1. Who we are (Data Controller)

Pro Studio ("we", "us", "our") is operated by:

YCL Enterprises d/b/a Mathias Media
1160 Vierling Dr E, Ste 301
Shakopee, MN 55379, United States
Email: kraig@mathiasmedia.com

We are the data controller responsible for your personal data under the EU General Data Protection Regulation (GDPR) and the UK GDPR.

2. Personal data we collect

• Account data: name, email address, hashed password, authentication identifiers.
• Billing data: purchase history, credit balances, billing email. Card details are handled directly by Stripe; we never see or store them.
• Content you create: sites, landing pages, copy, uploaded images, exported zips.
• Technical data: IP address, browser type, device information, timestamps, and minimal server logs required to operate and secure the service.
• Communications: messages you send us (e.g. support emails) and your responses to transactional emails.

We do not knowingly collect data from children under 16 and do not process special-category data (race, health, biometrics, etc.).

3. Why we process your data & legal bases (GDPR Art. 6)

• Provide the service (account, editor, exports) — performance of a contract.
• Process payments & manage credits — performance of a contract.
• Send transactional emails (sign-in, password reset, receipts, account notices) — performance of a contract.
• Keep the service secure (abuse detection, rate limiting, audit logs) — legitimate interests.
• Comply with law (tax, accounting, lawful requests) — legal obligation.
• Optional marketing emails (only if you opt in) — consent, which you can withdraw at any time via the unsubscribe link or by contacting us.

4. Sub-processors we share data with

We never sell your personal data. We share the minimum data necessary with vetted sub-processors who act under our instructions:

• Supabase — database, authentication, file storage, edge functions (hosting).
• Stripe — payment processing and billing.
• Lovable / Lovable AI Gateway — application hosting and AI inference for the in-app assistant.
• Anthropic — AI model provider used by the in-app assistant. Prompts and content you submit to the assistant are processed by Anthropic under their zero-retention API terms.
• Email delivery (Mailgun via Lovable Emails) — sending transactional and (if opted in) marketing emails.
• Firecrawl — only when you ask the assistant to clone or analyse a URL you supply.
• Kajabi — only if you choose to export your design to Kajabi. We never connect to your Kajabi account; you download the export and upload it yourself.

5. International transfers

Our infrastructure is primarily hosted in the United States. When personal data of users in the EEA or UK is transferred outside those regions, we rely on Standard Contractual Clauses (SCCs) and our sub-processors' equivalent safeguards (including the EU-US Data Privacy Framework where applicable).

6. How long we keep your data

• Account & content: for as long as your account is active. When you delete your account, your sites, images, exports, and profile are removed within 30 days, except where retention is required by law.
• Billing records: retained for up to 7 years to meet tax and accounting obligations.
• Server logs: typically 30–90 days.
• Email suppression list: retained indefinitely so we never email you again after unsubscribe.

7. Your rights under GDPR / UK GDPR

You have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten") — you can delete your account at any time from Settings.
• Restrict or object to certain processing.
• Portability — export your sites and content (the Export feature gives you a full Kajabi-ready zip).
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with your local supervisory authority. In the EU, find yours at edpb.europa.eu; in the UK, the ICO.

To exercise any of these rights, email kraig@mathiasmedia.com. We respond within 30 days.

8. Cookies & similar technologies

We use only strictly necessary cookies and local storage required to keep you signed in and to remember your preferences. We do not use advertising, analytics, or third-party tracking cookies. See our Cookie Policy for details.

9. Security

We use TLS in transit, encryption at rest, row-level security on our database, scoped service tokens, and least-privilege access. No system is 100% secure, but we work hard to protect your data and will notify you and the relevant authorities of any qualifying breach within 72 hours, as required by GDPR Art. 33.

10. Automated decision-making

We do not make decisions about you with significant legal effects using automated processing or profiling.

11. Changes to this policy

We may update this Privacy Policy as our service evolves. Material changes will be announced in-app or by email. The "Last updated" date at the top always reflects the current version.

12. Contact & Data Protection enquiries

For any privacy question, data request, or to reach our data protection contact, email kraig@mathiasmedia.com or write to the postal address in section 1.