Privacy policy

Version 2, effective 26 October 2026

The short version

• We use the photos and stories you share only to make and deliver the adventure you asked for. We never sell them, and we don't train AI on them. Training is switched off on our account; OpenAI handles the photos under its own policy.
• Your brief and your original photos stay private. The finished adventure, with the photos you chose for it, opens for anyone who has its link. Share the link only with people you trust.
• We create the illustrations with generative AI (OpenAI image models), and a person checks every result. You approve the portrait before we build the game.
• We use no advertising cookies and no third-party trackers. Our own analytics counts visits only if you agree.
• You can delete your brief at any time with "Delete data and start over". You can also ask us to delete everything at rafal.kondrat@gmail.com.

1. Who is responsible for your data

The controller of your personal data is Rafał Kondrat, trading as Rafał Kondrat Thirty-A, ul. Majowa 16, 41-706 Ruda Śląska, Poland, registered in CEIDG (the Polish business register), NIP 6561990629, REGON 260077120 ("we").

Write to us at rafal.kondrat@gmail.com, or by post at the address above. We have not appointed a data protection officer, because the law does not require one for our kind of processing. Questions go straight to us.

2. Who this policy is for

• Visitors to hero.vassistant.app, including people who play the demo adventures.
• Buyers, people who fill in a brief or order an adventure.
• Gift recipients and other people who appear in the photos or are described in a brief. Section 6 is written for you.

3. What we use, why, and on what legal basis

We do not send newsletters. If you join the gift-adventure waitlist, we store your email, chosen language, signup page, signup time and consent version to send one email when gifts become available. This is based on your consent (art. 6(1)(a) GDPR). Joining is free and does not place an order or reserve a price or delivery date. We delete the entry after sending the notification, on withdrawal, if the offer is cancelled, or after 180 days, whichever comes first. To withdraw at any time, email rafal.kondrat@gmail.com from the address you used to sign up. Withdrawal does not affect processing before withdrawal. Your address is held in our private database; it is not published or sent to an AI service.

We do not make decisions about you by automated means alone that have legal or similarly significant effects.

Providing data is voluntary. We cannot make an adventure without the photos and details it needs. Please don't include health information, religious or political views, or details of anyone's sex life or sexuality in a brief. If such details arrive, we leave them out of the adventure.

4. Your brief and photos

• The brief and the original photos are stored privately. Only you, with your private return link, and our production team can open them.
• When you upload a photo, we remove its embedded metadata, such as GPS location and camera details. The copy we work with has no location data.
• Your return link works for 30 days. It is the key to your brief: keep it private.
• "Delete data and start over" permanently deletes the brief, all its photos and every version you sent us.
• Photos you mark as memories may appear in the finished game. Photos you add as hero references are used only to draw the hero, unless you also choose them as memories.

5. How we use AI

• AI draws the hero. We create the illustrated likeness, backgrounds and props with OpenAI image models in ChatGPT. A person checks every image, and you approve the portrait.
• We send OpenAI only selected hero photos and short descriptions, never memory photos or your contact details. The person drawn must have agreed to it (for a child, their parent or guardian).
• OpenAI (OpenAI Ireland Ltd) is a separate company. Training is switched off on our account; OpenAI handles the photos under its own policy (openai.com/policies/eu-privacy-policy). We don't train AI on your data or create face-recognition templates.
• Labels. Our website says that the illustrations are made with AI, and every adventure we make for a customer carries the same label.

6. If a game was made about you

Someone close to you prepared this gift, and they gave us your photos and details. Here is what that means.

• Where we got your data. From the person who ordered the adventure: photos of you, your name, and memories and facts they chose to share. They confirmed to us that you had agreed to be drawn as a game hero.
• What we do with it. We use it only to make and host this one adventure. Sections 3 to 5 describe how.
• Our legal basis. Our legitimate interest, and the giver's, in making a personal gift (art. 6(1)(f) GDPR). The adventure is private by link, and we do not use your data for anything else.
• Your rights. You can ask us to remove the adventure, or only the photos of you, and to delete what we hold about you. You can also object to the processing. Write to rafal.kondrat@gmail.com and include the adventure's link so we can find it. We tell you this in the adventure itself, the first time you open it.
• Why you may hear about it only now. We ask the giver to share this page with you when they ask whether you'd like to be a game hero. The story, the photos chosen and the message stay a surprise until you open the game. Telling you more in advance would spoil the gift, and we have no way to contact you, so we publish this information here instead (art. 14(5)(b) GDPR).
• Other people in the photos. The giver confirmed that every clearly recognisable person in the memory photos agreed to appear in the game. For anyone under 18, a parent or guardian agreed. You have the same rights as the recipient.

7. Who else receives data

We use these service providers. They act on our instructions under data processing agreements, unless stated otherwise.

We may also disclose data to public authorities when the law requires it.

7a. Transfers outside the European Economic Area

OpenAI, Stripe and Google may process data in the United States. Where they do, the transfer relies on the EU–US Data Privacy Framework, for companies certified under it, or on the European Commission's standard contractual clauses. Write to us for a copy of the safeguards.

8. How long we keep data

• Original photos and the brief: 30 days after we deliver the adventure, so we can still make the corrections you are entitled to. Then we delete them, including the production copies on our computers and at our AI service. If you never order, we delete a submitted brief 12 months after its last change, and an unsubmitted draft once its return link has expired.
• The finished adventure: while its link is live, at least 12 months from delivery. Before we take it down, we e-mail you so you can keep it longer. You can ask us to remove it sooner.
• Order and payment records: as long as tax and accounting law requires, normally until 5 years from the end of the year in which the tax was due (an order from 2026 is kept until the end of 2032).
• Visit statistics (only if you agreed): 13 months.
• Messages and complaints: until claims are time-barred, up to 6 years.
• Server logs: 14 days.
• Backups are overwritten on a rolling basis within 30 days. A deleted item may survive in a backup until then, but we never restore it into use.

9. Your rights

You have the right to:

• access your data and get a copy;
• correct it;
• have it deleted;
• restrict processing;
• data portability, where processing is based on consent or a contract;
• object at any time to processing based on our legitimate interest;
• withdraw consent at any time, without affecting what was done before.

Write to rafal.kondrat@gmail.com. We answer within one month, and tell you if we need more time for a complex request.

You can complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl), or to the data protection authority in your own country. In the United Kingdom that is the ICO (ico.org.uk).

10. Cookies and local storage

We use no advertising cookies and no third-party cookies.

• Your choice. You can change your analytics choice at any time with the buttons below, or with "Privacy settings" on pages that show it. Rejecting it is as easy as accepting it, and the site works the same either way.
• Do Not Track. If your browser sends a "Do Not Track" signal, we don't load analytics, even if you agreed earlier.
• Our own servers record each request in a log (section 3). That is necessary to deliver the page and keep it secure.

11. Security

All traffic is encrypted (HTTPS). Briefs and original photos sit in private storage that needs authorisation to open, and return links are stored only as hashes. Access is limited to the people who make adventures. A finished adventure is protected by its unguessable link and is hidden from search engines. Anyone who has the link can open it, so please share it carefully.

12. Children

Our service is for adults: you must be 18 to order. The adventures are not designed for children to use without an adult. If a photo shows someone under 18, the buyer confirms that they are the child's parent or guardian, or have the guardian's permission. We may crop out or decline photos of other children. We do not knowingly collect personal data directly from children under 13.

13. California and other US residents

• We collect the categories of personal information described in section 3: identifiers (name, e-mail), photos, the information you write in a brief, payment status and internet activity on our site.
• We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not track you across other websites, and we let no one else do so. The service providers that receive data are listed in section 7.
• You can ask us to access, correct or delete your information through the contact details in section 1.
• "Do Not Track": see section 10.
• If we change this policy, we post the new version here with a new effective date. If the change is significant, we also e-mail buyers with an active order.

14. Changes to this policy

We update this policy when our service changes. The version and date are at the top. Earlier versions are available on request.

To save a copy, print this page or save it as PDF from your browser.