Privacy policy

Controller

Data controller: [NOMBRE], NIF [NIF], [DIRECCIÓN], [EMAIL].

What we collect

Organizers: the email or WhatsApp you type, optionally, when you lock in a kit. If you pay for everyone, the email and delivery address you give at checkout.

People who pay: name, email, sizes and, if the kit ships to each door, delivery address and country.

Crew photos: the photo you upload so the AI can draw the people in it.

Design ideas: the event name, date, place and what you write to describe the picture.

Technical data: an anonymous ID and your kit draft stored in your browser, and a guest session with no email when you lock in a kit.

Card details are collected by Stripe directly. We never see them.

Why, and on what legal basis

To make, charge, produce and ship your order and email you about it: performance of the contract (Art. 6.1.b GDPR).

To check every design before it prints and contact you if something looks off: performance of the contract.

To draw from your photo: your consent (Art. 6.1.a GDPR), given when you upload it. Only upload photos of people who agree.

To keep invoices and payment records: legal obligation (Art. 6.1.c GDPR).

To prevent abuse and keep the site secure: legitimate interest (Art. 6.1.f GDPR).

Crew photos: what happens today

The original photo stays in your browser's memory and is sent to our server only to request the drawing. Our code does not save the original photo in any database or storage. It is passed on to OpenAI's image model through Lovable AI, which handles it under its own terms.

The resulting drawing, which may show recognizable faces, is stored in private Lovable Cloud storage. Today it has no automatic deletion date. The private links to view it expire after one year.

When you lock in the kit, the drawing is sent to Replicate to enlarge it and to Printful to print it. Print files are also kept in private storage with no automatic deletion.

How long we keep each item

Today there is no automatic deletion. Kit data, payer data, drawings and print files are kept for as long as the kit exists.

You can ask us to delete your data at [EMAIL]. We do it by hand, except what the law requires us to keep.

Invoices and accounting records: the period required by law, generally 6 years (Art. 30 of the Spanish Commercial Code).

The draft and anonymous ID in your browser stay there until you clear your browser data.

Who we share data with

Stripe (payments and refunds): name, email, billing and delivery address, amount.

Printful (production and shipping): name, email, delivery address, sizes and print files.

Lovable Cloud (hosting, database, storage and sessions): all of the data above.

Lovable Emails (sending emails from notify.wooray.store): email, name and order details.

OpenAI, through Lovable AI: your design ideas and your photo, to create the drawing and pick the design set.

Replicate, with the Recraft models (vector drawings from text) and Real-ESRGAN (enlarging the final drawing).

Google Fonts: your browser downloads fonts from Google's servers, which see your IP address.

Some providers are outside the European Economic Area, mainly in the US. Transfers rely on the safeguards each provider offers, such as standard contractual clauses.

Your rights

You can ask for access, correction, deletion, objection, restriction and portability, or withdraw consent, by writing to [EMAIL]. You can also complain to the Spanish Data Protection Agency (aepd.es).