Privacy policy
1. Controller
The controller is Robin Alberty, Fuchsstraße 2, 65187 Wiesbaden, Deutschland. Email: hello@korvayne.com. No data protection officer has been appointed.
2. Data processed
We process a random session identifier, project and design details, uploaded JPEG and PNG images, optional captions, technical security data and, for an order, an email address, payment status and delivery address. We do not receive card numbers; Stripe processes payment details directly.
Use and purchase are for adults. Content may include children’s names, handwriting or photographs. The uploading adult must hold the required rights and permissions. We do not create public galleries and do not use projects for advertising or model training.
3. Purposes and legal bases
Project setup, quality review, book production, payment, printing, delivery and support are necessary to perform the contract or take requested pre-contract steps (Article 6(1)(b) GDPR). Tax and commercial records are processed to meet legal obligations (Article 6(1)(c)). Abuse prevention, logging, fraud prevention and service security rely on our legitimate interest in a safe and sustainable service (Article 6(1)(f)). Non-essential analytics or advertising services load only after consent.
4. Recipients and processors
Cloudflare supplies the web application, private object storage, database, queue and bot protection. Stripe processes payments. OpenRouter may route source content to the selected model provider for extraction; the application requests zero data retention and denied data collection. For print orders, Prodigi or the manual fulfilment operator receives the print files and delivery details needed for production. Each recipient receives only the data required for its purpose.
Where a provider processes data outside the EEA, transfers rely on an adequacy decision or appropriate safeguards such as EU Standard Contractual Clauses where required. Model processing exclusively within the EU is not promised.
5. Uploads and automated checks
Files are checked for type, size, resolution and visible quality problems. Image metadata, including location data, is removed when a source is accepted. Automated output prepares the book; customers review uncertain content and the complete print proof. No solely automated decision produces legal or similarly significant effects.
6. Retention and deletion
Unfinished projects are normally scheduled for deletion seven days after their last activity. Completed project files and downloads are normally deleted 30 days after completion. Material required for active production and delivery remains until fulfilment is complete. Incoming uploads that were not accepted are technically removed within one day.
Deleting a project removes originals, derived files, extraction data and personal project details. The anonymous session may remain until expiry or for other projects. Payment, contract and accounting evidence is retained only where and for as long as law requires; project images are not part of those records.
7. Required data, cookies and analytics
A technical session and source files are required to create a book. Purchases require an email address and print purchases require delivery details. We use only essential session and security cookies unless separate consent is given for another service. Internal funnel statistics are aggregated without filenames, image content, transcriptions, names, email addresses or project secrets.
8. Your rights
Subject to the GDPR, you may request access, correction, deletion, restriction and portability and may object to processing. Consent can be withdrawn for the future at any time. Contact hello@korvayne.com. You may also complain to the Hessian Commissioner for Data Protection and Freedom of Information, Postfach 3163, 65021 Wiesbaden, Germany, poststelle@datenschutz.hessen.de.