Privacy & personal data

What is collected, and when?

Selecting a photo creates a preview on your device. Starting generation uploads a JPEG copy, cat/dog selection, language and request identifier, linked to your guest access identifier or your signed-in account identifier in the existing pilot. The service stores the photo, stickers, chosen revisions, pack status and technical generation records. Selecting a photo alone does not upload it. Use only pet photos you are entitled to use, without people or private information.

WhatsApp is optional

When you send the prepared delivery request in WhatsApp, Meta supplies your sending number and we link it to this pack. The number, hashed pack claim, message identifiers and delivery/read status are used for delivery and to prevent duplicates. We do not request your address book or send your number to OpenAI image generation. WhatsApp receives an introductory message and 12 separate stickers, not the original photo. This request is not marketing permission. You can download your files without choosing WhatsApp.

Purpose and legal basis

Generation, pack access, recovery and optional WhatsApp delivery fulfil the service you request (where applicable, GDPR Article 6(1)(b) and KVKK Article 5/2(c)). Access-security, free-trial and cost-abuse records enforce those limits; a legitimate-interest assessment must be completed before public use. Optional measurement is disabled for guest customers. In the existing pilot it starts only with a separate choice (GDPR Article 6(1)(a), KVKK Article 5/1). Required service information is necessary for the relevant generation/delivery step; rejecting measurement does not block the service.

Recipients

OpenAI receives the photo and generation/revision instructions to create stickers. OpenAI Sites and Cloudflare infrastructure host the guest or account link, files and application records. When background generation is enabled, Upstash QStash schedules jobs: the job content we send contains only a random job identifier, not photos, stickers, phone numbers, access cookies or recovery links. Job details stay in the application database. Stripe hosts checkout and processes payment. You enter card details on Stripe’s screen; Stikpet does not store your full card number or card security code. The application stores order/pack and access identifiers, the Stripe session identifier, amount, currency, transaction times, test/live mode and payment status. Only a checkout explicitly marked as a test should use test card details. If you choose WhatsApp, Meta/WhatsApp processes your number, sticker files, messages and delivery data. Support correspondence is received and stored through Microsoft Outlook.com. Providers handle their own account, security and operational records under their notices.

International processing

Providers may process data outside the European Economic Area, including the United States; we do not promise EU-only storage. OpenAI Sites terms apply a processing agreement to hosted personal data; the API and WhatsApp also publish processing/transfer terms. However, the relevant account parties, settings, applicable safeguards and any required KVKK standard-contract signatures/notifications have not been fully verified for Stikpet. This notice is not itself transfer authorisation or a signed standard contract. This review must be completed before public use.

Cookies and browser choices

Starting guest access creates the necessary __Host-stikpet_customer cookie to access your packs. It contains a random access key, uses Secure, HttpOnly and SameSite=Lax protections and is valid for at most 90 days. The server stores only a cryptographic hash of the key, the guest identifier and time information. This is pseudonymous, not anonymous. A pack identifier is also remembered on your device. Authentication and security infrastructure may use necessary storage separately. Deleting the cookie does not delete pack files and may cause loss of access. Optional measurement is not collected in the guest customer flow. With separate consent in the existing pilot, a random measurement session records visits, advertising source and service steps; it excludes photos, phone numbers, email and IP addresses. The pilot measurement choice lasts at most 180 days and the session 24 hours; use “Measurement preferences” to withdraw, and DNT/GPC disables measurement. Withdrawal does not recall records already sent.

Recovery link

You can choose to create a private recovery link to return to packs belonging to the same guest access from another browser. It is valid for 90 days after creation; the server stores only a cryptographic hash of its key. Creating a new link invalidates the previous one. Anyone holding the link can access these packs, so do not share it publicly. Using a valid link creates a new access cookie; it cannot restore deleted or expired files.

Daily abuse controls

To enforce free-trial and session limits, we derive a daily HMAC hash from the connection IP address, a server-held key and the UTC day. This control does not store the raw IP address in the application database; it stores a daily hash, counter and preview request record. The daily counter expires at the end of the UTC day. Preview requests are linked to the guest identifier to control repeat trials and duplicate requests. These hashes are not treated as anonymous data; infrastructure providers may retain their own technical logs.

Retention

These are chosen service periods, not statutory mandatory periods. Photos and pack files become eligible for deletion 90 days after pack creation. Delivery-linked WhatsApp numbers, records and prepared files are cleaned after 30 days without delivery/claim activity; active sending and valid delivery requests are protected. Orphan files from failed preparation without a delivery record follow the 90-day pack period. Application records for completed or failed background jobs become eligible 30 days after their last update, once no dependent job remains. Technical generation records become eligible 90 days after the event, and trial-use and free-preview admission records 180 days after the request, once the linked pack is gone. Expired access/recovery records and daily network counters are removed during cleanup; the daily network hash in a preview admission follows that record’s 180-day period. An aggregate generation-spend counter without a person link is retained. Existing pilot measurement records have a 30-day period. With customer access enabled, periodic cleanup covers guest customer records and the existing pilot account; ongoing operations, backlogs or failures defer deletion to the next safe run. A delivery claim expiring after 24 hours does not erase files; a recovery link does not extend file retention. The pre-approved test-number list is separate configuration: deleting a pack does not remove it; it is removed when the test ends. Support emails are manually reviewed and deleted within 90 days after a request is resolved; an ongoing dispute or applicable retention duty may require necessary records to be retained with a documented reason. Provider records, backups and device copies are managed separately; local deletion does not guarantee their simultaneous erasure.

Your rights

Depending on the applicable law, you can request access, correction, erasure, restriction, objection, portability and withdrawal of consent. Withdrawal does not affect earlier lawful processing. KVKK also provides rights to learn about processing/transfers, request notification of correction/deletion to recipients, challenge adverse automated-analysis results and seek compensation where applicable. We verify only what is necessary to handle a request securely. You may complain to the AEPD in Spain or your competent data-protection authority. Where KVKK applies, the controller application and subsequent Board complaint procedures are available subject to the legal conditions. Stikpet does not make automated decisions about people with legal or similarly significant effects. We respond to GDPR requests within one month; where an extension is necessary, we explain it within the first month and may extend by up to two further months. Where KVKK applies, requests are answered as soon as possible and within 30 days.

Payment records

Payment and order records are kept separately from pack files to verify transactions, prevent duplicate payment processing and handle support or disputes. Deleting a pack does not automatically delete these payment records or Stripe’s own records. The 90-day photo and file period does not apply to payment records; the application does not yet have a separate automatic deletion period for them. You can contact us about erasure or retention; requests are considered separately in light of applicable duties and necessary records.

Delete your data

Open your pack in the browser you used, or with a valid recovery link, and choose “Delete photo and pack”. Existing pilot users can also sign in to their account. A successful deletion removes the site photo, sticker/revision files, prepared WhatsApp files and linked delivery records. If deletion shows a failure, retry or contact us. Deleting a cookie is not a substitute for this action. Trial-use, generation cost, access/recovery and limited technical records are not all removed by pack deletion; the periods above apply. For broader access/deletion requests, contact us with the pack identifier or relevant WhatsApp number. Do not send passwords, recovery links, identity documents or verification codes. Delete received messages, downloads and saved stickers separately in their apps; a send already in progress may complete during deletion.

stikpet@outlook.com