Current document · Privacy Notice
Privacy Notice
Controller: RELESONA TECHNOLOGIES s. r. o., Lesná 550/42, 900 42 Miloslavov, Slovakia, Company ID 52 609 227. Exercise rights at Configuration pending — draft only or info@relesona.com.
1. Data, purposes and legal bases
| Activity | Data | Purpose | Legal basis |
|---|---|---|---|
| Assessment and certificate | ten scored answers, name/nickname, country/region, locale, style, order ID and output | calculate and deliver the requested entertainment certificate | GDPR 6(1)(b) |
| Optional message | recipient and tone choices held in the browser; suggested or edited message if you keep it | select and deliver the optional certificate wording | GDPR 6(1)(b), where included in an order |
| Order and payment | email, SKU, amount, currency, VAT, payment status and transaction ID | contract, payment, refund and durable confirmation | 6(1)(b), 6(1)(c), and proportionately 6(1)(f) |
| Mugshot render | optional self-photo and technical metadata | place the photo in the ordered design | 6(1)(b); no secondary use |
| Share link | output, random token, times, state and reports | sharing expressly enabled by the user | 6(1)(b)/(f); separate opt-in |
| Support/legal requests | contact, order, correspondence and evidence | resolve requests and legal claims | 6(1)(b), (c), (f) |
| Security | IP, device, time, error and security events | protect service, prevent fraud and handle incidents | 6(1)(f); documented LIA |
| Optional analytics/marketing | consent ID, pseudonymous events or contact | measurement or messages | 6(1)(a); off until consent |
Only the first ten assessment answers affect the verdict. The two recipient and tone choices are used in your browser and are not sent or stored separately. If you keep a suggested message, that text is submitted with the order as the certificate dedication. You may edit or delete it before checkout. Fields marked required, the delivery email and order record are necessary for the contract. Photo, the optional message, public sharing, analytics and marketing are optional; refusing them does not block the basic purchase.
2. Sources and other people
Most data comes from you or is created by the service. Payment status comes from the payment provider; reports may come from the affected person or reporter. Using another adult's data requires authority and may not violate their rights. Default Mugshot mode permits self-photos only; third-party photos stay disabled until an approved lawful-basis, notice, permission and takedown workflow exists.
3. Recipients and transfers
We use verified hosting, rendering/storage, payment, transactional-email, support and security providers and, if enabled, analytics providers. The current legal entities, roles, regions and subprocessors are at Configuration pending — draft only. Transfers outside the EEA use a valid mechanism such as adequacy or Standard Contractual Clauses plus supplementary measures where required.
We do not sell personal data for money and do not use it for third-party behavioural advertising without a separate valid opt-in.
4. Retention
| Category | Controlled standard |
|---|---|
| Original photo | delete within 24 hours after successful render; within 7 days after failure; backups within 30 days |
| Private PNG | 30 days for download/support; then delete; non-content hash and delivery record up to 2 years |
| Share link and PNG | until disabled or 180 days, whichever is earlier |
| Order, legal versions and declarations | 4 years after delivery; longer for an active dispute |
| Accounting/tax records | 10 years or the then-current statutory period for the record |
| Support, complaint and withdrawal | 4 years after closure; longer for an active claim |
| Routine security logs | 90 days; longer only for an incident, abuse or legal claim |
| Consent evidence | for the consent term and 4 years after withdrawal/expiry, using minimal identifiers |
5. Rights
Subject to GDPR conditions, you may access, correct, erase, restrict, port, object and withdraw consent. We may proportionately verify identity. We normally respond within one month and explain any lawful extension. You may complain to the Slovak Personal Data Protection Office, Galvaniho 7/B, 821 04 Bratislava, Slovakia, dataprotection.gov.sk, or another competent EU/EEA authority.
6. Automation, security and incidents
DUMB TAX uses deterministic rules for the satirical verdict and selects optional message text from a fixed multilingual phrase library. It does not use a generative AI model for this feature and does not make a legal or similarly significant decision under GDPR Article 22. We do not use photos for facial recognition, identity verification, biometric matching, emotion inference or training. The control register must evidence access control, encryption in transit, private objects, short-lived signed links, webhook protection, admin logging, backups and restore tests, vulnerability management and incident response. We notify authorities and individuals when legally required.
7. Changes
We give clear advance notice of material changes to purpose, recipients, use of AI, retention or sharing. A new purpose does not automatically reuse an old consent. The effective notice version is archived with each order.