Edition of 27 September 2026
This Privacy Policy (the "Policy") describes what personal data the GPTARIA platform (https://gptaria.com) collects and how it processes that data when you use it.
The data controller is DANIUK IANA, a sole proprietor registered in Greece (Tax ID / VAT No. EL177161507), Chrysostomou Smyrnis 25, 15127 Melissia, Attica, Greece ("we", "the Controller"), contact: [email protected].
Personal data is processed in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Greek Law 4624/2019. This Policy is an integral part of the Public Offer Agreement.
1. What data we collect
| Category | Examples |
|---|---|
| Account data | Name / nickname, email, password (stored encrypted), role (Client / Builder) |
| Contact data | Email, optionally phone, links to profiles (GitHub, LinkedIn, etc.) |
| User content | Project descriptions, cases, portfolio, responses, messages |
| Payment data | The fact and amount of payment, the purchased service, transaction status, the billing country and email given at checkout. We do not receive or store card details — payments are processed by Paddle.com, our Merchant of Record |
| Technical data | IP address, device and browser type, Platform usage data, cookies |
| Referral source data | UTM campaign tags, ad click identifiers (Google gclid, Meta fbclid), landing page, referring site domain |
To prevent fraud and abuse, we may match technical (IP address) and contact (Telegram, GitHub, email, etc.) identifiers across accounts in order to detect linked or duplicate accounts. For this purpose the IP address is stored as an irreversible hash, not in plain form.
2. Purposes and legal bases for processing
We process data in order to:
- provide access to the Platform and its features (performance of the Agreement);
- process payments and refunds;
- send service and email notifications (responses to projects, statuses, bonus accruals);
- ensure security and prevent fraud and abuse — in particular, to detect linked and duplicate accounts, self-dealing (where the Client and the Builder are the same person), and manipulation of bonuses, ratings or referrals (on the basis of our legitimate interest in protecting the Platform and its users);
- improve the Platform and analyze its use (based on our legitimate interest or your consent — for analytics cookies).
3. Sharing data with third parties
We do not sell personal data. Data may be shared only with service providers necessary for the operation of the Platform:
- Paddle.com Market Ltd and its affiliates ("Paddle") — our online reseller and Merchant of Record: processes payments (PCI DSS standard), calculates taxes, issues receipts and handles refunds. For the payment transaction Paddle acts as an independent controller under its own privacy notice (paddle.com/legal/privacy);
- Hosting/infrastructure provider — data storage and service operation;
- Email delivery service — sending service emails;
- Google LLC — web analytics and tag management (Google Analytics, Google Tag Manager), conversion tracking (Google Ads);
- Meta Platforms, Inc. (Facebook) — conversion tracking and marketing analytics (Meta/Facebook Pixel);
- Reddit, Inc. — conversion tracking and marketing analytics (Reddit Pixel);
- Government authorities — only in cases expressly provided for by law.
4. Cookies
The Platform uses:
- necessary cookies — for authentication and basic site operation (the site does not function without them);
- analytics cookies — Google Analytics and Google Tag Manager to analyze site usage, and Microsoft Clarity for heatmaps and session recordings;
- marketing cookies — Meta (Facebook) Pixel, Reddit Pixel and Google Ads conversion tracking to measure advertising effectiveness.
Analytics and marketing cookies are used only with your consent, which you provide via the consent banner on the site and can withdraw in your browser settings. These tools may transfer data to Google, Meta and Reddit, including outside the European Economic Area.
A separate note on referral source tags. If you arrive via an advertising link, we record the campaign tag so we can tell which advertising works. When you register within the same visit, the tag travels inside the link itself and is not stored on your device — no consent is required for this. If you have consented to marketing cookies, the tag is additionally stored in the gptaria-attr cookie for 90 days so that a registration made later can still be attributed. For registered users the tag is kept in the profile and used solely for internal advertising-performance analytics; it is not shared with third parties.
A separate note on session recordings. Microsoft Clarity captures cursor movement, clicks, scrolling and page content so we can see where the interface confuses people. The data is processed by Microsoft. Recording happens only with your consent to analytics cookies — without it the tool does not load at all. Private areas (messages, account, settings, notifications, project publishing) are excluded: Clarity does not start there. We do not use these recordings to identify individuals and do not share them with third parties other than Microsoft as the service provider.
5. Retention period
We retain personal data for as long as necessary for the purposes set out in Section 2, or for the period established by law (in particular for financial reporting). After an account is deleted, the data is deleted or anonymized, except for data we are required to retain by law.
6. Your rights
You have the right to:
- access your personal data and obtain a copy of it;
- request correction of inaccurate data;
- request deletion of data (the "right to be forgotten"), where there is no lawful basis for retaining it;
- restrict or object to processing;
- withdraw previously given consent;
- lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr) or with the data-protection authority of your country of residence.
To exercise your rights, contact [email protected].
7. Security
We apply technical and organizational data-protection measures: password encryption, a secure connection (HTTPS/SSL), and access restrictions. However, no method of transmitting data over the internet is completely secure.
8. International transfers
The infrastructure and services we use may be located outside the European Economic Area. In such cases the transfer relies on an adequacy decision of the European Commission or on the Standard Contractual Clauses, in accordance with Chapter V of the GDPR.
9. The GPTaria app on Reddit
We provide an app on Reddit that turns a description of a task into a working set of documents for building the first version of a product. The app runs entirely inside Reddit and does not call GPTaria servers.
What we do not receive. The text you enter never reaches our servers and is not stored in our database. We receive neither your username, nor your email address, nor any contact details.
Where the draft is kept. In Reddit's own platform storage, tied to your Reddit account identifier, for 30 days from your last action; after that the platform deletes it. You can start over at any time — a button inside the app erases the draft immediately.
Where your text goes. To produce the follow-up questions and the documents, the app sends the text you enter to a language-model provider — OpenAI (servers in the USA) — and receives the answer. OpenAI acts as a processor on our instructions; processing on their side is governed by OpenAI's policies. The text is passed to no other recipient.
Statistics. We count how many people reached each step. This uses an irreversible value derived from the account identifier; we store no usernames, and these numbers never leave the Reddit platform.
Publishing is your action. The finished documents are published from your account and under your name, into the subreddit where the app is installed, and only after you have seen the full text and pressed "Post it". The published post is public and subject to the rules of Reddit and of that subreddit.
Reddit is an independent controller. Everything that happens inside the platform (the post itself, your actions in it, the data Reddit collects) is governed by Reddit's Privacy Policy, not by this one. We have no access to your messages, subscriptions or browsing history on Reddit.
We sell nothing inside Reddit. The app is free, it takes no payments, it contains no links to third-party sites, and the documents it produces are yours to publish anywhere.
10. Changes to this Policy
We may update this Policy by publishing a new version on this page with the date indicated. Continued use of the Platform constitutes acceptance of the updated Policy.
11. Contact
For questions regarding the processing of personal data, please contact: DANIUK IANA, sole proprietor · Tax ID / VAT No.: EL177161507 · email: [email protected] · website: https://gptaria.com · address: Chrysostomou Smyrnis 25, 15127 Melissia, Attica, Greece