Last updated: 14 August 2026
This Privacy Policy ("Policy") explains how BYQ Supply ("Company," "we," "our," "us") collects, uses and safeguards your personal data when you access or use the BYQ Supply platform (the "Platform").
1.1 The controller of your personal data is BYQ Supply spółka z ograniczoną odpowiedzialnością, ul. Stefana Drzewieckiego 19D, 54-129 Wrocław, Poland; KRS 0001234959; REGON 544500342; NIP 8943284908; EU VAT PL8943284908.
1.2 You can reach us about anything in this Policy at hi@byq.studio.
1.3 This Policy covers the byq.supply website, the application at app.byq.supply, the BYQ Supply Webflow extension, the Chrome extension, the MCP server, and related services.
1.4 It describes the personal data we collect, why we process it, who we share it with, and your rights under the EU General Data Protection Regulation ("GDPR") and other applicable laws.
Where we rely on legitimate interests, you may object at any time (see Section 13).
4.1 We do not sell your personal data, and we never have. We do not trade, rent or make your personal data available to data brokers.
4.2 In the interests of full transparency: where you consent to advertising cookies, limited data about your activity is shared with the advertising platforms listed in Section 8 so that we can measure our campaigns. Some laws — notably in California — classify that kind of sharing as a "sale" or "share" even though no money changes hands. You can prevent it entirely by declining advertising cookies in our consent banner.
5.1 The Platform includes AI features, currently the AI Builder and the generation of design systems. When you use them, the content you submit — your prompt and any text, code or context you include — is transmitted to a third-party AI model provider in order to generate a response.
5.2 Our AI model provider is Anthropic, PBC (United States), the provider of the Claude family of models. Anthropic acts as our processor and processes this content solely to return a result to us. This involves a transfer of data outside the European Economic Area; see Section 10.
5.3 Please do not submit personal data, confidential client information or credentials into AI prompts. You do not need to include such information for the features to work, and we ask you not to.
5.4 We retain your prompts and generated Output in your account so that you can access your own generation history, and we use aggregated, non-identifying usage counts to monitor consumption against your plan allowance.
5.5 For clarity, the Code Converter does not use AI. It is a deterministic script that runs on our infrastructure, and the code you paste into it is not sent to any AI model provider.
5.6 We do not use your prompts or your generated Output to train AI models, and our agreement with our AI model provider does not permit them to be used to train its models.
6.1 We use cookies and similar browser storage in three categories:
6.2 We also store marketing attribution parameters (UTM tags) in your browser's local storage so that campaign information is carried through to our application when you sign up.
6.3 Consent is collected and managed through Consent Studio (consent.studio), our consent management platform. You can change or withdraw your choices at any time through the cookie settings link on our website. A full, live list of the cookies in use is shown in the cookie declaration on this page.
6.4 Tags on our website are deployed through Google Tag Manager, which itself does not set analytics or advertising cookies but controls when other tags load, in line with your consent choices.
6.5 Disabling cookies may reduce functionality. Declining analytics and advertising cookies does not affect your access to the Platform.
7.1 Subject to your consent, we use Google Analytics 4 to obtain aggregated statistics on Platform usage. IP anonymisation is enabled. You can also opt out using the Google Analytics Opt-out Browser Add-on.
7.2 Subject to your consent, we use the Meta Pixel, Google Ads conversion tracking and the Reddit Pixel to measure the performance of our advertising campaigns, including sign-ups and purchases.
7.3 We operate an affiliate programme through Lemon Squeezy. Where you arrive via an affiliate link, a referral identifier is recorded so that the correct affiliate is credited.
8.1 We share personal data only where necessary, with the following categories of recipients:
8.2 Our service providers process data on our instructions under written data processing agreements, except where they act as independent controllers, as noted above.
8.3 This list reflects the providers in use at the date of this Policy. An up-to-date list is available on request at hi@byq.studio.
9.1 We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you.
10.1 Some of our providers are established outside the European Economic Area, principally in the United States. This includes Anthropic, Google, Meta, Reddit, Cloudflare, Vercel, Netlify and Lemon Squeezy.
10.2 Where data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses, the EU–US Data Privacy Framework where the provider is certified, or another lawful transfer mechanism, together with appropriate supplementary safeguards.
11.1 We keep personal data only for as long as it is needed for the purposes described in this Policy.
11.2 We may retain data for longer where we are required to do so by law, or where it is necessary to establish, exercise or defend legal claims.
12.1 We employ technical and organisational measures including encryption in transit, hashed password storage, access controls, infrastructure protection through Cloudflare, and regular backups.
12.2 No system is completely secure, but we work continuously to mitigate risk. If a personal data breach occurs that is likely to result in a high risk to your rights, we will notify you and the relevant supervisory authority as required by law.
13.1 Under the GDPR, you have the right to:
13.2 How to exercise your rights. Email hi@byq.studio and tell us which right you wish to exercise. We will respond within one month of receiving your request. If your request is complex, we may extend this by up to two further months and will tell you if we do. Exercising your rights is free of charge, although we may charge a reasonable fee for manifestly unfounded or excessive requests. We may ask you to confirm your identity before we act.
13.3 You may also lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa. You may alternatively complain to the authority in your country of residence.
14.1 The Platform is intended for users aged 18 and over, in line with our Terms & Conditions. We do not knowingly collect data from children. If we discover that we have, we will delete it promptly.
15.1 BYQ Supply Webflow extension. The extension operates inside the Webflow Designer and connects to the Platform to give you access to components such as Sections and Skeletons. It does not collect or store personal data beyond what its core functionality requires. Specifically, it may:
No personal or payment information is collected by the extension. Authentication and usage data remain in your browser.
15.2 Chrome extension. Our Chrome extension authenticates against your BYQ Supply account and stores an access token in browser storage in order to make Assets available while you browse. It does not read page content for any purpose other than the features you invoke, and it does not collect your browsing history.
15.3 MCP server. If you connect the BYQ Supply MCP server to an AI client such as Claude, Cursor or Lovable, that client authenticates to our server using a token issued to your account. We receive and log the requests your client makes — for example which Assets are retrieved — together with your account identifier, in order to serve the request, enforce your plan limits and protect against abuse. We do not receive the wider contents of your conversation with that AI client. Your use of the AI client itself is governed by that provider's own privacy policy, not ours.
16.1 The Platform may link to external sites. We do not control and are not responsible for their privacy practices.
17.1 We may update this Policy from time to time. Material changes will be announced by email or through a prominent notice on the Platform. Continued use after changes take effect means you accept the revised Policy.
BYQ Supply sp. z o.o.ul. Stefana Drzewieckiego 19D54-129 Wrocław, Poland
KRS: 0001234959 · REGON: 544500342 · NIP: 8943284908 · EU VAT: PL8943284908
Email: hi@byq.studio
