and the providers of models made available through Replicate – image processing; Anthropic (point 4.8) – the Veezard chat and summaries. Results are saved in the Platform as project files.
Model training: Anthropic does not use the data to train models. Under its terms, Replicate uses uploaded data solely to generate the result, and automatically deletes inputs, outputs and logs after one hour.
Recommendation for the User: do not upload to Veezard photos showing people, documents or other personal data unless this is necessary for the edit.
Data may be shared with the following recipients.
Platform:
veedeck.com website: Google (Tag Manager, Analytics, Fonts), Calendly LLC (booking presentations), Formspree, Inc. (contact form), CookieYes Limited (cookie banner), library CDN provider (unpkg).
A data-processing agreement (Art. 28 GDPR) is concluded with every entity that processes data on behalf of the Controller.
Outside the EEA, data is transferred to: Anthropic (USA – AI Agent and other AI features), Eleven Labs Inc. (USA – voice dictation), Replicate, LLC and model providers (USA – Veezard), T3 Tools Inc. – UploadThing (USA), Stripe (USA), Google (USA), Calendly and Formspree (USA – veedeck.com website). Transfers are based on standard contractual clauses approved by the European Commission or on the Commission's decision on the EU-US Data Privacy Framework, where the recipient is covered by it. Pusher processes data in an EU cluster. A copy of the safeguards can be obtained by contacting the Controller.
| Data category | Retention period |
|---|---|
| Account data and service usage history | for the duration of the contract + the statute-of-limitations period for claims (generally up to 6 years after the end of the relationship) |
| Billing / accounting data | 5 years from the end of the tax year in which the document was issued |
| Contact-form data | until the correspondence is concluded + the statute-of-limitations period for claims |
| Data processed on the basis of marketing consent | until consent is withdrawn |
| Internal analytics – events | 13 months |
| Internal analytics – daily activity data | 25 months |
Data related to AI features is deleted automatically after the following periods:
| Data category | Retention period |
|---|---|
| Conversations with the AI Agent (messages, including text from voice dictation) | until deleted by the User, no longer than 12 months from the last activity in the conversation |
| History of actions performed by the AI Agent | 12 months from execution; an action can be undone in the Platform for 2 hours after it was performed |
| Answer ratings (thumbs up or down and reasons) | deleted together with the conversation, at the latest after 24 months, or earlier upon objection |
| Veezard chat and AI request logs | content deleted after 90 days, technical data without content – after 12 months |
| Agent memory | until the entry is deleted by the User, the feature is disabled, the account is deleted or access to the workspace is lost |
| Voice recordings (dictation) | veedeck does not store them; the provider (ElevenLabs) saves the session recording and transcript and keeps them for as long as veedeck uses the provider's service, and after deletion – in backups for up to 30 days |
| Acknowledgement of the AI Agent information notice | until the account is deleted |
| Data sent to Anthropic | as a rule up to 30 days on the provider's side, in accordance with its policies |
When an account is deleted, AI Agent data is deleted immediately, and in the case of the owner's account – the AI Agent data of the entire workspace. When a person is removed from a team, their AI Agent conversations and ratings in that workspace are deleted immediately.
Everyone whose data we process has the right to:
The same rights apply to data processed by the AI Agent. You can view and delete your AI Agent conversation history and Agent memory entries in the Platform at any time. You may also object to the use of your answer ratings to improve service quality. The AI Agent does not make automated decisions about you within the meaning of Art. 22 GDPR.
The Controller applies appropriate technical and organisational measures to ensure data security, including encrypted connections (SSL/TLS), access control to systems, and regular reviews of infrastructure security.
For the AI Agent we apply additional safeguards: the AI Agent has access only to the data and modules the User has access to in the given workspace; actions that change data require the User's confirmation and are logged; data is not shared between workspaces; AI service providers process data as processors, and the use of data to train their models is excluded contractually or in the service settings.
The Controller reserves the right to make changes to the Policy, in particular in connection with changes in the law or in the platform's functionality. The current version is published on veedeck.com along with the date of the last update.
For matters related to the protection of personal data: