Privacy Notice

1. Controller

The data controller responsible for the processing of your personal data is:

2. Categories of Personal Data & Purposes

We process the following categories of data:

• Account data (email address, authentication identifiers from Google sign-in) — to create and manage your account. Legal basis: Art. 6(1)(b) GDPR (contract).
• Order & access data (transaction ID, product purchased, granted access status) — to deliver the digital product. Legal basis: Art. 6(1)(b) GDPR (contract).
• Consent records (timestamped withdrawal-waiver consent) — to comply with § 356 (5) BGB and § 312f BGB. Legal basis: Art. 6(1)(c) GDPR (legal obligation).
• Support correspondence — to handle your requests. Legal basis: Art. 6(1)(b) and (f) GDPR.
• Technical logs (IP address, user agent, timestamps) — for security and fraud prevention. Legal basis: Art. 6(1)(f) GDPR (legitimate interests).

Payment data (card details, billing address, tax data) is collected and processed by Paddle as Merchant of Record — see section 4.

3. User-Uploaded Reference Content

If you upload reference images or describe real persons in your prompts, you are responsible for ensuring you have the legal right to use such material (e.g. consent of depicted persons under Art. 9 GDPR for biometric data, or copyright clearance). We do not proactively analyze upload content but reserve the right to remove content that violates these terms.

4. Data Sharing & Processors

We share personal data with the following categories of recipients, all of which act as processors or independent controllers under appropriate agreements:

• Paddle.com Market Ltd. — Merchant of Record for sales, subscription management, payments, tax compliance, and invoicing.
• Supabase Inc. — hosting of authentication, database, and backend infrastructure.
• Google LLC — authentication via Google Sign-In (only if you choose this method).
• Professional advisers (legal, accounting) where necessary.
• Authorities where required by law.

5. International Transfers

Some of our processors are located outside the EU/EEA (notably in the United States). Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (SCCs) and applicable adequacy decisions.

6. Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law (in particular tax and commercial retention obligations of up to 10 years). Account data is deleted on request or after prolonged inactivity, subject to those legal retention periods.

7. Your Rights under GDPR

You have the right to: access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, and withdrawal of consent at any time. You also have the right to lodge a complaint with a supervisory authority (in Germany: the data protection authority of your federal state). We will respond to your request within one month.

To exercise your rights, contact contact@vikkisky.com.

8. Security

We apply appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS), encryption at rest at our hosting providers, access controls, and authentication safeguards.

9. Cookies

We use only essential cookies required to operate the Service (e.g. authentication session). We do not use marketing or advertising cookies. Where we add analytics in the future, we will request your consent beforehand.