Privacy Notice

1. Controller

The data controller responsible for the processing of your personal data is:

2. Categories of Personal Data & Purposes

We process the following categories of data:

• Account data (email address, authentication identifiers from Google sign-in) — to create and manage your account. Legal basis: Art. 6(1)(b) GDPR (contract).
• Order & access data (transaction ID, product purchased, granted access status) — to deliver the digital product. Legal basis: Art. 6(1)(b) GDPR (contract).
• Consent records (timestamped withdrawal-waiver consent) — to comply with § 356 (5) BGB and § 312f BGB. Legal basis: Art. 6(1)(c) GDPR (legal obligation).
• Support correspondence — to handle your requests. Legal basis: Art. 6(1)(b) and (f) GDPR.
• Technical logs (IP address, user agent, timestamps) — for security and fraud prevention. Legal basis: Art. 6(1)(f) GDPR (legitimate interests).

Payment data (card details, billing address, tax data) is collected and processed by Stripe on our behalf as our payment service provider; we (Ersan Yüksel, operating as WTDM) remain the Merchant of Record. See section 4 for details.

3. User-Uploaded Reference Content

If you upload reference images or describe real persons in your prompts, you are responsible for ensuring you have the legal right to use such material (e.g. consent of depicted persons under Art. 9 GDPR for biometric data, or copyright clearance). We do not proactively analyze upload content but reserve the right to remove content that violates these terms.

4. Data Sharing & Processors

We share personal data with the following categories of recipients, all of which act as processors or independent controllers under appropriate agreements:

• Stripe Payments Europe Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland) — payment service provider for card processing, fraud screening, and transaction handling. We act as the Merchant of Record; Stripe acts as our processor.
• Supabase Inc. — hosting of authentication, database, and backend infrastructure.
• Resend — delivery of transactional emails (order confirmations, document delivery, and account notifications). Resend receives your email address and the content of those messages.
• Cloudflare, Inc. (hosting & CDN) — the website and application run on Cloudflare’s edge network, which delivers our content and provides security and DDoS protection. Cloudflare processes connection data such as IP address, browser identification, and request metadata.
• Google LLC — authentication via Google Sign-In (only if you choose this method).
• Professional advisers (legal, accounting) where necessary.
• Authorities where required by law.

5. International Transfers

Some of our processors are located outside the EU/EEA (notably in the United States). Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (SCCs) and applicable adequacy decisions.

6. Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law (in particular tax and commercial retention obligations of up to 10 years). Account data is deleted on request or after prolonged inactivity, subject to those legal retention periods.

7. Your Rights under GDPR

You have the right to: access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, and withdrawal of consent at any time. You also have the right to lodge a complaint with a supervisory authority (in Germany: the data protection authority of your federal state). We will respond to your request within one month.

To exercise your rights, contact support@vikkisky.com.

8. Security

We apply appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS), encryption at rest at our hosting providers, access controls, and authentication safeguards.

9. Cookies

We use only essential cookies required to operate the Service (e.g. authentication session). We do not use marketing or advertising cookies. Where we add analytics in the future, we will request your consent beforehand.

10. Notice for United States Residents (CCPA/CPRA and similar state privacy laws)

This section applies to residents of California and, as far as the equivalent rights exist, to residents of other U.S. states with comprehensive privacy laws (e.g. Virginia, Colorado, Connecticut, Utah, Texas, Oregon).

We do not sell or share your personal information. We do not sell personal information as defined by the CCPA/CPRA, and we do not share it for cross-context behavioural advertising. We do not use your personal information for targeted advertising or for profiling that produces legal or similarly significant effects. We therefore do not offer a “Do Not Sell or Share My Personal Information” mechanism, because there is nothing to opt out of.

Categories of personal information we collect. Identifiers (email address, account identifier, IP-derived data), commercial information (purchase and order data), internet or network activity (server and security logs), and the content you create in the Service. The purposes, sources, and recipients are described in sections 2, 3, and 4 above. We retain this information as described in section 6. We do not collect sensitive personal information for the purpose of inferring characteristics.

Your U.S. state rights. Subject to your state’s law, you may request to know or access the personal information we hold about you, request correction of inaccurate information, request deletion, obtain a portable copy, and opt out of sale/sharing or targeted advertising (not applicable here, see above). You may also designate an authorised agent to submit a request on your behalf; we may ask for proof of authorisation and verify your identity via the email address linked to your account.

Non-discrimination. We will never deny you service, charge different prices, or provide a different level of quality because you exercised a privacy right.

To exercise any of these rights, email support@vikkisky.com. We respond within the statutory deadline (generally 45 days, extendable once where permitted).