Privacy Policy
In short:
- We collect only what the Service needs: your email, your saved patterns and, if you subscribe, billing records.
- We do not sell data, show ads or use tracking or analytics cookies.
- Card payments are handled by Stripe. We never see your card number.
- You can ask for a copy of your data or have it deleted at any time.
1Who is responsible
The controller of your personal data under the EU General Data Protection Regulation (GDPR) is:
David ZacekCompany ID (IČO): 17396557
Prusanecka 479/2, 155 21 Prague, Czech Republic
Email: [email protected]
Write to this address with any question about your data. We have not appointed a data protection officer, as the law does not require one for a service of this kind.
2What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Email address and password (stored only as a secure hash) | Creating and signing in to your account, sending confirmation and password-reset emails, and essential notices about the Service | Contract, Art. 6(1)(b) |
| Saved patterns: names, measurements, block settings, edits and grading rules | Saving your work and loading it again | Contract, Art. 6(1)(b) |
| Plan and subscription details: Stripe customer and subscription IDs, status, renewal date | Switching Pro on and off and managing your subscription | Contract, Art. 6(1)(b) |
| Billing records: name, billing address, amounts, invoices (held by Stripe and in our accounts) | Taking payment and keeping accounting and tax records | Contract and legal obligation, Art. 6(1)(b) and (c) |
| Technical logs: IP address, browser type, time of request | Delivering pages, keeping the Service secure and fixing errors | Legitimate interest, Art. 6(1)(f) |
| Anonymous usage statistics: which page or pattern was opened and which features were used (editor, exports, the Pro offer, lessons), counted with a hash of the IP address and browser that changes every day. The IP address itself is not stored and nothing is saved in your browser. | Seeing which features are used and where the Service is hard to use, so we can improve it | Legitimate interest, Art. 6(1)(f) |
| Messages you send us | Answering you and handling complaints or withdrawals | Contract and legitimate interest |
Giving us your email is needed to have an account. Everything else in the studio works without an account, and nothing you draft leaves your browser until you press Save.
3Measurements of other people
If you enter measurements of your clients or other people, you decide why and how that data is used, so you are its controller and we process it on your behalf, only to store and show it to you. Please make sure you may use it, and prefer client codes to full names in pattern titles. Body measurements are not health data, but treat them with care.
4Cookies and local storage
We use no advertising, analytics or tracking cookies, so we do not ask for cookie consent. The studio stores the following in your browser’s local storage, which is strictly necessary for the features you use:
- your current drafting settings, so they are still there when you return;
- your sign-in session (set by Supabase), so you stay signed in;
- which saved pattern is open.
You can clear these at any time in your browser settings. Doing so signs you out and resets the unsaved draft.
5Who processes data for us
We use a few trusted providers who process data only on our instructions and under data processing agreements:
| Provider | Role | Location |
|---|---|---|
| Supabase Inc. | Accounts, sign-in emails and the database of saved patterns | EU (Frankfurt, Germany) |
| Stripe Payments Europe Ltd. | Payments, subscriptions, invoices and the customer portal | Ireland, with some processing in the USA |
| Cloudflare, Inc. | Hosting and delivery of the website, protection against attacks, and cookie-free visit statistics (Cloudflare Web Analytics) | Global network, incl. the USA |
| Google Ireland Ltd. (Google Fonts) | Delivering the typefaces; your browser sends your IP address to Google | EU and the USA |
Where data goes to the USA, it is protected by the EU–U.S. Data Privacy Framework, under which these providers are certified, or by the European Commission’s standard contractual clauses. Stripe is also an independent controller for the data it needs for fraud prevention and its own legal duties; see stripe.com/privacy.
We also share data with our accountant and with public authorities when the law requires it. We never sell or rent personal data.
6How long we keep it
- Account and saved patterns: while you have an account. When you delete the account, we erase them within 30 days, and from backups within a further 30 days.
- Invoices and accounting records: 10 years after the end of the tax year, as Czech tax and VAT law requires.
- Technical logs: up to 30 days, unless needed to deal with a specific security incident.
- Usage statistics: 13 months, then deleted automatically.
- Correspondence: up to 3 years after a matter is closed, the limitation period for claims.
7Your rights
You have the right to:
- get a copy of your personal data and information about how we use it;
- correct inaccurate data;
- have your data erased, unless we must keep it by law;
- restrict processing in certain cases;
- receive the data you gave us in a machine-readable format (your patterns can also be exported as project files);
- object to processing based on legitimate interest;
- lodge a complaint with a supervisory authority.
To use a right, email [email protected] from the address on your account. We reply within one month. It is free of charge.
The Czech supervisory authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz. You may also complain to the authority in the EU country where you live or work.
8Security
All traffic is encrypted (HTTPS). Passwords are stored only as hashes. Database rules ensure each account can read and change only its own patterns. Access to our systems is limited to the people who run the Service. If a breach affecting your data occurs, we will tell the authority and, where the law requires, you.
9Children
The Service is not intended for children under 16, and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.
10Automated decisions
We make no decisions about you based solely on automated processing, and we do not profile users.
11Changes to this policy
We will update this policy when our services or the law change. Significant changes will be announced by email or in the studio before they take effect. The date at the top shows the current version.