This is a courtesy translation. The Polish version prevails.

Effective from: 28.10.2026 · Version: 1.11

§ 1. General provisions

These Terms set out the rules on which Canpol Bis Spółka z ograniczoną odpowiedzialnością (a Polish limited liability company), with its registered office at ul. Gimnazjalna 2/M501, 85-007 Bydgoszcz, Poland, KRS 0000424054, NIP 5542918412, REGON 341289717 (hereinafter: the “Service Provider”), provides electronic services under the “Kreatywna Agencja” brand: Chatbot AI and Social Media AI (hereinafter together: the “Services”).
Contact with the Service Provider: e-mail biuro@kreatywnaagencja.com.pl, telephone +48 502 811 949, postal address as above.
The terms used mean:
- Customer — a natural person, legal person or organisational unit without legal personality that has entered into an agreement with the Service Provider for the provision of a Service;
- Consumer — a Customer who is a natural person performing a legal act not directly related to their business or professional activity;
- Business Customer — a Customer who is not a Consumer;
- Licence — the Customer’s right to use the selected Service under the selected plan, confirmed by a licence key;
- Plan — a variant of the Service (Basic, Silver, Gold, Agencja) defining the limits, features and price, described on the page of the relevant Service;
- Panel — the Service management panel made available by the Service Provider;
- Connector — the “Kreatywna Hub — łącznik” WordPress plugin or the widget code by means of which the Service is connected to the Customer’s website.
The Terms are made available free of charge on the kreatywnaagencja.com.pl website in a manner that enables them to be obtained, reproduced and stored.

§ 2. Scope of the Services and technical requirements

Chatbot AI is a chat assistant that answers visitors to the Customer’s website on the basis of knowledge supplied by the Customer: the content of web pages, uploaded files, typed-in texts and a product catalogue. Answers are generated by an artificial intelligence model. The Service includes the Panel, the chat widget and — in selected Plans — product cards in the chat and file uploads.
Social Media AI is a service for preparing content (texts, graphics, short videos) and scheduling its publication on connected accounts on Facebook and Instagram. Publication takes place after the content has been approved by the Customer and on the Customer’s instruction.
To use the Services you need: a device with internet access, an up-to-date web browser and an active e-mail address; for Chatbot AI — the ability to place the widget on the Customer’s website (e.g. WordPress with the Connector, or by pasting a script); for Social Media AI — accounts on Meta services for which the Customer has administrator rights.
The scope, limits (including the number of messages, pages, files, products, domains, chatbots, posts, graphics, videos and connected accounts) and features of individual Plans are stated on the page of the relevant Service and in the Panel. The Service Provider may introduce new features and Plans.
The Services are provided on a due-care basis. The Service Provider does not guarantee uninterrupted availability; technical interruptions may occur (planned ones — announced where possible), as well as interruptions in the operation of external providers beyond the Service Provider’s control (including hosting, AI model providers and Meta platforms).
The Services are not intended for high-risk uses, in particular for taking, without human oversight, decisions that significantly affect health, rights, employment, access to credit or public services. Using the Services for such purposes requires the Service Provider’s prior written consent.
The Services are digital services provided continuously: the Customer obtains access to the functionality of the Service (the Panel, the widget, content generation) for the paid billing periods. The agreement does not include the sale of software or the transfer of ownership of it; the Connector and the widget serve solely to connect the Service.

§ 3. Entering into the agreement and the Licence

The agreement for the provision of a Service is concluded when the order is placed with the “Order with obligation to pay” button (after the required declarations have been ticked). The Service and the Licence are activated once the first payment for the selected Plan has been booked; until then no licence key is issued. Before ordering, the Customer is informed of the gross price, the monthly billing period, the automatic renewal of the subscription and how to cancel it. After payment, the Service Provider confirms the conclusion of the agreement on a durable medium (e-mail) by sending to the address provided the licence key, a link to download the Connector and information on the Terms in the version in force (and, to a Consumer, also information on the right of withdrawal).
The licence key is confidential. The Customer undertakes not to disclose it to third parties and to report its loss or disclosure without delay. The Service Provider may replace the key with a new one.
The Licence covers the domains specified in the Plan (the number of domains is limited by the Plan’s limit). Using the Licence on more domains than the Plan allows is prohibited.
The Customer is obliged to provide true data. As regards invoicing data, the Customer is responsible for its accuracy.
In the order form, the Customer indicates whether they are buying as a business (declaring that they are ordering in connection with their business or professional activity) or as a Consumer. A Consumer expressly requests that the provision of the Service begin before the end of the withdrawal period (§ 8) and confirms that they have been informed of the obligation to pay for performance rendered up to the moment of withdrawal. The Service Provider keeps a minimal record of the consents and declarations as proof that they were given: the date and time, the version of the Terms, the type of buyer, the content of the declarations and the transaction identifier, and additionally, for 12 months, the IP address and browser data. Data retention periods are described in the table in the Privacy Policy.

§ 4. Price, payments and settlements

The Services are paid for in monthly billing periods (subscription). Plan prices are given in Polish zloty (PLN) as gross prices, including 23% VAT.
Payments are handled by the operator Stripe. The subscription renews automatically for the next billing period, and the fee is charged to the card or other instrument indicated by the Customer until it is cancelled.
After payment is made, the Service Provider issues a sales document in accordance with the applicable tax rules, in particular an invoice or — where the rules so require and it is appropriate for the given transaction — a fiscal receipt or an electronic fiscal receipt (e-receipt). An invoice is issued to the business details (including NIP) provided by the Customer during payment. The document is made available in a form permitted by the rules, in particular in electronic form to the Customer’s e-mail address, to which the Customer consents. If a payment is refunded (e.g. after withdrawal from the agreement), the Service Provider issues a corrective document.
The Customer may change the Plan in the Panel at any time. The change takes effect immediately, and the price difference for the current period is settled proportionally in the next payment. The price applicable when the agreement is concluded does not change during the term of a given subscription; changes to the price list apply to new orders and Plan changes. An increase in the price of a subscription already running requires the Customer’s consent, given after receiving information on the new price sent by e-mail at least 30 days in advance; if consent is not given, the subscription continues at the existing price or — at the Customer’s choice — may be cancelled.
The Customer may cancel the subscription at any time in the customer Panel (My account → AI services), in the payment portal or by writing to the Service Provider. Cancellation takes effect at the end of the paid billing period; until then the Service remains active, and the Customer may revoke the cancellation before the end of the period. Fees for a billing period already begun are non-refundable, subject to § 8 and the Consumer’s rights arising from the law (including in respect of non-conformity of the Service with the agreement).
Some features use external AI services, and use above the Plan’s limits or above set cost limits may result in the temporary suspension of the given feature until the start of the next billing period or until the Plan is changed.
In Plans that allow it, the Customer may connect their own AI provider keys. The Customer is then responsible for the costs incurred with the provider and for compliance with the provider’s terms, and the Service Provider is not liable for unavailability or changes on the provider’s side.

§ 5. Non-payment and suspension of the Service

If collecting the fee for the next period fails, the Service Provider informs the Customer of this, and the Service continues to operate for a grace period of 3 days, during which the Customer may settle the payment (e.g. by updating the card in the payment portal).
After this period has passed without payment, the Service Provider suspends the Service: the widget stops responding, and the Panel functions used to manage the Service (chatbots, knowledge sources, accounts, publications) are blocked. The view of the licence status and the payment portal, in which the arrears can be paid, remain available. Once payment has been made, the Service is resumed without reconfiguration.
We keep the Customer’s data (settings, knowledge base, chatbots, connected accounts) during the suspension for 30 days; after that time, if the arrears have not been paid, the agreement expires and the data is deleted automatically in accordance with § 11 and Annex 1.

§ 6. Rules of use, content and the Customer’s responsibility

The Customer represents and warrants that they hold the rights to the websites, files, texts, product data and social media accounts that they connect to the Service, and that their use in the Service (including indexing the content and passing it to AI providers) does not infringe the rights of third parties or the law.
It is prohibited to use the Services for: unlawful or misleading content, content infringing personal rights or copyright, spam, distributing content prohibited by the terms of Meta services, circumventing the Service’s limits or safeguards, indexing websites to which the Customer has no right, and transmitting special categories of data or sensitive data unless this is necessary and lawful.
AI-generated answers and content may contain errors or inaccuracies or be out of date. The Customer is obliged to review content before publishing it (in Social Media AI — before approving posts) and to inform visitors to their website appropriately that they are talking to an assistant based on artificial intelligence. Chatbot AI answers do not constitute legal, medical, financial or other professional advice.
The Customer, as the entity making Chatbot AI available to visitors to their website, is responsible for fulfilling the obligation to inform people that they are communicating with an artificial intelligence system (Art. 50 of Regulation (EU) 2024/1689, the Artificial Intelligence Act). The widget contains a permanent notice of this kind; the Customer may not hide or remove it.
The Customer is responsible for the content published on their social media accounts and for complying with Meta’s terms. The Service Provider does not guarantee reach, campaign results or continued access to Meta’s interfaces (APIs), which may be changed or restricted by Meta. The Customer may revoke the app’s permissions at any time in their Meta account settings.
The Customer, as the controller of the data of visitors to their website, is responsible for the legal basis for the processing, for information obligations towards visitors and for compliance with personal data protection law (see § 9 and Annex 1).
The Service Provider may suspend the Service (in whole or in part) without notice if the Customer grossly breaches the Terms or the law or if the use of the Service endangers the security of the system or of third parties, informing the Customer of the reason.

§ 7. Complaints

Complaints concerning the Services may be submitted by e-mail to biuro@kreatywnaagencja.com.pl or in writing to the Service Provider’s address, stating the Customer’s details, a description of the problem and the desired way of resolving it.
The Service Provider considers a complaint within 14 days of receiving it and informs the Customer of the outcome at the e-mail address given in the complaint or the order.
A Consumer to whom the Service Provider supplies digital content or digital services has rights in respect of non-conformity of the digital content or digital service with the agreement on the terms set out in the Polish Consumer Rights Act (ustawa o prawach konsumenta); the provisions of the Terms do not exclude or limit them.

§ 8. Withdrawal from the agreement by a Consumer

A Consumer who has concluded a distance contract may withdraw from it within 14 days of its conclusion without giving a reason, by submitting a statement by e-mail to biuro@kreatywnaagencja.com.pl or in writing. It is sufficient to send the statement before the deadline expires. The Consumer may use a statement in any wording or the template set out in Annex 2.
If the Consumer has requested that the provision of the Service begin before the end of the withdrawal period (which occurs by ticking the relevant declaration in the order and activating the Licence), then in the event of withdrawal the Consumer is obliged to pay for the performance rendered up to the moment of withdrawal — the amount is determined in proportion to the scope of the performance rendered, taking into account the agreed price and, in cases provided for by law (e.g. where the price is excessive), the market value of the performance. If the Consumer has not made such a request or has not been informed of the obligation to pay, the Consumer does not bear the costs of performance rendered up to the moment of withdrawal. The Service Provider refunds the remaining part of the fee without delay, no later than within 14 days of receiving the statement of withdrawal, using the same payment method as the Consumer used, without charging the Consumer any additional refund costs. The Service Provider confirms receipt of the statement by e-mail.
For a Service provided continuously for which a fixed fee per billing period has been set, the amount due to the Service Provider is determined, as a rule, proportionally to the time during which the Service was provided: the fee for the first billing period is divided by the number of days of that period and multiplied by the number of days from the activation of the Licence (after the first payment has been booked) to the day the statement of withdrawal is received, a started day counting as a full day (at least one day). The settlement concerns only the fee for the Service; the Service Provider charges no administrative fees or costs connected with the withdrawal. The mere consumption of message limits, tokens or other technical resources is not a ground for increasing the amount due from the Consumer. Withdrawal differs from cancelling the subscription (§ 4(5)), which merely ends further renewals at the end of the paid period. The Consumer may submit the statement of withdrawal by e-mail or with the “Withdraw from the contract (14 days)” button in the customer Panel (My account → AI services), available throughout the 14-day period; the Service is then switched off immediately, the subscription ended and the refund ordered automatically. If the statement is submitted in another way, the Service is switched off and the refund is made once the Service Provider has accepted the statement.
The Service Provider may refuse to enter into another agreement or stop providing the Service where specific, objective circumstances indicate abuse (e.g. repeatedly concluding agreements solely in order to use the Service for part of the fee or to circumvent limits). In such a case the Service Provider informs the Consumer of the need to make contact, considers the Consumer’s explanations and may lift the restriction; the Consumer may contest the decision by writing to biuro@kreatywnaagencja.com.pl. Business Customers are not entitled to withdraw on consumer terms. The agreement may be terminated in accordance with § 11.

§ 9. Personal data

The controller of the personal data of Customers (contact, billing and invoicing data) is the Service Provider; the rules of its processing are described in the Privacy Policy.
As regards the personal data of visitors to the Customer’s websites and of persons whose data is contained in materials supplied to the Service (e.g. the content of conversations with the chatbot, files, social media accounts), the Customer is the controller and the Service Provider is the processor. In this respect the parties conclude a data processing agreement with the content set out in Annex 1, which takes effect upon the conclusion of the agreement for the provision of the Service.
Content supplied to the Services is processed by AI model providers (see Annex 1). The Customer should not supply to the Services data whose processing in this way would be unlawful or inconsistent with the information given to the data subjects.

§ 10. Intellectual property

The rights to the Services, the Panel, the host software and the “Kreatywna Agencja” marks belong to the Service Provider or its licensors. The Customer receives a non-exclusive, non-transferable right to use the Service for the term of the agreement and within the scope of the Plan. The Connector (WordPress plugin) is made available under the GPL-2.0 licence or later; this licence does not cover services and software running on the Service Provider’s side.
The Customer retains the rights to the content that they supplied to the Service. The Customer grants the Service Provider a non-exclusive, royalty-free licence to process it solely for the purpose of providing the Service.
Content generated for the Customer within the Services (e.g. posts, graphics) may be used by the Customer for their own purposes, at their own risk, bearing in mind that the legal protection of AI-generated content may be limited and that similar content may be generated for other users.
The Service Provider does not use the Customer’s content to train its own models. It uses the AI providers’ APIs in a mode in which — in accordance with their terms — data sent via the API is not used by default to train those providers’ models.

§ 11. Term, termination and consequences of the end of the agreement

The agreement is concluded for an indefinite period, with monthly billing periods.
The Customer may terminate the agreement at any time by cancelling the subscription (§ 4(5)). The Service Provider may terminate the agreement with 30 days’ notice, or without notice for important reasons, in particular in the event of a gross breach of the Terms; if the Service Provider terminates through no fault of the Customer, we refund the fee for the unused period.
After the agreement ends, the Service stops working and the Customer’s data (knowledge base, chatbots, conversations, settings, connected accounts, keys of the Customer’s own AI providers) is deleted automatically within 30 days of the end of access to the Service. The Service Provider retains the data that it must or may retain under the law or to defend claims, for the periods stated in the table in the Privacy Policy (including accounting documents, the licence record and usage counters, the minimal record of consents and the withdrawal entry). The Customer may delete their data earlier on their own in the Panel.

§ 12. Liability

The Service Provider is liable for non-performance or improper performance of the agreement on general terms, subject to paragraphs 2–4.
In relation to Business Customers, the Service Provider’s liability is limited to actual damage and to the amount of the fees paid by the Customer for the Service during the 3 months preceding the event; the Service Provider is not liable for lost profits. The limitation does not apply to damage caused intentionally.
The Service Provider is not liable for the content of answers generated by AI to the extent that the Customer has not fulfilled the obligations under § 6, nor for the actions and decisions of external platforms (including suspension of an account on a Meta service, changes to APIs).
The provisions of paragraphs 2–3 do not limit the Consumer’s rights arising from mandatory provisions of law.

§ 13. Final provisions

Polish law applies to agreements concluded under the Terms. Disputes with Business Customers are resolved by the court competent for the Service Provider’s registered office. Disputes with Consumers are resolved by the courts competent under the general rules; a Consumer may use out-of-court complaint-handling and redress methods (including mediation, the permanent consumer arbitration court, and the assistance of a county (municipal) consumer ombudsman or the Office of Competition and Consumer Protection (UOKiK)).
The Service Provider may amend the Terms for important reasons (including changes in the law, in the scope or manner of providing the Services, and technical and security considerations), informing Customers by e-mail at least 14 days in advance. A Customer who does not accept the changes may terminate the agreement before they take effect. The changes do not affect agreements concluded and performed before they take effect.
If any provision of the Terms proves invalid or ineffective, the remaining provisions remain in force.
The Polish version of the Terms is the binding version.

§ 14. Full Website Audit (one-off service)

In addition to the Services referred to in § 1, the Service Provider provides a one-off digital service, the “Full Website Audit” (the “Audit”): an automated analysis of the website indicated by the Customer (SEO, security, GDPR and cookies, loading speed, accessibility, AI readiness, brand visibility in AI assistants and — if detected — an online store), together with a report and an action plan made available on the website and sent by e-mail.
The Audit is paid for once, at the gross price stated in the order form, through the operator Stripe. The provisions of § 4(1)–(2) and § 5 (concerning subscriptions) do not apply to the Audit; the sales document is issued in accordance with § 4(3).
The agreement for the performance of the Audit is concluded when the order with an obligation to pay is placed. Performance begins immediately after the payment is booked, and the report is usually ready within a few minutes. If the Audit cannot be performed for reasons attributable to the Service Provider, the Service Provider will repeat it or refund the price paid.
The Audit is informational and automated. It is not legal advice, certification or a penetration test, and it does not guarantee better rankings, sales results or the website’s compliance with the law. The descriptions and the action plan in the report are prepared partly by artificial intelligence (§ 6(3) applies). The Service Provider analyses publicly available website content; the Customer declares that they are entitled to commission an analysis of the indicated website.
No right of return: because of the digital nature of the product and immediate access to the report, the purchase is non-refundable. Under Article 38(13) of the Polish Consumer Rights Act, the right of withdrawal does not apply to the purchase of digital content once its download/delivery has begun with the consumer’s consent. Before placing the order, the Consumer expressly requests that performance of the Audit begin before the withdrawal period expires and acknowledges that, once the service has been fully performed, they will lose the right of withdrawal (a statement ticked in the order form). The provisions of § 8 do not apply to the Audit.
The exclusion of the right of withdrawal does not limit the Consumer’s rights in respect of non-conformity of the digital content or service with the agreement (§ 7(3)) or the right to complain.

§ 15. SEO Autopilot (subscription service for businesses)

Besides the Services in § 1, the Service Provider provides the “SEO Autopilot” service, available only to businesses (not to Consumers). It consists of recurring analysis of the Customer’s website based on WordPress (or, in the script variant, another platform), proposing and applying SEO fixes (title, meta description, internal links in existing content, image alt texts, surplus H1 headings, 301 redirects for URLs that no longer exist, structured data), preparing question-and-answer sections and an llms.txt file that help AI-powered search, notifying search engines of changes (IndexNow, Bing Webmaster Tools), in WooCommerce shops also preparing product category descriptions and blocking filter and sorting pages from indexing, and, in the plan that includes articles, preparing and publishing new posts.
The condition for providing the service is installing and activating the KA Agent plugin on the Customer’s website (in the script variant: placing the script) and enabling the connection of the website to Google Search Console, with read-only access to data: the agent places an ownership verification tag on the website, and in the script variant the Customer adds the property following the instructions in My Account. The Customer declares that they are entitled to make such changes on the website. We recommend making backups of the website.
The agent executes only signed instructions of the Service Provider from a closed list of actions. Changes to content and settings are recorded in a log in the Customer’s WordPress (last 120 entries) and can be reverted by the Customer, who can also switch the agent off at any time (the “off” mode also stops all of the agent’s actions on the website) or set it to read-only mode. Changes older than the last 120 log entries, and the agent’s ownership verification, measurement and self-update actions, cannot be reverted from the log.
Articles are prepared by artificial intelligence and are subject to quality control (a second review of the text, including flagging uncertain claims). Before publication the Customer receives an e-mail with a preview link and has at least 48 hours to object (veto); no objection means consent to publication. The first articles and articles on sensitive topics (including health, law, finance) are additionally reviewed manually. After the objection period the Customer is responsible for the content published on their website.
The Service Provider does not guarantee improved search rankings, traffic or sales; these depend, among other things, on Google’s decisions and on competitors. The service is provided with due care, not with a guaranteed result.
The gross price is stated in the order form. The subscription is billed monthly and its price decreases with the duration of the subscription: by 10% from the 7th month, by 20% from the 13th and by 30% from the 25th relative to the plan price; the change applies from the next invoice. The subscription may be terminated at any time with effect at the end of the paid period; the provisions of § 4, § 5 and § 11 apply accordingly.
After the agreement ends, or 7 days after the licence expires, the Service Provider stops executing instructions on the Customer’s website and disconnects it: it removes the Google Analytics measurement, verification tag, structured data, speed settings, llms.txt file, IndexNow file and redirects added by the agent, deletes the Google Analytics 4 property it created, disconnects the Search Console property and deactivates the agent. The website’s data in the Service Provider’s system is deleted 30 days after disconnection. Other content changes made (title and meta description, internal links, image alt texts, question-and-answer sections, category descriptions, published articles) remain on the Customer’s website, and the Customer removes the agent plugin on their own.
As regards SEO Autopilot, the Processor processes the website address, publicly available website content, Google Search Console data and the questions put to AI assistants when measuring visibility; website content (including titles, headings and text excerpts) may be passed to AI providers to prepare proposals. Annex 1 applies accordingly; the list of sub-processors additionally includes Anthropic (content quality control and measurement of visibility in AI answers, USA), Perplexity (measurement of visibility in AI answers, USA) and Microsoft (submitting URLs to Bing and IndexNow and reading Bing Webmaster statistics, USA), while Google (Search Console, Analytics, PageSpeed Insights) acts as a separate controller of its own Search Console service.
As part of SEO Autopilot, the Service Provider creates a Google Analytics 4 property for the Customer’s website in the Service Provider’s account, and the agent inserts a measurement code on the website that works in Google Consent Mode (without consent to analytics the code does not store cookies). The Customer is responsible for having a cookie consent mechanism compatible with Consent Mode on the website, for reflecting the measurement in its privacy policy and for fulfilling the information obligation towards visitors. Measurement data is used solely to provide the service (reports and prioritising fixes). The Customer may switch the measurement off at any time in Tools → KA Agent or request deletion of the GA4 property. In this respect the Service Provider acts as a processor and Google as its sub-processor; Annex 1 applies accordingly.
Once enabled by the Service Provider on the Customer’s website, the agent may add schema.org structured data (JSON-LD) in the page header where it is missing, and enable switches that speed up page loading (e.g. turning off unused scripts, improving the loading of fonts and the main image). The changes do not include editing theme files or page content, apply only to logged-out visitors, are recorded in a log and the Customer may revert them in Tools → KA Agent. The Service Provider measures the page speed (Google PageSpeed Insights) before and after a change and reverts the change if the result worsens or the page stops working correctly. The Service Provider does not guarantee a specific PageSpeed score or search ranking, because they also depend on hosting, the theme and third-party services.
SEO Autopilot is available in two variants: (a) for WordPress websites, including WooCommerce shops (pages, posts and products), through the KA Agent plugin in the full scope described in this section; (b) for websites on other platforms, through the SEO Autopilot script placed in the website’s code, limited to the title, meta description, structured data and Google Analytics measurement applied in the visitor’s browser. In variant (b) the condition of the service is placing the script on the website (instead of installing the plugin, accordingly to clause 2), the Customer may remove it at any time, and the Service Provider does not guarantee that search engines will read the content applied by the script. Product categories, archives and content built with page builders are not covered by automatic fixes.
AI-assisted content and changes (question-and-answer sections, product category descriptions, new titles and descriptions) are applied by the Service Provider to the Customer’s website as follows: question-and-answer sections and category descriptions only after the Customer’s approval in My Account, and other fixes (title and meta description, internal links, alt texts, H1 headings, 301 redirects) in an automatic mode set by the Service Provider, which the Customer may pause or switch off at any time; the agent’s changes can be reverted. The click-through test compares Google Search Console data from before and after a change (a window of several weeks) and, if the result is clearly worse, restores the previous version; results are estimates. Measuring visibility in AI assistant answers is a snapshot of a sample of questions and does not guarantee mentions or citations. The Service Provider does not hide from visitors any content intended for search engine robots.
In variant (b) the script is loaded from the Service Provider’s server by the visitor’s browser, so standard request data (including the IP address and the page address) reaches the Service Provider; the Customer takes this into account in the privacy information of their website. The script applies only basic structured data of the home page and the title and meta description for addresses with an approved proposal.

Annex 1. Personal data processing agreement

Concluded under Art. 28 GDPR between the Customer as the controller (hereinafter: the “Controller”) and the Service Provider as the processor (hereinafter: the “Processor”) in connection with the provision of the Services.

Subject matter, nature and purpose. The Processor processes personal data on behalf of the Controller solely for the purpose of providing the Services: in Chatbot AI — receiving and handling messages from visitors to the Controller’s website, indexing the knowledge supplied by the Controller and generating answers; in Social Media AI — preparing and publishing content on the Controller’s social media accounts. In SEO Autopilot: analysing and improving the content of the Controller’s website, preparing AI-assisted proposals and measuring the visibility of the website in search engines and in AI assistant answers.
Categories of persons and data. Persons: visitors to the Controller’s website using the chat, persons whose data is contained in materials supplied to the knowledge base or in the content of posts, Panel users indicated by the Controller. Data: the content of chat messages (which the visitor types in themselves, including any personal data), session identifier, dates and times, temporarily the IP address in the form of a hash to limit abuse, data contained in the materials supplied, identifiers and access tokens for social media accounts (stored in encrypted form), publication metrics. Special categories of data are not intentionally processed. In SEO Autopilot: publicly available content of the Controller’s website (including any personal data in content, comments or reviews), URLs and page metadata, aggregated data from Google Search Console and Google Analytics, and the questions put to AI assistants when measuring visibility.
Controller’s instructions. The Processor processes data on the Controller’s documented instructions, which are the Terms and the configuration of the Service in the Panel. If the Processor considers that an instruction infringes the law, it will inform the Controller without delay.
Confidentiality and security. The Processor ensures that persons authorised to process the data are bound by confidentiality, and applies technical and organisational measures appropriate to the risk, including: encryption of transmission (HTTPS/TLS), encryption of API keys and tokens in the database, isolation of individual Customers’ data (every query to the knowledge base is restricted to the Customer’s licence and chatbot), access control for the Panel and the administration panel, request rate limiting, backups and regular software updates.
Sub-processing (subcontractors). The Controller gives general authorisation to use the following categories of sub-processors: providers of artificial intelligence models — OpenAI (generating answers and search vectors, USA) and fal.ai (generating graphics and video in Social Media AI, USA); the provider of the knowledge base infrastructure (a Qdrant vector search server maintained by the Processor, connected via the Cloudflare service); the provider of hosting and backups for the kreatywnaagencja.com.pl website. Meta platforms (Facebook, Instagram) act as separate controllers as regards data published on the Customer’s accounts. The Processor ensures that sub-processors are bound by agreements providing at least the same level of protection, and informs the Controller of any intended change of sub-processors 14 days in advance; the Controller may object and, where the objection cannot be accommodated, terminate the agreement. For SEO Autopilot additionally: AI model providers Anthropic and Perplexity (USA), Microsoft (Bing, IndexNow, USA) and Google (Search Console, Analytics, PageSpeed Insights, USA); Google also acts as a separate controller of its own services.
Transfers outside the EEA. Data may be transferred to the USA to the providers indicated in paragraph 5 on the basis of a European Commission adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses.
Assistance to the Controller. To the agreed extent, the Processor assists the Controller in fulfilling data subjects’ rights (including providing or deleting conversations), in performing the obligations under Art. 32–36 GDPR and in the event of an inspection. The Controller may delete knowledge sources and chatbots on its own in the Panel.
Breaches. The Processor reports a personal data breach it has established to the Controller without undue delay, no later than within 48 hours of establishing it, providing the information necessary to assess the breach.
Retention period. Chat conversation history is deleted automatically after 90 days. Knowledge sources and settings are kept until they are deleted by the Controller or the agreement ends. After the agreement ends, the Processor deletes the entrusted data within up to 30 days, unless the law requires it to be retained further.
Audit. The Processor makes available to the Controller the information necessary to demonstrate compliance with the obligations under Art. 28 GDPR and allows audits at an agreed time and to an agreed extent, in a manner that does not disrupt the Processor’s operations.
Controller’s obligations. The Controller is responsible for the legal basis for the processing, for informing visitors to its website about the processing of data in the chat (including that they are talking to an AI assistant and that the content of messages is passed to AI service providers), and for reflecting this in the privacy policy of its website.
Term. The agreement remains in force for the period during which the Services are provided.

Annex 2. Template statement of withdrawal from the agreement (for Consumers)

(this form should be completed and returned only if you wish to withdraw from the agreement; send it to biuro@kreatywnaagencja.com.pl or by post to: Canpol Bis Sp. z o.o., ul. Gimnazjalna 2/M501, 85-007 Bydgoszcz, Poland)

I, the undersigned, hereby inform you of my withdrawal from the agreement for the provision of the service: [name of the service and Plan], concluded on [date], to the e-mail address [e-mail address provided in the order].

Consumer’s name and surname: […]
Consumer’s address: […]
Date and signature (only if the form is sent in paper form): […]

AI services Terms.