Privacy Policy

This policy explains what personal data Vibe-Coding Journal collects, why, who else handles it, how long we keep it, and what rights you have. It follows the EU General Data Protection Regulation (GDPR).

1. Who is responsible

The controller is Prompt Hero Studio, e-mail ai-hero-studio@outlook.com, website https://mulalic.ai-studio.wiki/. For anything about your data, write to ai-hero-studio@outlook.com.

2. What we collect and why

What	Why	Legal basis (GDPR Art. 6)
Account: e-mail address, password (kept only as a one-way hash by our sign-in provider, we never see it), the AI tools you tick and the depth you choose at sign-up, optional text about other tools	To create and run your account and personalise the Service	Contract (1)(b)
Plan: trial dates, plan, status, end date, whether the account is blocked	To give you the access you paid for	Contract (1)(b)
Payments: PayPal transaction and event numbers, amount, date, and the payer details PayPal sends us (such as the payer name and e-mail). We never receive your card or PayPal password.	To confirm and record your payment, handle refunds, and keep the accounts	Contract (1)(b), legal obligation (1)(c)
Learning and use: bookmarks, reports you open, coins, levels, streaks, badges, University and Prompt School progress, exercise and test results	To run the Service and show your progress	Contract (1)(b)
Assistant: what you enter in the wizard and the prompt that is generated, kept in your history until you delete it	To give you the result and your history	Contract (1)(b)
Sandbox: the fact that a run happened (time, task, length). The text you write is sent to the AI to get the answer and is not stored by us.	To enforce the daily limit	Legitimate interest (1)(f)
Technical: the address and browser details your device sends with each request, kept in the hosting provider's logs for a short time	Security, fault finding, abuse prevention	Legitimate interest (1)(f)
E-mail we send you: reminders before your plan ends and messages about your account	To keep you informed about your plan	Contract (1)(b)

We do not sell your data, we do not show advertising, and we do not use tracking or analytics tools. We do not make decisions about you by automated means that have legal or similarly significant effects.

3. Who else handles your data (processors)

We use these providers, each under a data processing agreement or standard terms:

• Supabase, database and sign-in. Our project runs in the EU (Ireland).
• Vercel, hosting of the website and its server functions (servers may be in the United States).
• PayPal, payments. PayPal is an independent controller for the payment itself and has its own privacy statement.
• Resend, sending e-mail.
• Google (Gemini API), the AI that answers the Assistant and the sandbox. The text you enter there is sent to Google. On the free tier we use, Google may use such content to improve its services, and people at Google may read it. This is why you must not enter personal data or secrets into the Assistant or the sandbox.

Where a provider is outside the European Economic Area, the transfer is covered by the European Commission's standard contractual clauses or an adequacy decision. We give data to authorities only when the law requires it.

4. How long we keep it

• Account, progress and history: as long as your account exists. When you ask us to delete your account we do it within 30 days, usually sooner.
• Assistant history: until you delete an item (the Delete button in History). The text is removed at once. Only an empty record with the date stays, so that the daily limit is counted correctly.
• Payment records: for as long as accounting and tax law require, even after the account is deleted. They are not used for anything else.
• Hosting logs: a short period set by the provider.
• Backups: overwritten on a rolling schedule; deleted data disappears from them in that way.

5. Your rights

You have the right to: access your data and get a copy; have wrong data corrected; have your data erased; restrict or object to its use; receive it in a usable format (portability); withdraw consent where we rely on it; and complain to a data protection authority, in particular where you live or work. To use any of these rights, write from your account address to ai-hero-studio@outlook.com. We answer within 30 days. We may ask you to confirm who you are.

6. Children

The Service is not for people under 16. If you think a child has given us data, write to us and we will delete it.

7. Security

Data travels over encrypted connections. Passwords are stored only as hashes. The database is closed by default, and every request is checked for who you are and what your plan allows before data is returned. No system is perfectly safe; if a breach affects your rights, we tell you and the authority as the law requires.

8. Cookies and similar storage

We keep only what the Service needs to work. See the Cookie notice.

9. Changes

We will update this policy when the Service changes and show the date above. If a change matters for you, we tell you before it applies.