Privacy Policy

1. Scope

This policy describes personal data handled by Shablonix at shablonix.online, editor.shablonix.online, and api.shablonix.online. It covers the marketing site, accounts, the editor, the dashboard, and the generation API.

If you only appear inside a document that one of our customers generates — for example as the recipient of an invoice — that customer decides why your data is there. Read the section “Document data”, then contact that customer about access or deletion. Contact us if you cannot tell who the customer is.

2. Who we are

Radiant Software Ltd, UIC 208709030, Sofia, Bulgaria, operates Shablonix and is the controller for the account, billing, and website data described below. Radiant Software Ltd is not registered for VAT.

Write to shablonix@radiantsoftware.eu to exercise a right in this policy, or to ask us to close an account.

3. Two roles

We act in two different ways, and the difference matters.

Controller. We decide why account, billing, security, and website data is used. That is the data in “Account data”.

Processor. When you send us templates and generation data that include personal data about other people, you are the controller of that data (or you process it for someone else). We process it only to render and deliver what you asked for, under the data-processing terms in the Terms of Service.

4. Account data

To run the account, we process:

• name, email address, and a bcrypt hash of your password;
• optional multi-factor authentication secrets, stored encrypted, and recovery codes;
• organization membership, if the account belongs to an organization;
• session records: a hash of the refresh token, IP address, user agent, and timestamps;
• API key name, scopes, and a hash of the key — the full key is shown once;
• optional AI provider, model, and an encrypted copy of a key you choose to store, plus a short hint;
• billing status, plan, usage counts, and a Stripe customer id;
• how you found us when you sign up: campaign tags in the link you followed (such as utm_source), the website that referred you (its address only, not the full page URL), and the first page you opened. This is held in page memory until you submit the sign-up form, not in a cookie or browser storage, and we use it only to understand which channels bring customers;
• messages you send through the contact form: name, email, company, subject, and the message; and
• support correspondence you send us.

Stripe collects and stores the payment card and the billing address you enter at checkout. We do not store the full card number. Stripe’s own privacy notice describes that processing.

If you publish a page we have enabled for your account, the content you choose to publish can be seen by anyone with the address.

5. Document data

Customers use Shablonix for invoices, letters, contracts, receipts, certificates, reports, and email. The payload can contain names, addresses, amounts, and other details about their own customers. We use that payload to render the file you asked for.

We do not use generation payloads to train Shablonix models, to build advertising profiles, or to enrich other customers’ records.

How long a payload exists depends on the way you generate:

• Direct PDF stream. If the request asks for the PDF in the response and sends no idempotency key, the payload is encrypted with AES-256-GCM and a key created for that generation, and held in our database only while our render worker produces the file. It is cleared when the job succeeds or fails. The PDF is written to a private temporary file on our server, streamed back, and deleted when the response finishes or the connection drops. If it is never collected, it is deleted within about 20 minutes. It is never uploaded to object storage and no download link is created. The response is marked so caches should not store it. A request that sends an idempotency key keeps the file like a stored file below, so a retry returns the same PDF without rendering or charging again.
• Queued, batch, and stored jobs. The payload is encrypted while the job waits, with AES-256-GCM and a key created for that generation. The queue carries an id, not the document. The payload is cleared when the job succeeds or fails. A job that never finishes is failed and cleared after about 60 minutes, plus the cleanup cycle (about every 10 minutes).
• Stored files. A file kept for later download is private. It is deleted after 72 hours by default. A download link is minted only for an authenticated owner, lasts 10 minutes by default, and never outlives the file. Anyone who receives that link can use it until it expires, so do not put it in logs, chat, or a public page.
• Email compiles. The compiled message is returned to you. If you send an idempotency key, we can keep an encrypted copy of that reply for 24 hours so a retry is not charged twice.

Templates, uploaded assets, saved sample data, and editor history stay until you delete them or the account is closed. Do not put personal data in template names, asset file names, or webhook URLs. Those identifiers can appear in operational logs.

6. Why we use it

We do not sell personal data, and we do not use it for third-party advertising. You can object to processing based on legitimate interest by emailing us. If we can still show a compelling ground, we may continue, and we will tell you.

7. How long it stays

Generation metadata can remain after the payload is gone: an id, the owning account, the template id, format, status, sizes, timing, and a generic failure reference. That metadata does not include the document body.

These are the retention rules of the product. They describe how the service is built to behave. They are not a certification.

8. AI assistance

AI help in the editor is off until you connect a provider. You can use your own key for OpenAI, Anthropic, Google, Groq, Mistral, or a custom endpoint you name. For a request you start, we send the prompt and the relevant template context to that provider with your key.

That provider processes the prompt under its own terms and privacy notice. If the provider is outside the European Economic Area, your instruction to use it is the reason the prompt is sent there. We store the key encrypted. We do not use those prompts to train a Shablonix model.

9. Cookies

We use a session cookie so you stay signed in. It is strictly necessary for the account. The theme choice is stored in local storage in your browser and is not sent to us as a tracking cookie.

We do not use advertising cookies, and we do not drop an analytics cookie on these sites. Because the session cookie is required to provide the service you asked for, we do not show a consent banner for it.

10. Recipients

We use the following providers. They may process personal data only to perform the service described.

An AI provider you connect is your provider, not one we chose for the whole service. Your own email service, if you send a compiled message yourself, is also outside this list.

We share personal data with a public authority when the law requires it. We will tell you when we are allowed to.

11. International transfers

The application database runs in the European Union. Cloudflare, Stripe, and Resend can process data outside the European Economic Area, including in the United States. Where no adequacy decision covers a transfer, we use an approved mechanism such as the European Commission’s standard contractual clauses.

A provider you instruct us to call, including an AI endpoint you configure, may be in any country that provider operates in. You should read that provider’s terms before you connect it.

12. Security

The product is built with these controls:

• HTTPS for traffic to the sites and the API;
• passwords stored as bcrypt hashes, and API keys stored as hashes;
• pending generation payloads encrypted with AES-256-GCM and a separate key per generation, bound to the owning account;
• private object storage for files that are kept, with short-lived download links;
• renderer state cleared between documents;
• operational logs that omit generation bodies and redact secrets, kept for 30 days by default; and
• encrypted database backups on a two-slot weekly rotation.

Stored files use the storage provider’s encryption at rest. They are not encrypted with a key that only you hold. A signed download link cannot be revoked after you have shared it; it expires on its timer.

These are product measures, not a certification. We do not claim SOC 2, ISO 27001, HIPAA, or a GDPR “certification”. No method of transmission or storage is perfectly secure.

If we become aware of a personal-data breach that affects data we process for you, we will tell you without undue delay, with the information we reasonably have.

13. Your rights

If we are the controller, you can ask to access, correct, delete, or restrict your personal data, and you can ask for a portable copy of the data you gave us. You can object to processing based on legitimate interest. Where a particular act is based on consent, you can withdraw that consent.

Email shablonix@radiantsoftware.eu. We may need to confirm you control the account email. We respond within one month, or we tell you if we need longer, as the GDPR allows. Some records, such as invoices, stay for the tax period even after the account closes.

You can delete your account yourself under Settings → Security. If a paid subscription is still running, deleting the account cancels it immediately and the rest of the period is not refunded. Deletion removes your templates, uploaded files, API keys, webhooks, and sessions immediately; stored generated files follow within minutes. Your email and name are removed from the account record, while invoices, credit, and usage records stay as tax law requires. Accounts that belong to an organization are closed on request to that address, within 30 days of confirming the request.

You can complain to the Commission for Personal Data Protection (CPDP): https://www.cpdp.bg/. If you live elsewhere in the EU, you can also complain to the authority in your country.

14. Children

Shablonix is a business tool. We do not knowingly create accounts for children. If you believe a child has given us personal data, email us and we will delete the account.

15. Changes

We will post changes on this page and update the effective date. If a change materially affects account data we control, we will also email the address on the account when we have one. The Terms of Service explain how changes to the contract work.