Privacy Notice · FizzUp Ideas

Version 3.1 · Effective 15 October 2026

1. Controller and contact

The data controller for the FizzUp Ideas web Programme is DB 77 CUW Sp. z o.o., ul. Żółkiewskiego 31, 87-100 Toruń, Poland, KRS 0000755526, NIP 8792706635. Rights requests: privacy@fizzup.ai; general questions: support@fizzup.ai. This notice concerns https://fizzup.ai/ideas. The separate App privacy notice also applies when you use the App. We have not designated a data protection officer; privacy requests go directly to the controller.

2. What we collect

We collect email address, verification state, chosen nickname and optional profile name or avatar; age-eligibility declaration; publicly submitted ideas, comments and extensions; votes and status history; complaints and moderation correspondence; security logs such as IP address, event time and technical abuse indicators; and consent/terms acceptance records. We do not require a mobile App account to join the Programme. We do not deliberately collect government IDs, health data or private App audio. Public submission forms warn against entering sensitive or third-party information.

Account, publication, comment, vote, status and ordinary Programme communications: contract performance, GDPR Article 6(1)(b).
Security, abuse prevention, proportionate moderation investigation, legal claims, service reliability and aggregated product analysis: legitimate interests, Article 6(1)(f), subject to your right to object and a documented balance of interests. Where necessary, we process to comply with applicable legal obligations under Article 6(1)(c).
Optional publication of your real name, identifiable photo or other recognition beyond the public nickname: consent, Article 6(1)(a), freely withdrawable for future display.
Optional marketing emails: separate consent under applicable marketing and privacy laws. Programme service emails do not require marketing consent.
Optional private App feedback or conversation excerpts: separate notice and optional controls within the App; no use under this Programme notice to justify analysing entire private transcripts.

Do not post special-category data such as health details. If such material appears, we restrict it and assess lawful handling. Routine processing of voluntary public posts is not based on collecting blanket Article 9 consent.

4. Public visibility and AI-assisted processing

Published ideas and comments are visible to anyone and may be indexed by search engines or copied. We screen submissions for spam and unsafe content and may use Google Gemini for moderation support and machine translation to English; the translated text is marked. We do not automatically post private App conversation transcripts. Human review controls consequential status and moderation decisions; there is no solely automated decision with legal or similarly significant effect under Article 22 by virtue of ordinary idea classification.

5. Recipients, hosting and transfers

We use the FizzUp hosting infrastructure described in our system records, including Railway for app hosting and Hostinger for email delivery, and Google for AI processing. Authentication and the separate App may involve Apple and Google. Service providers may act as processors or independent controllers according to their contractual roles; we assess those roles service-by-service. Google processing or provider support may involve countries outside the European Economic Area. When a transfer restricted by GDPR occurs, we rely on an applicable adequacy decision or appropriate contractual safeguards where available, and provide additional information upon request. We do not claim that every Google AI request remains inside the EU.

At the Programme launch, published ideas and account-linked identifiers are not copied to GitHub repositories or submitted to OpenAI, Anthropic or other external generative-AI analysis providers. If this changes, we will update the notice and determine lawful bases, contracts, safeguards and applicable consent requirements before enabling transfer. The mere fact that a post is public does not remove GDPR protection.

6. Retention

Programme account, nickname and the ability to associate authored contributions with an account: during account operation; associated information is assessed for removal or de-identification when the account is deleted, with exceptions for legal claims, integrity of public discussions and legally required records.
Published Contributions: during their public relevance and ordinarily no longer than 24 months from last substantive status or community activity, followed by review, archiving without identifying attribution where possible, or deletion; earlier justified rights requests are assessed promptly.
Unpublished rejected content: deleted within 30 days after final moderation decision, except evidence required to resolve a report or legal claim.
Voting and abuse/security logs: ordinary identifiable anti-abuse logs for 90 days, extended only for a documented abuse incident or legal need; non-identifying statistical totals may remain.
General support and moderation cases: 12 months after closure unless a longer legal retention obligation or dispute applies.
Terms/consent acceptance evidence: while needed to demonstrate valid participation and ordinarily 24 months after account closure where no legal dispute justifies longer.
Infrastructure backups: rotate within 35 days under the configured backup policy; immediate selective erasure inside immutable backups may be technically infeasible, but deleted material must not be restored to live use and must expire under the rotation schedule.

These are operator-set retention rules which must be implemented in the system. They do not override statutory retention duties where applicable. Independent copies created by visitors or search engines are not under our direct control.

7. Your rights

You may seek access, rectification, erasure, restriction, data portability where applicable, and object to legitimate-interest processing. You may withdraw consent without affecting prior lawful processing. Contact privacy@fizzup.ai; we respond under the GDPR timetable, ordinarily within one month, subject to lawful extension. You may complain to the Polish supervisory authority Prezes Urzędu Ochrony Danych Osobowych (UODO) or a competent EEA supervisory authority. Certain requests require verifying account ownership.

8. Children and security

Programme membership is limited to those 18+. We use email verification, access controls, technical rate limits and report handling to reduce misuse. Do not include third-party personal data or private transcript extracts in public forms. No online service is entirely risk-free; security incidents are assessed under GDPR notification requirements.

9. Cookies and tracking

The launch Programme uses only technology strictly necessary for authentication, session integrity, language selection, fraud prevention and security, without nonessential advertising or behavioural-analytics trackers. Optional tracking and cookies requiring consent will not be enabled without a separate compliant consent mechanism and cookie information. Language preference storage may be used solely as necessary to remember the user-selected interface setting.

10. Updates and language

We publish material updates before they apply to existing Members where required and seek fresh permission for new purposes when law requires. This notice is available in Polish, English, German, French and Spanish. The edition provided in the participant’s selected language supplies the Programme privacy information; it does not replace the separate App Privacy Policy, whose Polish edition remains its published reference version. For questions contact privacy@fizzup.ai.