Privacy Policy

1. Who we are (Data Controller)

This Privacy Policy explains how WillpowerLab ( "WillpowerLab", "we", "us", "our") collects, uses, discloses, and protects your personal data when you use our speech-coaching and presentation-practice application and related services (the "Service").

WillpowerLab is a service operated by an individual (a natural person) based in Poland, currently conducting unregistered business activity (działalność nieewidencjonowana) below the revenue threshold that requires business registration under Polish law. For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Polish Act of 10 May 2018 on the Protection of Personal Data, the Data Controller is:

Given the small scale of processing, we are not required to, and have not, appointed a Data Protection Officer (GDPR Art. 37). The operator handles all privacy requests directly at the email above.

2. Categories of personal data we collect

We collect and process the following categories of personal data:

• Account Data: your email address, name (or display name), password (stored in hashed form), and technical identifiers including your IP address, device/browser information, and authentication metadata.
• Voice Data: audio recordings of your voice that you create when you record a "take" or re-read within the Service.
• Text Data: transcripts automatically generated from your Voice Data, AI-generated coaching notes and analytics (e.g., filler-word and structure analysis), and the evolving "Ideal Text" versions assembled for you.
• Usage Data: logs of how you interact with the Service (features used, sessions, timestamps, error and diagnostic data) used to operate, secure, and improve the Service.
• Payment Data: where you make a purchase, transactions are processed entirely by our third-party payment processor (Stripe). We do not store or have access to your full payment-card number. We receive limited billing metadata (e.g., transaction status, the last four digits of the card, billing country) necessary to manage your account and comply with applicable obligations.

3. Lawful bases for processing (GDPR Articles 6 and 9)

We rely on the following lawful bases:

• Performance of a contract (Article 6(1)(b)). We process your Voice Data, Text Data, and Account Data to deliver the core Service you have requested: recording and transcribing your takes, running AI speech analysis, and assembling and presenting your coaching notes and Ideal Text.
• Consent (Article 6(1)(a)). We record your voice and generate speech analytics only after you have given clear, affirmative consent. You may withdraw this consent at any time (see §7); withdrawal does not affect processing carried out before withdrawal.
• Legitimate interests (Article 6(1)(f)). We process Usage Data to secure the Service, prevent abuse, and improve reliability, where such interests are not overridden by your rights and freedoms.
• Legal obligation (Article 6(1)(c)). We process limited billing data to meet applicable Polish accounting and tax obligations.

Special categories of data (Article 9): important characterisation. WillpowerLab processes your voice to analyse speech delivery (pace, fillers, structure, clarity), not to uniquely identify you. We do not create voiceprints or perform biometric identification. On that basis, your Voice Data is processed as ordinary personal data and the special-category regime of Article 9 is, in our assessment, not triggered by the processing itself. However, because voice can be sensitive and because coaching notes could incidentally touch on inferences a user might regard as sensitive (for example, indicators of stress or emotional state), we adopt a cautious posture: to the extent any special-category data within the meaning of Article 9(1) is processed, we do so only on the basis of your explicit consent under Article 9(2)(a).

No AI foundation-model training. Your Voice Data and transcripts are sent to OpenAI's developer API for analysis under a commercial API agreement that provides for zero data retention and under which API inputs and outputs are NOT used to train OpenAI's foundation models. We do not use your content to train any public AI model, and we do not sell your personal data.

Note on the challenge/threat-detection model. WillpowerLab is developing an internal model to detect "breakthrough / key moments" in speech. Where recordings or annotations are used to train our own internal model, this is done only on the basis described above (contract and/or your explicit consent) and never shared for training third-party public models.

4. How we use your data (purposes)

We use your data to: create and manage your account; record, transcribe, and analyse your takes; generate coaching notes and assemble Ideal Text; enable coach review where applicable; process payments; provide support; secure and improve the Service; and comply with legal obligations.

5. Sub-processors and international transfers

We use carefully selected third-party service providers ("sub-processors") who process personal data on our behalf under written Data Processing Agreements (DPAs). Where a sub-processor transfers data outside the European Economic Area (EEA), the transfer is governed by appropriate safeguards, primarily the European Commission's Standard Contractual Clauses (SCCs) and, where relevant, supplementary measures.

We keep an up-to-date list of sub-processors and will update this Policy when it changes materially.

6. Data retention

We retain personal data only for as long as necessary for the purposes described above:

• Voice Data (audio files): retained only as long as necessary to transcribe and process the take, and in any case automatically deleted no later than 30 days after creation, or earlier upon your request.
• Text Data (transcripts, coaching notes, Ideal Text): retained for as long as your account remains active, so that your coaching history and Ideal Text remain available to you. Deleted upon account deletion or valid erasure request, subject to any overriding legal retention obligation.
• Account Data: retained for the life of your account and deleted (or anonymised) following account closure, subject to legal retention periods.
• Payment/billing records: retained for the period required by applicable Polish accounting and tax law.

7. Your rights under the GDPR

Subject to the conditions in the GDPR, you have the right to:

• Access: obtain confirmation of whether we process your data and a copy of it (Art. 15).
• Rectification: correct inaccurate or incomplete data (Art. 16).
• Erasure ("right to be forgotten"): request deletion of your data (Art. 17).
• Restriction: request that we limit processing in certain circumstances (Art. 18).
• Data portability: receive your data in a structured, commonly used, machine-readable format and transmit it to another controller (Art. 20).
• Object: object to processing based on legitimate interests (Art. 21).
• Withdraw consent: withdraw any consent at any time, without affecting the lawfulness of prior processing (Art. 7(3)).
• Not be subject to solely automated decisions producing legal or similarly significant effects (Art. 22). Our AI analysis is advisory coaching and does not produce such effects; a human remains responsible for any consequential decisions.

To exercise any right, contact us at artur@willonski.com. We respond within one month, as required by the GDPR.

Right to lodge a complaint. You have the right to lodge a complaint with the Polish supervisory authority:

8. Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit, access controls, hosting within the EU region for our primary datastore, and the zero-retention API arrangement described above. No system is perfectly secure, but we work to protect your data commensurate with its sensitivity.

9. Children

The Service is not directed to, and may not be used by, persons under the age of 18. We do not knowingly process the personal data of children. If we learn that we have collected such data, we will delete it.

10. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new effective date and, for material changes, provide additional notice (e.g., by email or in-app). Continued use of the Service after the effective date constitutes acceptance of the updated Policy.

11. Contact

Questions or requests regarding this Policy or your personal data: artur@willonski.com. WillpowerLab, operated by Artur Willoński, Poland.