Privacy Policy
1. Who we are
PRD Wizard is operated by Novalytix UG ("we", "us", "our"). We are the data controller for personal data processed through this service.
Contact: niels@novalytix.eu
2. What data we collect
- Account data: email address and hashed password when you register.
- PRD content: app names, descriptions, feature lists, and other product information you enter into the wizard. This content is sent to Anthropic's Claude API to generate your PRD.
- Payment data: credit pack purchases are processed by Mollie. We store only a reference to the Mollie payment ID and the number of credits purchased — no card details ever reach our servers.
- Usage data: if you consent, we collect anonymised analytics via Google Analytics (pages visited, session duration, referral source).
- Technical data: server logs containing IP addresses and user-agent strings, retained for up to 30 days for security purposes.
3. Why we process your data
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the PRD Wizard service | Contract performance (Art. 6(1)(b)) |
| Processing payments and granting credits | Contract performance (Art. 6(1)(b)) |
| Sending transactional emails (password reset, PRD ready) | Contract performance (Art. 6(1)(b)) |
| Security logging and fraud prevention | Legitimate interest (Art. 6(1)(f)) |
| Analytics to improve the product | Consent (Art. 6(1)(a)) |
4. Sub-processors
We share data with the following third-party processors:
| Processor | Purpose | Location |
|---|---|---|
| Anthropic | AI generation of PRD content | United States (SCCs apply) |
| Mollie | Payment processing | Netherlands (EU) |
| Hetzner | Cloud hosting | Germany (EU) |
| Resend | Transactional email delivery | United States (SCCs apply) |
| Google Analytics | Usage analytics (consent required) | United States (SCCs apply) |
For transfers to the United States, we rely on Standard Contractual Clauses (SCCs) as the transfer mechanism under GDPR Chapter V.
5. Cookies
- Session cookie (essential): keeps you signed in. Cannot be declined.
- Google Analytics cookies (_ga, _gid): used for usage analytics. Only set after you give consent via the cookie banner.
You can withdraw analytics consent at any time by clearing your browser cookies and declining when the banner reappears.
6. Data retention
- Account data: retained until you request deletion.
- PRD content: retained until you delete the PRD or your account.
- Payment records: retained for 7 years to comply with tax and accounting obligations.
- Server logs: retained for 30 days.
7. Your rights under GDPR
You have the right to:
- Access the personal data we hold about you
- Rectification of inaccurate data
- Erasure ("right to be forgotten")
- Restriction of processing
- Data portability
- Object to processing based on legitimate interest
- Withdraw consent for analytics at any time
- Lodge a complaint with a supervisory authority
To exercise any of these rights, email niels@novalytix.eu. We will respond within 30 days.
8. Changes to this policy
We may update this policy from time to time. We will notify registered users of material changes by email. Continued use of PRD Wizard after changes constitutes acceptance of the updated policy.