Privacy policy

Inkantation (“we”, “us”) is run by [COMPANY NAME], [COMPANY ADDRESS], [REGISTRATION NUMBER]. We are responsible for your personal data as described here (the “controller”). Questions about privacy: [PRIVACY EMAIL], or use our contact form.

• Account details: your email address and password (stored only in scrambled, “hashed” form), or your Google account's name and email if you sign in with Google.
• Your designs: the ideas you type, the AI-generated images, your edits and text, saved designs, and preview pictures.
• Uploaded files: images and fonts you upload to use in your designs.
• Orders: your name, shipping address, email, phone number (if given), tax number (only for Brazil), what you ordered, prices, payment status, and tracking details. We don't see or store your full card details; the payment provider handles those.
• Usage: a record of each AI action (when, which model, what it cost), used for daily limits and to prevent abuse.
• Messages: what you send us through the contact or corporate order forms.
• Technical data: information your browser sends when you visit (such as IP address and browser type), kept in our hosting provider's logs, and the bot check described below.

• To create your account, make your designs, and fulfill and deliver your orders (to perform our contract with you).
• To keep the service safe and fair: bot checks, daily limits, and preventing misuse (our legitimate interests).
• To answer your messages and help with problems (our legitimate interests, or our contract with you).
• To keep records the law requires, such as invoices and tax records (legal obligation).
• [IF ADDED LATER: marketing emails, only with your consent, which you can withdraw at any time.]

We only share what each service needs to do its job for us. They act on our behalf (as “processors”):

• Supabase — accounts, database, and private file storage (our project is hosted in [SUPABASE REGION, e.g. Frankfurt, Germany]).
• Vercel — hosts the website (our server code runs in Frankfurt, Germany).
• fal — runs the AI models. It receives the ideas you type and the images being created, changed, or enlarged.
• Printful — prints and ships your order. It receives your name, shipping address, email, phone (if given), and your print files.
• Cloudflare (Turnstile) — checks that sign-ups and sign-ins come from people, not bots.
• Google — only if you choose “Continue with Google”.
• [PAYMENT PROVIDER] — processes payments (once payments are available).

We don't sell your personal data, and we don't use it for advertising.

Some of these services are based in, or use servers in, countries outside the European Economic Area (for example the United States). When your data goes there, we rely on safeguards such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework. [LAWYER TO CONFIRM FOR EACH PROVIDER.]

We use only what the site needs to work: a sign-in cookie to keep you signed in, and storage in your browser for your cart, the design you're working on, and uploaded images. Signing out removes your current design and uploads from the browser (the cart stays). We don't use advertising or tracking cookies. The Cloudflare bot check may set its own cookie to do its job.

• Account and saved designs: until you delete them or your account.
• Order records: [NUMBER] years, as required for tax and accounting.
• Usage records and messages: [NUMBER] months/years.
• Hosting logs: as kept by our hosting provider, usually a short time.

Depending on where you live (including under the EU and UK GDPR), you can ask to see, correct, delete, or receive a copy of your data, to limit or object to how we use it, and to withdraw consent you gave. To do this, contact us or email [PRIVACY EMAIL]. You can also complain to your local data protection authority.

Inkantation is not meant for children under [16]. We don't knowingly collect data from them.

Your files are stored privately, and only you (and the services above, when needed for your order) can reach them. Passwords are never stored in readable form. No system is perfectly secure, but we work to protect your data.

If we change this policy, we'll update the date above, and tell you about important changes.