Privacy Policy
1. Who we are
PRD Wizard is operated by Novalytix UG (haftungsbeschränkt), Richardstraße 88, 22089 Hamburg, Germany ("we", "us", "our"). We are the data controller for personal data processed through this service.
Contact: info@novalytix.eu. Further company details are in the imprint.
2. What data we collect
- Account data: email address and hashed password when you register.
- PRD content: app names, descriptions, feature lists, and other product information you enter into the wizard. This content is sent to Anthropic's Claude API to generate your PRD. If you give a reference website URL, our server loads that page and sends a screenshot of it to Anthropic together with your brief.
- Payment data: credit pack purchases are processed by Mollie. We store only a reference to the Mollie payment ID and the number of credits purchased — no card details ever reach our servers.
- Technical data: server logs containing IP addresses and user-agent strings, retained for up to 30 days for security purposes.
3. Why we process your data
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the PRD Wizard service | Contract performance (Art. 6(1)(b)) |
| Processing payments and granting credits | Contract performance (Art. 6(1)(b)) |
| Sending transactional emails (password reset, PRD ready) | Contract performance (Art. 6(1)(b)) |
| Security logging and fraud prevention | Legitimate interest (Art. 6(1)(f)) |
4. Sub-processors
We share data with the following third-party processors:
| Processor | Purpose | Location |
|---|---|---|
| Anthropic | AI generation of PRD content | United States (SCCs apply) |
| Mollie | Payment processing | Netherlands (EU) |
| Hetzner | Cloud hosting | Germany (EU) |
| Brevo (Sendinblue SA) | Transactional email delivery | France (EU) |
For transfers to the United States, we rely on Standard Contractual Clauses (SCCs) as the transfer mechanism under GDPR Chapter V.
5. Cookies
- Session cookie (essential): keeps you signed in. Cannot be declined.
This is the only cookie we set. We run no analytics, advertising, or tracking cookies, and we therefore do not show a cookie consent banner.
6. Data retention
- Account data: retained until you ask us to erase it.
- PRD content: retained until you delete the PRD or your account.
- Payment records: kept for ten years from the end of the year in which the purchase was made, as § 147 AO and § 257 HGB require. Art. 17(3)(b) GDPR means an erasure request cannot remove them, so erasing your account anonymises it instead: your email and password are replaced, the account can no longer be signed into, and the purchase rows stay without identifying you.
- Server logs: retained for 30 days.
7. Your rights under GDPR
You have the right to:
- Access the personal data we hold about you
- Rectification of inaccurate data
- Erasure ("right to be forgotten")
- Restriction of processing
- Data portability
- Object to processing based on legitimate interest
- Lodge a complaint with a supervisory authority
Access, portability and erasure are self-service on your account page. For anything else, email info@novalytix.eu. We respond within one month, as Art. 12(3) GDPR requires.
8. Changes to this policy
We may update this policy from time to time. We will notify registered users of material changes by email. Continued use of PRD Wizard after changes constitutes acceptance of the updated policy.
