Privacy Policy

• Account information such as name, email address, and password.
• Order and payment details processed securely via trusted payment providers.
• Usage data and analytics to improve performance and user experience.
• Cookies and similar technologies. See our Cookie Policy for details.

• To provide, maintain, and improve our services.
• To process transactions and fulfill orders.
• To communicate with you regarding your account, orders, and updates.
• To enhance security, prevent fraud, and comply with legal obligations.

We retain personal data only for as long as necessary to provide our services and comply with legal requirements. When data is no longer needed, we securely delete or anonymize it.

We do not sell your personal information. We may share information with service providers (e.g., payment processors) strictly for operational purposes and only under appropriate safeguards.

If you opt in, we show your approximate location on a public community map. We only use the city from your saved address — never your street or exact position. Your pin is placed at the centre of that city and shared with everyone from the same city, so the map reveals only your city, never where you live. Your public nickname is shown and, if you have made gallery photos public, the map can link to them. The legal basis is your consent (Art. 6(1)(a) GDPR); it is off by default and you can withdraw it at any time in your account settings, which removes you from the map. To render the map we rely on two services operated by the OpenStreetMap Foundation in the United Kingdom: Nominatim (to turn a city and country name into coordinates) and OpenStreetMap map tiles (to draw the map). Both are within the EU/UK adequacy area, so your data is not transferred to any third country such as the United States.

Depending on your location, you may have rights to access, correct, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, contact us via the details on our About page.

We process your personal data based on the following legal bases under Article 6 of the GDPR: (a) Performance of a contract – processing data necessary for order fulfillment, delivery of digital content, and customer service. (b) Legitimate interest – website usage analysis, security, and fraud prevention. (c) Legal obligation – retention of billing data as required by accounting and tax legislation. (d) Consent – sending marketing emails and using analytics and marketing cookies (consent can be withdrawn at any time).

To provide our services, we use the following data processors: Stripe, Inc. (payment services, USA/EU) – credit card payment processing; DigitalOcean, LLC (USA) – hosting and data storage; WebSupport, s.r.o. (Slovak Republic) – domain and email services. All processors are bound by data processing agreements in accordance with Article 28 of the GDPR.

Some of our processors (Stripe, DigitalOcean) are based in the United States of America. Transfers of personal data to the USA are safeguarded under the EU-US Data Privacy Framework, EU Standard Contractual Clauses, or other appropriate safeguards under Chapter V of the GDPR. You have the right to request a copy of the appropriate safeguards by contacting us via the email address on our About page.

The supervisory authority for personal data protection in the Slovak Republic is the Office for Personal Data Protection of the Slovak Republic (ÚOOÚ SR), Hraničná 12, 820 07 Bratislava 27, Slovak Republic, phone: +421 2 3231 3214, email: statny.dozor@pdp.gov.sk, web: https://dataprotection.gov.sk. You have the right to lodge a complaint with the supervisory authority if you believe that the processing of your personal data violates the GDPR.

We retain personal data for the following periods: Account data – for the duration of the account and 30 days after deletion. Billing data and orders – 10 years from invoice issuance (legal obligation under accounting legislation). Customer support tickets – 3 years from ticket closure. Marketing consents – until consent is withdrawn. Analytics data – 26 months. After the retention period expires, data is securely deleted or anonymized.

Given the scope and nature of our data processing, appointing a Data Protection Officer (DPO) is not mandatory. For any questions regarding personal data protection, please contact us via the email address on our About page.

We may update this Privacy Policy from time to time. We will post any changes on this page and update the "Last updated" date above.

If you have questions about this Privacy Policy, please reach out via the contact details on our About page.