Privacy Policy

Data controller

Data controller is the operator of SpotMade (registered details to be filled after business registration). Contact: contact@spotmade.com.

Scope of processed data

• Customer email (order fulfillment, communication)
• Order data (tier, price, Stripe session id, IP and user-agent at time of consent)
• Reference photos (biometric data — GDPR Art. 9, basis: explicit consent)
• Brief, styling preset, destination
• IG / social handle (optional)
• Free sample request: company or name, email, industry, profile or website link, optional message

Legal basis

• Art. 6(1)(b) GDPR — contract performance (order, delivery, complaints)
• Art. 6(1)(c) GDPR — accounting and tax obligations (5 years, Polish accounting act)
• Art. 9(2)(a) GDPR — explicit consent for biometric data (reference photos)
• Art. 6(1)(f) GDPR — legitimate interest (moderation, abuse prevention)
• Art. 6(1)(b) GDPR — steps taken at your request before entering into a contract (preparing a free sample)

Retention period

• Reference photos: 30 days after order delivery (auto-deletion)
• Character Bible (AI model parameters): 90 days after delivery, then deleted
• Order data and accounting documents: 5 years (statutory)
• Access logs and technical logs: 12 months
• Free sample requests: 12 months from the request if no contract follows

Data recipients

Data is shared only with processors essential to service delivery: Stripe (payments), Resend (transactional email), Uploadthing (reference photo hosting), Vercel (app hosting), Supabase (database), Anthropic (the Claude model — drafts an internal reel outline from a "first reel free" or "sample" request; we share only the company name, industry, the profile provided and the message, never the email or phone number; by default Anthropic does not use this data to train its models). All processors are GDPR-compliant and bound by DPAs.

Data processing agreements (DPA) — public links

• Stripe — https://stripe.com/legal/dpa
• Resend — https://resend.com/legal/dpa
• Uploadthing — https://uploadthing.com/legal/dpa
• Vercel — https://vercel.com/legal/dpa
• Supabase — https://supabase.com/legal/dpa
• Anthropic — https://www.anthropic.com/legal/data-processing-addendum

Transfers outside the EEA

Some processors (Stripe, Resend) have US servers. Transfer occurs under Standard Contractual Clauses (SCCs of June 2021) and the EU-US Data Privacy Framework (Commission decision 2023/1795 of 10.07.2023). Providers hold DPF certification (verify at dataprivacyframework.gov). Anthropic (USA) processes data under the Standard Contractual Clauses included in its data processing addendum.

Your rights

• Right of access (contact@spotmade.com)
• Rectification
• Erasure ("right to be forgotten") — via /api/privacy/delete or email
• Restriction of processing
• Data portability (JSON export)
• Objection to processing based on legitimate interest
• Withdrawal of consent at any time (does not affect prior processing)
• Complaint to the competent data protection authority

Security

Data in transit and at rest is encrypted (TLS 1.3 in transit, AES-256 at rest via infrastructure providers). Access to customer personal data is restricted to the operator. Audit logs of administrative actions are retained.

Profiling and automated decisions

We do not use profiling or automated decision-making within the meaning of GDPR Art. 22. Brief moderation (keyword filter) is a preliminary screen only — every flagged brief is reviewed by a human operator.