Privacy Policy

1. Who We Are and What We Do

"Računarsko programiranje GUGUNOVIĆ Saša Gugunović s.p. Kozarska Dubica" company operates Bricks Pilot, a WordPress plugin that provides AI-powered design automation and HTML/CSS conversion features for Bricks Builder users.

Our service enables users to generate designs using artificial intelligence and convert HTML/CSS code into Bricks Builder elements, streamlining the web development process.

2. Data Protection Regulation

We take our responsibilities under data protection regulations seriously and ensure that personal information is held, used, transferred, and processed in accordance with applicable data protection laws and regulations.

This Privacy Policy is designed to comply with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

3. Information We Collect

3.1. Account Registration Data

When you register for Bricks Pilot using email registration, we collect:

• Your name
• Email address
• Password (encrypted and hashed)

We only collect the minimum necessary information to create and manage your account. We do NOT collect or store profile pictures.

3.2. Subscription and Payment Information

When you subscribe to a paid plan, we collect:

• Subscription plan selection and preferences
• Payment information (processed securely by Paddle.com)
• Billing history and invoice details

Important: Payment information is securely processed by our third-party payment provider, Paddle.com. Paddle acts as our Merchant of Record. We do not directly store your full credit card details on our servers. Please review Paddle's privacy policy for information on how they handle your payment data.

3.3. API Keys (BYOK Plans Only)

If you use a Bring Your Own Key (BYOK) subscription plan, we collect and securely store:

• AI provider API keys (encrypted using AES-256-GCM)
• API provider selection preferences

Your API keys are encrypted at rest and in transit. We never share your API keys with anyone except the AI providers you select.

3.4. Usage and Service Data

To provide and improve our services, we automatically collect:

• AI generation prompts - We save your prompts but NOT the generated results/outputs
• HTML/CSS conversion history
• Credits used - We track how many AI generations and conversions you've used
• Usage statistics (number of generations, conversions used per billing period)
• Feature usage patterns
• Error logs and debugging information

Important: We save your AI prompts for your reference and history, but we do NOT save the generated results or outputs. This helps keep our storage minimal while allowing you to track what you've requested.

3.5. Technical and Device Information

Through our website and plugin, we automatically collect:

• IP addresses
• Browser type and version
• Device information and operating system
• WordPress version and site URL
• Pages visited and time spent on each page
• Referring and exit pages
• Date and time stamps of access

4. How We Use Your Information

4.1. Core Service Functionality

• Account creation and authentication
• Processing AI generation and conversion requests
• Managing subscription plans and billing
• Storing and retrieving your generated content
• Communicating service updates and account notifications
• Providing technical support

4.2. Service Improvement and Analytics

• Analyzing service usage patterns to improve features
• Understanding user preferences and behavior
• Optimizing plugin performance and user experience
• Maintaining service security and preventing abuse
• Troubleshooting technical issues and bugs
• Developing new features based on user needs

4.3. Legal and Safety

• Complying with legal obligations and regulations
• Enforcing our Terms of Service
• Protecting against fraud and abuse
• Responding to legal requests and preventing harm

5. Third-Party Services

5.1. AI Providers

We integrate with multiple AI providers to process your generation requests:

• Anthropic: Claude AI models (primary provider for Pro and Business plans)
• Google: Gemini AI models
• OpenAI: GPT models
• xAI: Grok models
• DeepSeek: DeepSeek models

When you use AI features, your prompts are sent to the selected AI provider for processing. Important: Your data is NOT used to train AI models. Each AI provider has their own privacy policy governing how they handle data.

5.2. Paddle

We use Paddle.com as our Merchant of Record to handle all payment processing for subscription services. When you make a payment, Paddle processes your payment information on our behalf.

Paddle is responsible for securely handling your payment data in accordance with PCI DSS standards and their privacy policy. We recommend you review Paddle's policies at https://www.paddle.com/.

5.3. Cloudflare

We utilize Cloudflare for:

• Website security and optimization
• DDoS protection and threat mitigation
• Content delivery and caching
• Traffic analytics and monitoring

5.4. Analytics

We use Google Analytics for:

• Website analytics and usage tracking
• Understanding user behavior and preferences
• Improving service performance

6. Generated Content and Intellectual Property

6.1. Your Generated Content

• All designs and code you generate using Bricks Pilot belong to you
• We store your generated content to provide access through your dashboard
• You control how your generated content is used
• We do not use your generated content for any purpose other than providing our services

6.2. Content Retention

• Generated content is retained as long as your account is active
• You can delete individual generated items at any time
• Upon account deletion, your generated content is permanently removed within 30 days

7. Data Security

We implement comprehensive technical and organizational measures to protect your data:

7.1. Encryption

• At Rest: Sensitive data is encrypted using AES-256-GCM encryption
• In Transit: All data transmission uses HTTPS/TLS encryption
• API Keys: Your BYOK API keys are encrypted with industry-standard encryption

7.2. Authentication and Access Control

• Secure authentication via Google OAuth 2.0
• Password hashing using bcrypt (where applicable)
• Role-based access controls
• Regular security audits and penetration testing

7.3. Infrastructure Security

• Secure cloud hosting with enterprise-grade providers
• Regular security updates and patches
• Automated backups and disaster recovery procedures
• Monitoring and intrusion detection systems

7.4. Data Breach Notification

In the unlikely event of a data breach that affects your personal information, we will notify you and relevant authorities as required by applicable laws, typically within 72 hours of discovering the breach.

8. Data Retention

8.1. Account Information

• Active account information is retained as long as your account exists
• Inactive accounts (no login for 24+ months) may be archived or deleted
• We will notify you before deleting inactive accounts

8.2. Usage and Analytics Data

• Usage statistics are retained for up to 2 years for analytics purposes
• Aggregated and anonymized data may be retained indefinitely

8.3. Deleted Account Data

When you delete your account:

• Your personal information is deleted within 30 days
• Generated content is permanently removed
• Some data may be retained for legal or accounting purposes as required by law
• Anonymized usage data may be retained for analytics

9. Your Privacy Rights

You have the following rights regarding your personal data:

9.1. Right to Access

You can request a copy of all personal data we hold about you.

9.2. Right to Rectification

You can correct any inaccurate or incomplete information in your account settings.

9.3. Right to Erasure (Right to be Forgotten)

You can request deletion of your account and all associated data.

9.4. Right to Data Portability

You can export your data in a machine-readable format.

9.5. Right to Restrict Processing

You can request that we limit how we use your data.

9.6. Right to Object

You can object to certain types of data processing, such as marketing communications.

9.7. Right to Withdraw Consent

You can withdraw consent for data processing at any time.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days.

10. Cookies and Tracking Technologies

10.1. Essential Cookies

We use essential cookies that are necessary for the Service to function:

• Authentication cookies (to keep you logged in)
• Session management cookies
• Security cookies (CSRF protection)

10.2. Analytics Cookies

We use Google Analytics to understand how users interact with our service:

• Page views and navigation patterns
• Feature usage statistics
• Performance metrics

10.3. Managing Cookies

You can control cookie preferences through your browser settings. Note that disabling essential cookies may impact the functionality of our Service.

11. Data Sharing and Disclosure

We do NOT sell your personal information. We only share your data in the following limited circumstances:

11.1. Service Providers

• AI providers (to process your generation requests)
• Payment processors (Paddle.com for billing)
• Cloud hosting providers (for infrastructure)
• Analytics services (Google Analytics)

11.2. Legal Requirements

We may disclose your information when required by law or to:

• Comply with legal obligations or court orders
• Protect our rights and property
• Prevent fraud or abuse
• Protect the safety of users or the public

11.3. Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the new entity. We will notify you before your data is transferred and becomes subject to a different privacy policy.

12. International Data Transfers

Your data may be processed and stored in countries outside of your residence, including the European Union and the United States. We ensure that appropriate safeguards are in place to protect your data in accordance with this Privacy Policy and applicable data protection laws.

13. Children's Privacy

Bricks Pilot is not intended for users under the age of 16. We do not knowingly collect personal information from children under 16. If you believe we have collected information from a child under 16, please contact us immediately at [email protected].

14. Changes to This Privacy Policy

• We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements
• Material changes will be communicated via email or dashboard notification
• The "Last Updated" date at the top indicates when changes were made
• Continued use of the Service after changes constitutes acceptance

15. How to Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

• Privacy Inquiries: [email protected]
• General Support: [email protected]
• Company: Računarsko programiranje GUGUNOVIĆ Saša Gugunović s.p. Kozarska Dubica
• Location: Banja Luka, Bosnia and Herzegovina

For data protection requests (access, deletion, portability), please include "Privacy Request" in your email subject line and provide sufficient information to verify your identity.