What we keep, where it goes, and how to get it out

The controller of personal data processed through Potilion is:

Most of what goes into Potilion is meant to be published. A newsroom is a public page. We keep what you put in it, we keep what we need to run your account and bill you, and we keep a ledger of what the AI features cost. We do not sell any of it, and we do not use it for advertising.

Your account. Your email address, and if you sign in with Google, the name and email Google provides. Sign-in timestamps. Needed to run the account. Legal basis: performing our contract with you.

Your newsroom. Everything you write or upload: About copy, the people you list with their roles, bios, photos and links, your press contact's name, email and phone, news posts, logos and press-kit files. Also the questionnaire answers and any document you give AI Draft, which stay private and are not published. Legal basis: our contract with you. For the personal data of the people you list, you are responsible for having their agreement, as the terms say.

Journalists who follow a newsroom. Their email address, the newsroom they follow, and when they confirmed. If they create a journalist account, also their name, outlet, beat and the profile they fill in. Legal basis: their consent, which they can withdraw with one click in any email we send.

AI usage. For each AI Draft or coaching call: the account, the newsroom, the model, the token counts and the cost. Not the content. Needed to enforce plan limits and to bill correctly. Legal basis: our contract with you.

Payments. Handled by Stripe. We store your Stripe customer and subscription identifiers and the plan status. We never see or store card numbers. Legal basis: our contract with you, and legal obligations around invoicing.

Technical. Server logs with IP address and request details, kept briefly for security and debugging. Legal basis: our legitimate interest in running a secure service.

We use these providers. Each processes data only on our instructions and under a data processing agreement.

• Anthropic (United States). When you use AI Draft or the coach, the text of the section being drafted or scored, your questionnaire answers, the readable text of your website and any document you supplied are sent to Anthropic's API to produce the draft or the notes. This is a transfer outside the EU, made under the EU-US Data Privacy Framework and standard contractual clauses. Anthropic does not use API inputs to train its models. Nothing is sent unless you press the button.
• Supabase (EU, Ireland). Database, authentication and file storage. Where your account and newsroom live.
• Vercel (EU, Dublin, with a global edge network). Hosting. Pages are served from the nearest location to the reader.
• Resend (EU). Sends our email: sign-in links, follow confirmations, news notifications, team invites.
• Stripe. Payments and invoicing.
• Google. Only if you choose to sign in with Google.

A published newsroom is public and is meant to be indexed by search engines and read by AI systems. We publish it with structured data (schema.org, llms.txt, a sitemap) precisely so that it is found. Once published, copies may exist in search indexes, archives and AI systems that we do not control and cannot remove from.

A draft is visible only to your account and to anyone you give the preview link to. Preview pages carry a no-index instruction.

• Your account and newsroom content: until you delete them.
• Deleting a newsroom removes its content and every uploaded file. Deleting your account removes everything on it.
• A draft newsroom nobody has touched for thirty days gives up its web address, but the content stays until you delete it.
• Journalist follows: until they unsubscribe. Unconfirmed follows are dropped.
• The AI usage ledger and billing records: for as long as accounting law requires, currently ten years for invoicing records in the Czech Republic.
• Server logs: a few weeks.

We set only the cookies needed to keep you signed in. Page views are counted with Vercel Web Analytics, which uses no cookies and no persistent identifier: it records the page, the referrer, the country and the device type, and cannot follow one visitor across days. There is no advertising tracking. If we ever add analytics that identify a visitor, this section will say so and, where the law requires it, you will be asked first.

You can ask to see the personal data we hold about you, have it corrected, have it deleted, receive a copy in a portable format, object to processing based on our legitimate interest, or withdraw consent where processing rests on it. Write to support@potilion.com. We answer within a month.

If you think we are handling your data wrongly, you can complain to the Czech data protection authority, Úřad pro ochranu osobních údajů (uoou.gov.cz), or to the authority in your own EU country.

When we change how we handle data, we update this page and the date at the top. If the change matters to you, we tell you by email.