Privacy Policy

The data controller is SmashOne AI Sp. z o.o., Aleja Rzeczypospolitej 6/U19, 02-972 Warsaw, Poland (KRS 0001249992, NIP 9512650941). The supervisory authority is the President of the Personal Data Protection Office (UODO), Warsaw, Poland. This Privacy Policy applies to the smashone.ai European public surface.

This policy covers the information you give us when you create an account, the information collected when you use SmashOne, and the information received from the social media platforms you choose to connect: Facebook, Instagram, Telegram, WhatsApp Business, and Google Business Profile, each once that channel is enabled for your account.

We process data from a channel only when you connect that channel to an AI employee, it is enabled for your account, and the connected third-party platform provides the data needed for the feature. Charges for a channel start on Day 15 after the 14-day free trial unless the checkout says otherwise. If a channel is unavailable, withdrawn, or removed for platform access, legal, safety, or policy reasons, we stop collecting new data from that removed channel where technically possible, stop future charges for that removed channel, and keep our customer-facing availability statements aligned with UCPD rules against misleading commercial claims.

We collect account details, business profile information, connected platform metadata, catalog items, scheduled content, messages, billing records, support communications, security logs, and product usage events needed to operate the service. Catalog items may include photographs and other media you upload. Where those photographs show identifiable people — for example your staff, models or customers — they are personal data of those people, and you remain the controller for them.

We use data to provide publishing, messaging, AI assistant, analytics, billing, security, support, product improvement, abuse prevention, and legal compliance.

We process personal data only where we have a legal basis under Article 6 GDPR. The table below maps our main purposes to their legal basis.

Where we rely on legitimate interests, we balance our interest against your rights and only proceed where your interests do not override ours; you may object at any time. Where we rely on consent, you may withdraw it at any time without affecting processing carried out before withdrawal.

Connected social account data is used only to deliver requested publishing, messaging, analytics, and AI assistant features. We do not sell personal information.

The assistant uses your business profile, FAQ, catalog, connected platform messages, and configured tone to draft answers. Sensitive or off-script items can be escalated for human review. AI employees also generate content for you: post text and images produced from the photographs in your catalog. Generated media is created on your instructions, stored with your other content, and published only to the channels you have connected.

We use service providers for hosting, analytics, payments, communications, monitoring, and AI processing. They process data only for the service purposes we authorize.

We use the following sub-processors to operate the service: Hetzner Online GmbH (Germany) for EU application hosting and compute; DigitalOcean, LLC (Frankfurt, Germany) for managed PostgreSQL, Valkey cache, and object storage including backups; Stripe Payments Europe, Ltd. (Ireland), with Stripe, Inc. group affiliates in the United States, for payment processing; Brevo (Sendinblue SAS, France) for transactional email; Google Workspace (Gmail) for inbound email processing at info@smashone.ai; Google LLC (Vertex AI) for AI processing — assistant replies and generated content, including text and images — currently configured with a global processing location; Cloudflare, Inc. for DNS, CDN, WAF, and TLS edge security; Sentry (Functional Software, Inc.) for error monitoring with PII minimisation; PostHog (EU Cloud) for pseudonymous server-side product analytics; and ScrapingBee SAS (France) to retrieve your public business website for the assistant’s knowledge base. Where a sub-processor is US-incorporated or processes data outside the EEA (DigitalOcean, Stripe, Google, Cloudflare, Sentry, PostHog), transfers rely on the EU-US Data Privacy Framework adequacy decision where applicable or Standard Contractual Clauses with supplementary safeguards. The current list, with regions and dates, is maintained on our Sub-processors page; we notify customers at least 30 days before adding a new sub-processor.

When you connect a social platform to SmashOne, that platform processes personal data as an independent controller under GDPR Articles 13 and 14 — not as a SmashOne sub-processor. This is different from the sub-processors above: those process personal data only on SmashOne’s documented instructions under Article 28 GDPR, while a connected social platform decides how it processes personal data on its own platform, for its own purposes, under its own privacy policy. We disclose the platforms below as recipients and independent controllers so you know who receives your data and can read their policies before you connect. The platforms listed below exchange data with SmashOne only for the channels you have connected and that are enabled for your account. SmashOne is not responsible for how these independent platforms process personal data under their own policies. Where a platform and SmashOne genuinely determine purposes and means together for a specific activity, that activity is instead governed as joint controllership under Article 26 GDPR; this section covers platforms acting as separate, independent controllers.

These platforms are independent controllers, not SmashOne sub-processors: they are not listed on our Sub-processors page and do not act on our instructions. To exercise data-protection rights against a platform, use the controls and contacts in its own privacy policy linked above.

EU users may request access, deletion, correction, restriction, portability, or objection. Poland data-protection authority reference: UODO. SmashOne does not sell personal information. Send requests to info@smashone.ai.

We answer data-subject requests within one month of receiving them, free of charge. For complex or numerous requests we may extend this by a further two months, and we will tell you within the first month if we need the extension and why. We may ask you to verify your identity before we act, and if a request is manifestly unfounded or excessive we may charge a reasonable fee or decline, explaining why. Where we rely on your consent, you can withdraw it at any time without affecting processing carried out before withdrawal. SmashOne does not make decisions producing legal or similarly significant effects about you based solely on automated processing. You also have the right to lodge a complaint with the Polish supervisory authority — the Urząd Ochrony Danych Osobowych (UODO) — or with your local EU data-protection authority. To exercise any right, contact info@smashone.ai.

We keep personal data only as long as necessary for the purpose it was collected, then delete or anonymise it. The table below sets out how long we keep each category.

On a verified erasure request we delete your data within the response time set out above, except where we must keep specific records to meet a legal obligation (for example billing and tax records).

Privacy requests: info@smashone.ai. Data controller: SmashOne AI Sp. z o.o., Aleja Rzeczypospolitej 6/U19, 02-972 Warsaw, Poland (KRS 0001249992, NIP 9512650941).