Privacy Notice
Effective from 22 October 2026
This notice explains how the controller of Second Draft processes personal data connected with accounts, text generation, subscriptions, invoicing and service security. When business billing is enabled, the checkout flow also collects the legal company name, country and business tax or registration number for invoicing. Registration is open to anyone, and the application currently does not ask for or verify age.
1. Controller and contact
- Controller: Gábor Herbály, sole proprietor
- Postal address: 29 Móricz Zsigmond Street, 2141 Csömör, Hungary
- Privacy and general contact: herbaly.digital@gmail.com
- Data Protection Officer: none has been appointed.
Send privacy requests and complaints to the email address above. If needed, we will ask only for additional information necessary to verify your identity before acting on a request.
2. Personal data, purposes and legal bases
| Data | Purpose | Legal basis |
|---|---|---|
| Account: email address, creation time, random user ID, salted password hash, plan, usage counters, subscription status and scheduled deletion time. | Creating and authenticating an account, providing the service, applying plan limits and carrying out an account-deletion request. | Performance of a contract (GDPR Article 6(1)(b)). |
| Hashed session identifier and expiry; a browser session cookie containing an identifier. | Secure sign-in and maintaining your session. | Performance of a contract and use of a cookie necessary to provide the service. |
Random anonymous trial token (stored in the browser as an sd_trial cookie; only its hash and the number of free generations used are stored on the server). | Providing and limiting the five free generations without requiring an account; reducing repeated resets of the trial quota. | Legitimate interests in providing the requested trial and preventing abuse (GDPR Article 6(1)(f)); the cookie is used only for this service function, not advertising or analytics. |
| Email address, one-time password-reset token hash and expiry, and a password-change notification. | Password changes requested by you and protection of account security. | Performance of a contract and legitimate interests in account security (GDPR Article 6(1)(b) and (f)). |
| Source text, selected platforms, audience and tone settings, and generated drafts. | Generating the text draft you request. | Performance of a contract (GDPR Article 6(1)(b)). |
| Stripe customer, subscription and invoice IDs; plan, currency, amount, payment and invoice status. The name, email and billing address supplied for invoicing may also be processed by Stripe and Számlázz.hu; if business billing is enabled, the legal business name and business tax ID may also be processed. | Processing payments and subscriptions, issuing and delivering invoices, and meeting accounting and tax obligations. | Performance of a contract and compliance with a legal obligation (GDPR Article 6(1)(b) and (c)). |
| Technical and security logs: IP address, timestamp, requested path, HTTP status, browser identifier, and technical identifiers relating to errors and billing events. | Operating and troubleshooting the service, preventing abuse and attacks, and investigating security incidents. | Legitimate interests in operating and securing the service and establishing or defending legal claims (GDPR Article 6(1)(f)). |
| Daily aggregated page-view totals for the home page and privacy pages; no visitor identifier is created. | Understanding overall service usage and improving reliability. The analytics table stores only the date, page category and count; it does not store IP address, account/session ID, referrer or browser details. | Legitimate interests in operating and improving the service (GDPR Article 6(1)(f)). Standard web-server logs are processed separately for security and operations. |
| One daily aggregate count of unpaid trial generation requests (Budapest calendar date and total only; no IP, cookie token, account or payment identifier). | Applying the shared daily free-trial ceiling and protecting service availability. | Legitimate interests in reliable service operation and abuse prevention (GDPR Article 6(1)(f)); the date total is removed during the first hourly cleanup after that Budapest day ends. |
Passwords are not stored in readable form. An email address and password are required to create and access an account; without them, we cannot provide account access. The buyer's name and billing address required for an invoice are collected through Stripe Checkout. When business invoicing is enabled, the checkout flow also collects the legal company name, country and business tax or registration number. These details are sent to Stripe as subscription metadata, retrieved by the application for invoice issuance, and transferred to Számlázz.hu. The company country must match the Stripe billing address country. An invoice cannot be issued automatically if the necessary details are missing or inconsistent.
3. Text generation and artificial intelligence
When you generate text, the submitted source text, selected platforms and settings are sent to the OpenAI Responses API so that it can produce an answer. The application does not save the request in its database and sends the store: false setting. This does not rule out provider-side security retention: OpenAI's API documentation says abuse-monitoring logs may include request and response data for up to 30 days by default, subject to legal and security exceptions. OpenAI does not use API data to train its models by default unless the customer separately opts in. Please do not submit confidential, special-category or third-party personal data unless you have an appropriate legal basis and authority to do so.
You are responsible for reviewing and editing AI-generated text. The service does not make automated decisions about you that have legal or similarly significant effects.
4. Service providers, recipients and international transfers
Each provider receives only the data needed for its function. A provider's own notice governs its processing as an independent controller.
- OpenAI: processes source text, generation settings and responses. The service uses the global API endpoint and does not configure EEA-only processing. See API data controls and retention and the Data Processing Addendum.
- Stripe, Inc. and its affiliates: Checkout, card payments, subscriptions, fraud prevention and billing details. Stripe receives the payment data directly; the application does not receive or store card details. If business invoicing is enabled, Stripe also stores the legal company name, country and business tax or registration number in subscription metadata. Stripe may transfer data to the United States and other countries. Depending on the transfer, Stripe may rely on the Data Privacy Framework (DPF) and/or Standard Contractual Clauses (SCCs). See the Stripe Data Processing Agreement, Data Transfers Addendum and Stripe Privacy Policy.
- KBOSS.hu Kft. (Számlázz.hu): issues and emails electronic invoices. We send the customer's name, email and billing address, and, for business invoices, the legal business name and tax ID, along with service description, amount paid, currency, performance date, exchange rate and Stripe invoice ID. See the Számlázz.hu privacy notice.
- Plus Five Five, Inc. (Resend): sends transactional email, including password-reset and password-change messages. The recipient email address and message content are transferred; a reset message also contains a one-time link. The EU (Ireland) sending region is selected for this sending domain; this controls where email is sent from, not where data is stored. Resend states that stored data is held in the United States and that email and log data are retained for 30 days on its general plans. Transfers may rely on the SCCs and DPF mechanisms in Resend's DPA. See Resend security, region and retention information and the Resend Data Processing Addendum.
- Magyar Nemzeti Bank (Hungarian National Bank): for invoicing, the server requests an exchange rate based on the performance date and currency. We do not send the customer's name, email or billing address with this request. See official MNB exchange rates.
- Hosting and network transmission: the application, SQLite database and server logs are currently hosted on the controller's own server at the Csömör address above. The provider carrying the public network connection may process connection data under its own legal and contractual obligations. No VPS provider is currently used.
OpenAI, Stripe and Resend may process data outside the EEA, including in the United States. Depending on the provider and transfer, the transfer mechanism may be an adequacy decision, the EU–US Data Privacy Framework (DPF), or Standard Contractual Clauses (SCCs), as set out in the provider's contractual documents. Provider and subprocessor lists and settings may change; the linked documents and terms accepted in the relevant accounts govern.
5. Retention and deletion
- Account data: while the account exists. When a free account is deleted, the application removes the user record and associated active sessions and password-reset records. If a subscriber requests account deletion, renewal of the Stripe subscription is stopped; access remains available until the end of the period already paid for, after which deletion is automatic.
- Sessions: session cookies remain valid for up to 30 days. Expired session hashes and password-reset token hashes are automatically removed from the application database at startup and during hourly cleanup.
- Anonymous trial: the random browser token and its server-side hash and usage count expire after 12 months without activity and are automatically deleted. The cookie is renewed while the trial is used. Clearing the browser cookie may reset the free-trial count; it is not a verified one-person identity system. The service also applies a shared limit of 250 unpaid trial generation requests per Budapest calendar day across anonymous visitors and free accounts. Paid-plan requests use their separate plan quota. A separate daily counter stores only the date and aggregate total, without an IP address, cookie token, account or payment identifier; it is removed during the first hourly cleanup after the day ends.
- Password reset: a reset token expires after 30 minutes. Its hash is automatically removed when expired, used, when a later reset request is made, or when the account is deleted.
- Invoices and billing records: the application automatically deletes its local billing metadata five years after the record is first created. This local record includes Stripe and invoice IDs, status, country, currency, amount, technical error code and update time. It is not removed when an account is deleted. The invoice document itself is issued, emailed and retained in the Számlázz.hu account under the provider’s applicable retention rules.
- Backups: planned monthly; kept for no more than 12 months. Data of a deleted account may remain in a backup for up to 12 months until that backup expires. If a backup is restored, deletions that are already due must be applied again.
- Server and security logs: Apache and application logs may include IP address, time, requested path, response status and standard request metadata. They are used for security and troubleshooting and are kept for no more than 12 months, then deleted or overwritten. A record relevant to a legal process or security incident may be retained longer until that matter is resolved.
- Daily analytics: aggregate page-view counts for the home page and privacy pages are automatically deleted after 12 months. They do not identify unique visitors.
- Provider copies: Stripe, OpenAI, Resend and Számlázz.hu also apply their own retention rules. They may retain some data longer than the periods above where required for their own legal, security or fraud-prevention obligations.
6. Cookies and analytics
The application uses a necessary sd_session cookie to keep you signed in (up to 30 days), and a random sd_trial cookie to remember how many of the five free generations have been used before registration. Both are HTTP-only and SameSite=Lax; they are marked Secure over production HTTPS. The trial cookie is renewed during use and expires after 12 months without activity. It is not used for advertising or analytics, and its server-side record contains only a hash of the token, the usage count and expiry. Clearing the cookie may reset the trial count; it does not identify a person. First-party visitor statistics count daily page views only for the home page and privacy pages. The counter stores only the page category, date and total count; it does not create visitor profiles or store IP addresses, account/session identifiers, browser details or referrers in the analytics table. It uses no analytics cookie or third-party analytics provider and counts page views, not unique people. Standard server logs are handled separately as described above.
7. Your rights
Subject to the GDPR, you may request access to your personal data, rectification or erasure, restriction of processing and, where applicable, a portable copy. You may object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time; the main functions described here are not currently based on consent. Send requests to herbaly.digital@gmail.com. We normally respond within one month. For complex requests, this may be extended by up to two further months; we will explain the delay within the first month. Requests are generally free of charge.
You may complain to the Hungarian supervisory authority: National Authority for Data Protection and Freedom of Information (NAIH), Falk Miksa utca 9–11, 1055 Budapest, Hungary; postal address: P.O. Box 9, 1363 Budapest; email: ugyfelszolgalat@naih.hu. This is the authority's general customer-service email; use NAIH's official channels to initiate formal proceedings. You may also seek a judicial remedy. See NAIH information on data-subject rights.
People in the United States may have additional rights under applicable state privacy laws; requests may be sent to the contact above.
8. Changes to this notice
We will update this notice when the service, its providers or applicable law changes. The effective date of the latest version will be shown on this page.
Please submit only personal data that you are authorised to use in a draft and transmit to OpenAI. The providers' official documents linked above explain the details of their own processing.
Last updated: 23 October 2026.