Veyraflow
Sign inGet started

Privacy Policy

Draft

Version 2026-11-07 · Last updated 2026-11-07

ABOUT THIS PRIVACY POLICY

This Privacy Policy explains how Jan Nastały, trading as Veyraflow ("we," "us" or "our"), collects, stores, uses, shares and otherwise handles (together, "processes") your personal data when you use our services (the "Services"), for example when you:

  • visit our website at https://veyraflow.eu or any other website of ours that links to this Privacy Policy;
  • create an account, generate assets, buy credits, or work with other people in a team workspace;
  • contact us or interact with us in other ways, including by receiving product updates that you have agreed to.

We are the controller of your personal data, which means that we decide why and how it is processed. Reading this Privacy Policy will help you understand your privacy rights and choices. It complements our Terms and Conditions. If you do not agree with the way we handle personal data, please do not use the Services. If you have any questions or concerns, contact us at janeknastaly50@gmail.com.

KEY POINTS

This summary covers the most important points of this Privacy Policy. Each point refers to the section with more details, and all sections are listed under "CONTENTS" below.

  • What personal data do we process? It depends on how you use the Services: mainly your email address and account details, the content you provide when generating assets, your purchase history, and technical data such as your IP address. See Section 1.
  • Do we process sensitive data? We do not ask for special categories of personal data, such as information about your health, racial or ethnic origin, religious beliefs or sexual orientation. See Section 1.
  • Do we receive data from third parties? Only in a few situations: from our payment provider about your payments, and from other users who invite you to a team workspace. See Section 1.
  • Why do we process your data? To provide, improve and administer the Services, to communicate with you, to keep the Services secure and prevent fraud, and to comply with the law. For any other purpose, we ask for your consent first. See Section 2.
  • With whom do we share your data? With service providers that help us run the Services, with other users only in the ways you choose, and when the law requires it. We do not sell your data. See Section 4.
  • How do we protect your data? With appropriate technical and organizational measures. However, no transmission over the internet and no storage technology is completely secure, so we cannot guarantee that unauthorized persons will never be able to access, steal or change your data. See Section 9.
  • What are your rights? Depending on where you live, you have rights such as access to, correction and deletion of your data, and the right to complain to a supervisory authority. See Section 11.
  • How do you exercise your rights? Many of them directly in the app, in Settings under "Data & privacy", or by contacting us. We handle every request in accordance with applicable data protection law. See Sections 11 and 17.

CONTENTS

  • 1. WHAT DATA WE COLLECT
  • 2. HOW AND WHY WE USE YOUR DATA
  • 3. LEGAL GROUNDS FOR PROCESSING
  • 4. WHO WE SHARE YOUR DATA WITH
  • 5. COOKIES AND SIMILAR TECHNOLOGIES
  • 6. ARTIFICIAL INTELLIGENCE FEATURES
  • 7. INTERNATIONAL DATA TRANSFERS
  • 8. HOW LONG WE KEEP YOUR DATA
  • 9. HOW WE PROTECT YOUR DATA
  • 10. CHILDREN AND MINORS
  • 11. YOUR PRIVACY RIGHTS
  • 12. DO-NOT-TRACK AND GLOBAL PRIVACY CONTROL
  • 13. ADDITIONAL INFORMATION FOR UNITED STATES RESIDENTS
  • 14. ADDITIONAL INFORMATION FOR OTHER REGIONS
  • 15. CHANGES TO THIS PRIVACY POLICY
  • 16. HOW TO CONTACT US
  • 17. HOW TO ACCESS, UPDATE OR DELETE YOUR DATA

1. WHAT DATA WE COLLECT

Data you give us

In short: we collect the personal data that you provide to us yourself.

You provide personal data to us when you register, use the Services (for example to generate assets or to invite other people to a workspace), make a purchase or contact us. What we receive depends on how you use the Services and on the features you choose, and may include:

  • your email address;
  • your password, which our authentication provider stores only as a secure hash, and the one-time codes we send you to verify your email address or reset your password;
  • your display name and avatar, if you add them;
  • your settings and choices, for example whether you want to receive product updates and which cookies you accept;
  • the content you provide when using the Services, such as prompts, the text and instructions for voice lines, project names, descriptions and style guides, reference images, and the names, instructions, item lists and photos of your packs;
  • the email addresses of the people you invite to a team workspace;
  • the content of the messages you send us, for example support requests and feedback.

Sensitive data. We do not ask for, and do not intend to process, special categories of personal data, for example information about your health, racial or ethnic origin, political opinions, religious beliefs or sexual orientation, or biometric data used to identify you. Please do not include such data in prompts, uploads or messages. We do not process payment card data ourselves (see below).

Payment data. When you buy credits, you pay on pages operated by our payment provider, Stripe. Stripe collects your card or other payment details, your billing name and address and, if you are a business, your tax number. Your card number and security code never reach us. We receive and store the identifier of your customer account at Stripe and information about your payments (such as their status, amount and dates), and we can view your billing details in our Stripe account when we need them, for example to issue invoices or meet our tax obligations. For each order we also keep a record of what you bought, when and for how much, the request for immediate performance that you confirmed before paying, when we sent you the order confirmation and, if you withdraw from the contract, your withdrawal statement (including the name and email address it contains) and the refund. If a payment is refunded or you dispute it with your bank (a chargeback), we keep the amount, the reason given by the bank, the status of the dispute and the credits that were removed or returned. You can read Stripe's privacy notice here: https://stripe.com/en-pl/privacy.

Please make sure that the personal data you give us is true, complete and accurate, and keep it up to date. You can change most of it yourself in Settings.

Data collected automatically

In short: some data, such as your IP address and information about your browser and device, is collected automatically when you use the Services.

When you visit or use the Services, we automatically receive certain technical information, such as your IP address, browser and device characteristics, operating system, language preferences, the referring page, the pages you view and the actions you take, the date and time of your requests, and error information. On its own, this information usually does not reveal your name or contact details, but it is still personal data. We need it mainly to operate and secure the Services and, if you allow it, for analytics.

This includes:

  • Log and usage data. Our hosting and server infrastructure keeps technical logs of requests to the Services, including your IP address, your browser type (user agent), the pages and features you use and the time of use. We also keep a log of security-relevant actions, such as changes to workspaces and administrative actions, which may include your IP address. We do not write the content of your prompts into server logs.
  • Error reports. If an error occurs in your browser or on our servers, we record an error report with the error message and technical details, the address of the page (without query parameters or access tokens), your browser's user agent and, if you are signed in, the internal identifier of your account. Error reports do not contain your IP address, email address or prompts.
  • Device data. Information about the device and browser you use to access the Services, such as the device type, operating system and browser version.
  • Approximate location. We do not collect your precise location, for example from GPS. An approximate location, such as your country or city, may be derived from your IP address by Google Analytics (only if you accept analytics cookies) and by our payment provider to calculate taxes.
  • Analytics identifiers and in-app events. If you accept analytics cookies, Google Analytics stores a pseudonymous identifier in cookies (_ga and _ga_<ID>), and we send it records of actions in the app, such as pages viewed, sign-ups, sign-ins, asset generations, downloads, shares and started checkouts. Before a page address is sent, we replace access tokens and identifiers in it and remove query parameters other than campaign tags (such as utm_source), so that email addresses and tokens are not sent. You can withdraw your consent at any time via "Cookie settings".

We also use cookies and similar technologies, which are described in Section 5 and in our Cookie Policy.

Data from other sources

  • Our payment provider (Stripe): information about your payments, such as their status, amounts and dates.
  • Other users: if someone invites you to a team workspace, they give us your email address, which we use to send you the invitation.
  • AI model providers: the generated output and technical information about each generation, such as its status.

2. HOW AND WHY WE USE YOUR DATA

In short: we use your data to provide, improve and administer the Services, to communicate with you, to keep the Services secure and prevent fraud, and to comply with the law. We use it for other purposes only with your prior consent.

We process personal data for the purposes listed below. The legal grounds are explained in Section 3, and the retention period for each purpose is given in brackets.

  • Your account. To create your account, verify your email address, let you sign in and reset your password, and otherwise manage your account. (Until you delete your account; the deletion takes effect immediately. Verification codes stop working after 10 minutes for sign-up and after 15 minutes for a password reset.)
  • Generating and delivering assets. To generate assets from your prompts, instructions, reference images and project style guides by sending them to our AI providers or, for Packs, to machines that we rent from RunPod, and to store the results so that you can preview, download and share them. (Generated assets: until you delete them or until the workspace or your account is deleted. Deleted assets stay in the Trash for 14 days and are then permanently deleted. Prompts and generation history: until the workspace or your account is deleted. Project reference images: until you delete them, the project or your account. Temporary uploads and ZIP downloads: 24 hours. The download link for a data export: 24 hours. Copies at our AI provider fal.ai, which runs the generation models: up to 24 hours after the generation, see Section 6. Packs: the machine at RunPod keeps the texts and photos of an item only while it works on it, see Section 6.)
  • Acceptance of our terms and policies. To record which version of the Terms and Conditions and of our policies you accepted and when, and to show you a notice in the Services when a new version is published. (Until you delete your account.)
  • Team workspaces and sharing. To let you create team workspaces, invite members by email, assign roles and create private share links to assets and projects. (Until the workspace or your account is deleted. Invitations expire after 7 days and are deleted 30 days after they are accepted or expire. Share links work until the date you choose, after 7, 30 or 90 days or never, or until you revoke them.)
  • Credits and payments. To process your orders and payments, handle refunds and withdrawals, and keep track of your credit balance. (Credit balance and purchase history: until you delete your account. Order records, including your request for immediate performance, any withdrawal statement and any payment dispute: until claims related to the order become time-barred, at most 6 years from the end of the calendar year of the order, also after you delete your account. Payment notifications we receive from our payment provider: 30 days. Payment and invoice records: 5 years from the end of the calendar year in which the related tax payment was due, as required by Polish tax law; these records are kept in our payment provider's systems.)
  • Service messages. To send you messages that are needed to provide the Services, such as verification codes, invitations, order confirmations and confirmations of withdrawal, moderation warnings, information about changes to our terms and policies, and other account notices. (Your email address: until you delete your account. We do not store the messages themselves in our database; our email provider keeps delivery logs for a limited period.)
  • Product updates. Only if you have agreed to receive them, to send you news about Veyraflow. You can withdraw your consent at any time in Settings with the "Product updates" option. (Until you withdraw your consent or delete your account.)
  • Support and feedback. To answer your questions, solve problems with the Services and ask for your feedback. (Support requests: up to 12 months after the matter is resolved. Feedback: up to 12 months after we receive it.)
  • Security, moderation and fraud prevention. To keep the Services and your account secure, to check generation requests against our content rules, to enforce our Terms and Conditions, to prevent fraud and abuse and to limit excessive numbers of requests. (Moderation records, such as blocked prompts, violation counts and suspensions: until you delete your account; the violation counter resets every month. Security audit logs: 12 months. Rate-limiting data (IP address, email address): up to 24 hours. Error reports: 30 days.)
  • Understanding how the Services are used. To analyze how the Services are used and to improve them. (Google Analytics data: 14 months, collected only if you accept analytics cookies; analytics cookies last up to 2 years or until you withdraw your consent in "Cookie settings". Internal usage statistics are calculated from account data that is kept until you delete your account.)
  • Legal obligations and claims. To comply with our legal obligations, such as tax and accounting rules and requests from public authorities, to handle requests in which you exercise your data protection rights, and to establish, exercise or defend legal claims. (For as long as the law requires, or until the relevant claims become time-barred.)
  • Vital interests. In rare cases, to protect someone's life or physical safety, for example to prevent harm. (Only for as long as necessary.)

In short: we process personal data only when we have a valid legal ground to do so under applicable law, for example your consent, a contract with you, a legal obligation or our legitimate interests.

Because we are established in Poland, the EU General Data Protection Regulation (GDPR) applies to our processing of your personal data, wherever you live; if you are in the United Kingdom, the UK GDPR may also apply. We rely on the following legal grounds:

  • Performance of a contract (Article 6(1)(b) GDPR): to provide the Services under our Terms and Conditions, which covers your account, generating and delivering assets, team workspaces and sharing, credits and payments, service messages and support related to your use of the Services, as well as steps you ask us to take before entering into a contract with you.
  • Consent (Article 6(1)(a) GDPR): for analytics cookies and Google Analytics, and for product updates. You can withdraw your consent at any time (see "Withdrawing your consent" in Section 11).
  • Legitimate interests (Article 6(1)(f) GDPR): to keep the Services secure and working (security audit logs, error reports, rate limiting, moderation and fraud prevention), to produce internal usage statistics from account data, to ask for feedback, to answer enquiries that are not related to a contract, and to establish, exercise or defend legal claims. Our legitimate interests are protecting the Services and their users, preventing abuse, improving the Services and protecting our rights, and we rely on them only where your interests and fundamental rights and freedoms do not override them. You can object to this processing (see Section 11).
  • Legal obligations (Article 6(1)(c) GDPR): for example to keep tax and accounting records, to respond to lawful requests from public authorities, and to handle requests in which you exercise your data protection rights.
  • Vital interests (Article 6(1)(d) GDPR): to protect your life or safety or that of another person, for example in situations involving a potential threat to someone's safety.

You must provide your email address and a password to create an account; without them we cannot provide the Services to you. Providing other data is voluntary, but some features may not work without it.

If you are in Canada

If Canadian privacy law applies, we process your personal information with your consent, which may be express (for example when you accept analytics cookies) or, where appropriate, implied from the circumstances. You can withdraw your consent at any time (see "Withdrawing your consent" in Section 11).

In some exceptional situations the law allows us to process your information without your consent, for example: when this is clearly in your interest and consent cannot be obtained in time; to investigate or prevent fraud; for business transactions, if certain conditions are met; when the information is contained in a witness statement needed to assess, process or settle an insurance claim; to identify injured, ill or deceased persons and contact their next of kin; when we have reasonable grounds to believe that someone has been, is or may be a victim of financial abuse; when asking for consent could compromise the availability or accuracy of the information and the collection is reasonable for investigating a breach of an agreement or of the laws of Canada or a province; to comply with a subpoena, warrant, court order or court rules on the production of records; when the information was produced by a person in the course of their employment, business or profession and its collection is consistent with the purposes for which it was produced; when the collection is solely for journalistic, artistic or literary purposes; when the information is publicly available and specified by the regulations; and to disclose de-identified information for approved research or statistics projects, subject to ethics oversight and confidentiality commitments.

4. WHO WE SHARE YOUR DATA WITH

In short: we share personal data only in the situations described in this section.

Service providers

We use third-party service providers ("processors") that process personal data on our behalf, only on our instructions and only to the extent needed to provide their services to us. Our contracts with them require them to protect your data, not to use it for their own purposes, and to keep it only for as long as we instruct. They may use their own subcontractors only under equivalent obligations. Our service providers are:

  • AI models: OpenAI, which checks generation requests against our content rules and converts them into a form that the generation models understand, and fal.ai, which runs the generation models, including models developed by Hyper3D, ElevenLabs and Google (depending on the model, fal.ai may pass your input to the model's developer);
  • Machines for Packs: RunPod, which provides the computers (GPU machines) on which we run open-source AI models that generate the models of a pack;
  • Hosting: Vercel, which hosts the website and the application;
  • Database and user accounts: Supabase, which provides our database and authentication;
  • File storage: Cloudflare, which stores generated assets and uploaded files (R2 storage);
  • Background processing: Upstash, which runs our task queue and scheduled jobs, and Modal, which processes and converts generated files when this is needed;
  • Payments and billing: Stripe, which handles payments, receipts and tax calculation. For some purposes, such as fraud prevention and meeting its own legal obligations, Stripe acts as an independent controller under its own privacy notice;
  • Email delivery: Resend, which sends our service messages;
  • Analytics: Google Analytics, only if you accept analytics cookies;
  • Error monitoring: Google Cloud Error Reporting.

Other users

  • Members of a workspace can see the projects, assets and prompts in that workspace, as well as the display name (or, if none is set, the email address) and avatar of the other members.
  • If you create a share link, anyone who has the link can see the shared assets or project and, if you allow it, the original prompt, and can download the files.

Other situations

  • Legal requirements and protection of rights. We may disclose personal data when the law requires it, for example in response to a court order or a request from a public authority, or when this is necessary to establish, exercise or defend legal claims, to prevent fraud or to protect the safety of our users or other people.
  • Business transfers. We may share or transfer personal data in connection with, or during negotiations of, a merger, a sale of company assets, a financing, or the acquisition of all or part of our business by another company. We will inform you if this happens.

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.

5. COOKIES AND SIMILAR TECHNOLOGIES

In short: we use necessary cookies to run the Services and, only with your consent, analytics cookies. We do not use cookies for advertising.

Cookies are small text files that a website stores in your browser; similar technologies include your browser's local and session storage. We use:

  • Necessary cookies and storage, without which the Services cannot work: cookies set by our authentication provider (Supabase) that keep you signed in, a cookie that remembers the workspace you are currently using (vf_ws), a cookie that stores your cookie choices (vf_consent, kept for 12 months), and, if you use the theme switch, an entry in your browser's local storage that remembers the light or dark theme (theme). When you sign up, we sign you in with these cookies as soon as you verify your email address with the code we send you; your password is not stored in your browser for this. These technologies do not require your consent.
  • Analytics cookies, only if you accept them: Google Analytics cookies (_ga and _ga_<ID>) that help us understand how the Services are used. They last up to 2 years unless you withdraw your consent earlier.

We do not use advertising cookies, and we do not allow third parties to use tracking technologies on the Services for advertising. We do not sell personal data or share it for targeted advertising. When you go to checkout, you are on pages operated by Stripe, where Stripe's own cookies and policies apply.

You can change your choices at any time with the "Cookie settings" link in the footer of our website and of the application, or in Settings under "Data & privacy". You can also block or delete cookies in your browser settings, but without the necessary cookies you will not be able to sign in. More details are available in our Cookie Policy.

Google Analytics

With your consent, we use Google Analytics to understand how the Services are used. We have configured it without Google signals and without advertising features, and we remove access tokens, identifiers and query parameters (other than campaign tags) from page addresses before they are sent. According to Google, Google Analytics 4 does not log or store IP addresses. You can withdraw your consent via "Cookie settings" or use Google's browser add-on to opt out of Google Analytics: https://tools.google.com/dlpage/gaoptout. For more information about how Google handles data, see https://policies.google.com/privacy.

6. ARTIFICIAL INTELLIGENCE FEATURES

In short: the main feature of the Services, the generation of game assets, is powered by artificial intelligence that we obtain from third-party AI providers.

As part of the Services, we offer features powered by artificial intelligence, machine learning and similar technologies (the "AI Features"), currently the generation of game assets such as 3D models and characters, sound effects, music and voice lines. The rules for using the AI Features are set out in our Terms and Conditions and our AI Disclosure; this section explains what happens to your data when you use them.

  • What we send to AI providers. The content of your generation requests (prompts, the text and instructions for voice lines, style guide notes and any reference images you attach) is sent to OpenAI, which checks it against our content rules and converts it into a form that the chosen model understands, and to fal.ai, which generates the asset and may pass your input to the developer of the selected model (see Section 4). fal.ai keeps the files of a generation — the reference images you attach and the files the model returns — for no longer than 24 hours and then deletes them automatically; during that time each of these files can be opened by anyone who has its unguessable link. The links are known only to us, fal.ai and, where applicable, the developer of the model, and we do not publish them. fal.ai does not keep the content of your requests for its request history. We keep our own copy of the generated files in our file storage. We do not send the AI providers your email address, password or payment details. Please do not include personal data about other people in your requests unless you are allowed to.
  • Packs. When you start or edit a pack, its name, instructions, item texts and photos are checked by OpenAI's filters and then processed by open-source AI models (Qwen, FLUX.2 [klein], BiRefNet, TRELLIS.2 and DINOv3) that we run on machines rented from RunPod. A machine receives only the items it works on and their photos, through short-lived links, and deletes its working files after each item; it sends the finished files straight to our file storage. RunPod does not receive your email address, password or payment details. The machines may be located in the United States (Section 7).
  • No training by us. We do not use your prompts, uploads or generated assets to train AI models ourselves. The AI providers process this data as our service providers, under their agreements with us and their own terms.
  • Rules of the AI providers. You must not use the AI Features in any way that violates the terms or policies of our AI providers.
  • Automated moderation and decisions. Every generation request is checked automatically by an AI-based filter before it is sent to a model, and blocked requests are not charged. Several blocked requests within one calendar month may lead to a warning and then to an automatic suspension of your account, and a request involving the sexual exploitation of minors leads to an immediate suspension. These decisions are made by automated means and can significantly affect you; we make them because they are necessary to perform our contract with you and to keep the Services safe. You have the right to have such a decision reviewed by a person, to express your point of view and to contest the decision. To do so, contact us using the details in Section 16.

We handle all personal data processed with the AI Features in accordance with this Privacy Policy and our agreements with the AI providers.

7. INTERNATIONAL DATA TRANSFERS

In short: some of your data is processed outside your country, including outside the European Economic Area.

Our main infrastructure, that is the application servers, the database and background processing, is located in Germany, and generated files are stored in Europe. However, some of our service providers (see Section 4) and their subcontractors process data in other countries, in particular in the United States, and also in Ireland, Singapore and elsewhere. This applies especially to the AI providers (OpenAI, fal.ai and the developers of the models), RunPod (the machines for Packs), Google (Analytics and Error Reporting), Stripe, Vercel, Resend and Modal.

These countries may not have data protection laws as comprehensive as those in the European Economic Area (EEA), the United Kingdom or Switzerland. When your data is transferred outside the EEA, we make sure that it stays protected in accordance with this Privacy Policy and applicable law, by relying on:

  • an adequacy decision of the European Commission, such as the EU–US Data Privacy Framework for US companies certified under it; or
  • the Standard Contractual Clauses adopted by the European Commission, which require the recipient to protect your data in accordance with EU data protection law.

You can ask us for more information about these safeguards, and for a copy of the relevant clauses, using the details in Section 16.

8. HOW LONG WE KEEP YOUR DATA

In short: we keep your data only for as long as we need it for the purposes described in this Privacy Policy, unless the law requires us to keep it longer.

We keep personal data only for as long as necessary for the purposes set out in this Privacy Policy. The specific period for each purpose is given in Section 2. We may keep data for longer where the law requires or allows it, for example for tax or accounting purposes, or until legal claims become time-barred.

When you delete your account, the deletion takes effect immediately: your profile and every workspace you own, together with all the projects, assets, files, uploads, generation history, moderation records and credits in them, are permanently deleted from our database and file storage. Assets that you created in a team workspace owned by someone else belong to that team and are not deleted. Copies of generation files at fal.ai are deleted automatically within 24 hours of each generation in any case (Section 6). After the deletion we keep only payment and invoice records (for the period required by tax law), order records with your request for immediate performance and any withdrawal statement (until claims related to the order become time-barred, see Section 2), security audit log entries (for up to 12 months, no longer linked to your account), and copies in backups until they are overwritten in the normal backup cycle.

When we no longer need personal data, we delete or anonymize it. If this is not immediately possible, for example because the data is stored in backup archives, we store it securely and isolate it from any further processing until it can be deleted.

9. HOW WE PROTECT YOUR DATA

In short: we protect your personal data with a set of organizational and technical security measures.

We use appropriate technical and organizational measures to protect the personal data we process, including:

  • encrypted connections (HTTPS) between your browser and the Services;
  • passwords that must be at least 10 characters long and contain at least one letter and one digit, and that are stored only as secure hashes by our authentication provider, and one-time codes that are stored as hashes, expire quickly and allow only a limited number of attempts;
  • access controls in our database, so that users can only access data from their own workspaces;
  • private file storage that is available only through short-lived signed links;
  • at our AI provider fal.ai, automatic deletion of generation files after 24 hours, access to these files only through unguessable links that we do not publish, and no storage of request contents in its request history (Section 6);
  • limits on the number of requests, to prevent abuse and attacks on accounts;
  • re-encoding of uploaded images, which removes embedded metadata such as EXIF data (which may include the location where a photo was taken);
  • access to administrative functions only for authorized persons, with a record of administrative actions.

Despite these measures, no transmission over the internet and no data storage technology can be guaranteed to be completely secure, so we cannot promise that hackers, cybercriminals or other unauthorized third parties will never be able to defeat our security and improperly access, steal or change your data. You can help protect your account by using a strong, unique password, not sharing it with anyone, and using the Services only on devices and networks you trust.

10. CHILDREN AND MINORS

In short: the Services are only for adults, and we do not knowingly collect data from, or market to, anyone under 18.

The Services are intended only for people who are at least 18 years old, or older if a higher age of majority applies where they live. We do not knowingly collect personal data from, or market to, anyone below that age, and we do not knowingly sell such data. By using the Services, you confirm that you are at least 18 years old. If we learn that we have collected personal data from a person under 18, we will close the account and promptly take reasonable steps to delete the data from our records. If you become aware of any data that we may have collected from a person under 18, please contact us at janeknastaly50@gmail.com.

11. YOUR PRIVACY RIGHTS

In short: depending on where you live, you have rights that give you access to and control over your personal data. You can review and change your account details, or delete your account, at any time.

Your rights

Under the GDPR and, depending on where you live, under similar laws such as those of the United Kingdom, Switzerland and Canada, you have the right to:

  • access your personal data and receive a copy of it;
  • have inaccurate data corrected (rectification);
  • have your data deleted (erasure);
  • restrict the processing of your data;
  • receive your data in a structured, machine-readable format and have it transferred to another controller (data portability);
  • object to processing based on our legitimate interests, and object at any time to the use of your data for direct marketing;
  • withdraw your consent at any time;
  • not be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you, and, where such a decision is made (see Section 6), to have it reviewed by a person, to express your point of view and to contest it;
  • lodge a complaint with a data protection supervisory authority.

You can exercise many of these rights yourself in Settings (see Section 17). For anything else, contact us using the details in Section 16 or through our contact page. We will consider and act on every request in accordance with applicable data protection law. We will respond without undue delay and in any case within one month; for complex or numerous requests we may extend this period by up to two further months, in which case we will let you know. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive. We may ask you to confirm your identity, for example by writing to us from the email address of your account.

Complaints to a supervisory authority

If you believe that we are processing your personal data unlawfully, you can lodge a complaint with a supervisory authority. Our lead supervisory authority is the President of the Personal Data Protection Office in Poland (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl. You can also complain to the data protection authority of the EU or EEA country in which you live or work, or in which the alleged infringement took place.

If you are in the United Kingdom and are unhappy with the way we have handled your personal data, you can first complain directly to us; this is in addition to your rights under the UK GDPR and the Data Protection Act 2018. You can reach us through our contact page, by email at janeknastaly50@gmail.com, or by post at the address in Section 16. After you complain, we will acknowledge your complaint within 30 days of receiving it, investigate it without unjustified or excessive delay, keep you informed of our progress, and explain the outcome. If you are not happy with our final response, you can refer your complaint to the UK supervisory authority, the Information Commissioner's Office (ICO): website https://ico.org.uk/make-a-complaint, helpline 0303 123 1113, post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

If you are in Switzerland, you can contact the Federal Data Protection and Information Commissioner (https://www.edoeb.admin.ch).

If we process your personal data based on your consent, which, depending on the applicable law, may be express or implied, you can withdraw it at any time: for analytics cookies via "Cookie settings" in the footer of our website and of the application (or in Settings under "Data & privacy"), for product updates in Settings, and in any case by contacting us (see Section 16). Withdrawing your consent does not affect the lawfulness of the processing carried out before the withdrawal, nor, where the law allows, processing carried out on legal grounds other than consent.

Account information

You can review and change your account details at any time in Settings. You can also delete your account there, under "Data & privacy". The deletion is immediate and permanent; Section 8 explains what limited information we keep afterwards and why.

Cookies and similar technologies

Most web browsers accept cookies by default. You can usually set your browser to remove or reject cookies; if you do, some features of the Services may not work, and without the necessary cookies you will not be able to sign in. You can change your choice about analytics cookies at any time via "Cookie settings". For more information, see our Cookie Policy.

If you have questions or comments about your privacy rights, email us at janeknastaly50@gmail.com.

12. DO-NOT-TRACK AND GLOBAL PRIVACY CONTROL

Many web browsers, and some mobile operating systems and apps, offer a Do-Not-Track ("DNT") setting that signals that you do not want your online activity to be monitored and collected. There is currently no uniform technology standard for recognizing and implementing DNT signals, so we do not respond to them; California law requires us to tell you this. However, analytics cookies stay off unless you accept them, and we do not track your activity across other websites. If a standard for online tracking that we must follow is adopted in the future, we will describe how we handle it in an updated version of this Privacy Policy.

Global Privacy Control (GPC). GPC is a browser signal that asks websites not to sell your personal data or share it for targeted advertising. We do not sell personal data or share it for targeted advertising, so this signal does not change the way we process your data, and analytics cookies stay off unless you accept them. For more information about GPC, visit https://globalprivacycontrol.org.

13. ADDITIONAL INFORMATION FOR UNITED STATES RESIDENTS

In short: if you live in California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah or Virginia, you may have the right to request access to the personal data we hold about you and details of how we have processed it, to correct inaccuracies, to obtain a copy of it or to have it deleted, and to withdraw your consent to its processing. These rights may be limited in some circumstances by applicable law. This section applies to the extent that the privacy law of your state applies to our processing of your data.

Categories of personal data we collect

In the past twelve (12) months we have collected the following categories of personal data. The examples are illustrative; the full description of the data we process is in Section 1.

  • A. Identifiers (such as email address, account name, IP address and online identifiers): collected.
  • B. Personal information described in the California Customer Records statute (such as name, email address and billing address): collected; billing details are collected by our payment provider.
  • C. Protected classification characteristics under state or federal law (such as age, gender, race or national origin): not collected.
  • D. Commercial information (such as purchase history and transaction information): collected.
  • E. Biometric information (such as fingerprints or voiceprints): not collected.
  • F. Internet or other electronic network activity (such as your interactions with our website and app): collected.
  • G. Geolocation data: only an approximate location derived from your IP address is collected; no precise location.
  • H. Audio, electronic, visual or similar information: collected only in the form of images that you upload as references.
  • I. Professional or employment-related information: not collected.
  • J. Education information: not collected.
  • K. Inferences drawn from other personal data (such as a profile of your preferences and characteristics): not collected.
  • L. Sensitive personal information: collected only in the form of your account login credentials (email address and password), which we use solely to let you sign in.

We may also receive other personal data from you when you ask for help through our support channels, when you send us feedback, and when we provide the Services and respond to your enquiries.

  • Sources of personal data: see Section 1.
  • How we use personal data: see Section 2.
  • Disclosure of personal data: we disclose personal data to our service providers under written contracts (see Section 4). In the past twelve (12) months, we have disclosed personal data in categories A, B, D, F, G, H and L to service providers for business purposes. We have not sold personal data and have not shared it for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing personal data of consumers under 16. Using personal data for our own internal purposes, such as operating, securing and improving the Services, is not a sale of personal data.

Your rights

Under certain US state data protection laws, you have the rights listed below. These rights are not absolute, and in some cases we may decline a request as permitted by law. You may have the right:

  • to know whether we process your personal data;
  • to access your personal data;
  • to correct inaccuracies in your personal data;
  • to request the deletion of your personal data;
  • to obtain a copy of the personal data you have previously shared with us;
  • not to be discriminated against for exercising your rights;
  • to opt out of the processing of your personal data for targeted advertising, of its sale, and of profiling in furtherance of decisions that produce legal or similarly significant effects; we do not carry out any of these activities.

Depending on the state where you live, you may also have the right to: access the categories of personal data being processed (for example under the law of Minnesota); obtain a list of the categories of third parties to which we have disclosed personal data (for example under the laws of California, Delaware and Maryland); obtain a list of the specific third parties to which we have disclosed personal data (for example under the laws of Minnesota and Oregon); obtain a list of the third parties to which we have sold personal data (for example under the law of Connecticut; we do not sell personal data); review, understand, question and, depending on your state, correct how personal data has been profiled (for example under the laws of Connecticut and Minnesota); limit the use and disclosure of sensitive personal data (for example under the law of California); and opt out of the collection of sensitive data and of personal data collected through voice or facial recognition features (for example under the law of Florida; we do not use such features).

How to exercise your rights

To exercise these rights, contact us through our contact page, by email at janeknastaly50@gmail.com, or using the details in Section 16. You can manage analytics cookies at any time via "Cookie settings"; because we do not sell personal data, use it for targeted advertising or profile you, there is nothing else to opt out of.

Under certain US state data protection laws, you can appoint an authorized agent to make a request on your behalf. We may deny a request from an agent who does not provide proof that you have validly authorized them to act on your behalf in accordance with the applicable law.

Request verification

When we receive your request, we need to verify that you are the person whose data we hold. We use the information in your request only to verify your identity or your authority to make the request. If we cannot verify your identity from the information we already have, we may ask you for additional information, which we will use only to verify your identity and for security or fraud-prevention purposes. If you submit a request through an authorized agent, we may need additional information to verify your identity before processing the request, and the agent must provide your written and signed permission to submit the request on your behalf.

Appeals

Under certain US state data protection laws, if we decline to act on your request, you can appeal our decision by emailing us at janeknastaly50@gmail.com. We will inform you in writing of any action taken or not taken in response to your appeal, including a written explanation of the reasons for our decision. If your appeal is denied, you can submit a complaint to your state attorney general.

California "Shine the Light" law

California Civil Code Section 1798.83, known as the "Shine the Light" law, allows California residents to request from us, once a year and free of charge, information about the categories of personal data (if any) that we disclosed to third parties for their direct marketing purposes in the previous calendar year, together with the names and addresses of those third parties. We do not disclose personal data to third parties for their direct marketing purposes. If you are a California resident and would still like to make such a request, send it to us in writing using the details in Section 16.

14. ADDITIONAL INFORMATION FOR OTHER REGIONS

In short: you may have additional rights depending on the country where you live.

Australia and New Zealand

We collect and process your personal information in accordance with the obligations and conditions of Australia's Privacy Act 1988 and New Zealand's Privacy Act 2020. This Privacy Policy is intended to meet the notice requirements of both Acts, in particular regarding what personal information we collect from you, from which sources, for which purposes and who else receives it.

If you do not wish to provide the personal information needed for a particular purpose, this may affect our ability to provide the Services, in particular to:

  • offer you the products or services that you want;
  • respond to or help with your requests;
  • manage your account with us;
  • confirm your identity and protect your account.

You have the right to request access to or correction of your personal information at any time, as described in Section 17. If you believe that we are processing your personal information unlawfully, you have the right to submit a complaint about a breach of the Australian Privacy Principles to the Office of the Australian Information Commissioner (https://www.oaic.gov.au) and about a breach of New Zealand's Information Privacy Principles to the Office of the New Zealand Privacy Commissioner (https://www.privacy.org.nz).

Republic of South Africa

You have the right to request access to or correction of your personal information at any time, as described in Section 17. If you are not satisfied with the way we have handled a complaint about our processing of your personal information, you can contact the Information Regulator (South Africa). General enquiries: enquiries@inforegulator.org.za. Complaints (complete POPIA/PAIA form 5): PAIAComplaints@inforegulator.org.za and POPIAComplaints@inforegulator.org.za.

15. CHANGES TO THIS PRIVACY POLICY

In short: yes, we update this Privacy Policy when this is necessary to stay compliant with the law.

We may update this Privacy Policy from time to time. The date of the current version is shown as "Version" at the top of this page ("Last updated" also changes for editorial corrections). When we publish a new version, we show a notice in the Services the next time you open them while signed in, with a link to the new version and a summary of the changes; if we make material changes, we will also inform you in advance, for example by email. We encourage you to review this Privacy Policy regularly to stay informed about how we protect your data.

16. HOW TO CONTACT US

If you have questions or comments about this Privacy Policy, email us at janeknastaly50@gmail.com or write to us at:

Jan Nastały

Złota 17

Banino, Pomorze 80-297

Poland

We have not appointed a data protection officer, as we are not required to do so. Please send all privacy questions and requests to the contact details above.

17. HOW TO ACCESS, UPDATE OR DELETE YOUR DATA

Depending on the laws of your country or US state, you may have the right to request access to the personal data we hold about you and details of how we have processed it, to correct inaccuracies, or to have your data deleted. You may also have the right to withdraw your consent to our processing of your data. These rights may be limited in some circumstances by applicable law.

You can do much of this yourself in the app:

  • change your account details in Settings;
  • download a copy of your data in Settings, under "Data & privacy", with the "Request data export" option; we will email you a link to a ZIP file with your profile, projects, packs, asset metadata, credit history, orders and links to your files, valid for 24 hours;
  • delete your account in Settings, under "Data & privacy", with the "Delete account" option.

For any other request, use our contact page or email us at janeknastaly50@gmail.com.