Privacy Policy

1. Data We Collect

Account & email — your email address, collected via Google sign-in or a one-time sign-in link we send through our email provider (Resend). We use it to authenticate you and to send purchase receipts.

Payment data — when you buy a paid tier, payment is handled entirely by the processor you choose at checkout: Stripe, PayPal, or NOWPayments (cryptocurrency). We never receive or store your full card number; we only receive confirmation that payment succeeded and the minimal billing metadata needed to fulfil your order. Review their policies: Stripe Privacy Policy (stripe.com/privacy), PayPal Privacy Policy (paypal.com/privacy), NOWPayments Privacy Policy (nowpayments.io/privacy-policy).

IP address — logged for anti-abuse purposes: rate-limiting the claim flow (including our bot-protection widget) and identifying anonymous submitters on the content-report system.

Uploaded images — images you attach to a claimed body are stored with our cloud storage provider (Cloudflare R2) and passed through an automated moderation check before being shown publicly.

Analytics — we use Google Analytics (GA4/GTM) only after you explicitly accept analytics cookies via the cookie banner. If you reject or dismiss the banner without accepting, no analytics data is collected about you. See "Cookies" below.

2. Cookies & Local Storage

We use a small amount of strictly necessary local storage (e.g., to remember your cookie-consent choice and your signed-in session) that does not require consent under applicable law.

Analytics cookies (Google Analytics / Google Tag Manager) are only set after you click "Accept all" in the cookie banner. You can withdraw consent at any time by clearing this site's local storage in your browser, which will show the banner again on your next visit.

3. Legal Basis for Processing (GDPR)

Performance of a contract — to create your account, deliver a claimed body, and process payment.

Legitimate interest — to prevent abuse and fraud (IP-based rate limiting, moderation) and to keep the Service secure.

Consent — for analytics cookies (GA4/GTM), which you can grant or withhold via the cookie banner at any time.

4. Who We Share Data With

We share data only with the service providers ("processors") needed to run Cosmic Canvas: Resend (transactional email), Cloudflare (image storage and infrastructure), Stripe / PayPal / NOWPayments (payment processing, at your choice), and Google (Analytics/Tag Manager, only with your consent).

We do not sell your personal data.

5. International Transfers

Some of our processors may process data outside your country of residence, including in the United States. Where required, we and they rely on recognized safeguards such as Standard Contractual Clauses.

6. Data Retention

We keep your account and purchase data for as long as your account or claimed body exists, and as needed to meet tax and accounting obligations. IP addresses logged for anti-abuse purposes are kept only for a limited window before being purged. Uploaded images are kept for as long as the associated body's content remains published (i.e., is not hidden by moderation or you don't request deletion).

7. Your Rights

If you're in the EU/EEA, UK, or a jurisdiction with similar protections, you generally have the right to: access the personal data we hold about you; correct inaccurate data; request erasure; restrict or object to processing; receive a portable copy of your data; and withdraw consent (for analytics) at any time without affecting past processing.

Erasing your personal data does not necessarily remove the neutralized coordinate record associated with a body you created. We can remove the personally identifying link between your account and that record (for example, anonymize the creator display) on request, subject to our legitimate need to retain payment and anti-fraud records.

You also have the right to lodge a complaint with your local data protection supervisory authority.

8. Children

The Service is not directed at children under 16, and we do not knowingly collect personal data from them.

9. Security

We use industry-standard safeguards — encryption in transit, access controls on our infrastructure and processors — to protect your data. No system is 100% secure, and we cannot guarantee absolute security.

10. Changes to This Policy

We may update this Privacy Policy from time to time; material changes will be reflected by an updated "Last updated" date above.

11. Contact / Data Controller

The data controller is SOROKDVA LABS (SIREN 830 976 262), France. Privacy questions or requests: cosmiccanvas@sorokdva.eu. No separate Data Protection Officer is appointed; requests are handled directly by the operator.