Privacy Policy

1. Who processes the data

The controller of personal data is the online service dekorcakes.com. Questions about data: [email protected].

2. What data we collect

• Account: email, name, business name (optional), user type, profile photo (optional), language and units of measurement. The password is stored only as a hash.
• Your content: cake photos, your own pictures, cut-out and generated elements and their versions, descriptions and lettering, print layouts, cake designs, the library, exported PDF/PNG/JPG files.
• Client link: if you share a layout, the client can leave a name, a comment and the decision “Approve” or “Changes needed”.
• Usage records: plan, AI images used, number of exports, storage used, notifications.
• Technical data: sign-in cookies, service usage events (for example “project created”, “export”), error logs.
• Messages from the “Contacts” form: name, email and text — so we can reply to you. A copy arrives in our mailbox (Gmail, Google). To protect against spam we keep only an irreversible fingerprint of the IP address, not the address itself.

3. Why

• to provide the service: store projects, cut out, process and print elements;
• to count plan limits and payment;
• to show a layout to a client through your link;
• to send service emails (email confirmation, password reset);
• to improve the service from anonymised usage statistics.

We do not sell data and do not show advertising. Your photos are not used to train our models.

4. Who else receives data

• Oracle Cloud — the cloud server that runs our database, sign-in and file storage (open-source Supabase deployed by us; region: Germany, Frankfurt (EU)).
• OpenAI (USA) and Google Gemini (USA) — only when you start an AI action yourself (“Redraw”, “Create pictures”, “Replace area”): the provider receives the needed photo or description and returns a picture. We use paid APIs whose data, under the providers’ terms, is not used to train their models.
• Cutting out, “Remove background”, “Enhance”, lettering and export run on our server, without third-party AI services.
• The payment service (WayForPay) — when you pay for a plan or a top-up; card details are entered on the WayForPay page, and we neither receive nor store them.

Data is transferred to the USA under these providers’ data processing agreements and standard contractual clauses.

5. Access to your files

• Only you (and the members of your workspace, if any) see your projects and files.
• A client link opens only a low-resolution layout with a watermark; you can revoke it at any time.
• Files are served through temporary signed links.

6. How long we keep it

• The visit log — 90 days, then the records are deleted automatically.
• The account and projects — until you delete them or ask us to delete the account.
• Exported files older than 30 days are deleted automatically (the layout stays).
• A deleted project is deleted together with its files.
• Payment records — as long as tax law requires.
• Messages from the “Contacts” form — as long as we need them to reply; we delete them earlier at your request.

7. Your rights

Under the Law of Ukraine “On Personal Data Protection” and, where applicable, the GDPR, you can: find out what data is stored; correct it in your profile; delete any project yourself; on request, get a copy of your data and files or delete the whole account with all its data; withdraw consent; and complain to the Ukrainian Parliament Commissioner for Human Rights. Send requests to [email protected] — we will reply within 30 days.

8. Photos of people and children

By uploading a photo that shows people (including children) you confirm that you have the right to use it. Do not upload unnecessary personal data; if needed, crop the photo to the cake itself.

9. Security

Access to data is limited by database-level rules, connections are encrypted and secret keys are kept only on the server. No protection is absolute; we will tell you about incidents that concern your data without undue delay.

10. Changes

We will tell you about significant changes to this policy in the service or by email. The current version is always on this page.