Privacy Policy

1. Controller

1.1. The controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 (“GDPR”) is the operator of slp.gallery under the SLP — Sorted Labeled Prompts brand, established in Ukraine (the “Controller”, “we”).

1.2. All requests concerning data protection shall be addressed to support@slp.gallery. Full identification of the Controller is provided on written request to that address.

2. Categories of personal data processed

• Identification data — the email address provided at checkout and used for authentication.
• Contract data — the record associating that email address with the packs purchased.
• Authentication data — single-use sign-in tokens transmitted by email and a session token stored in the browser.
• Usage data — pages accessed, interactions, approximate country derived from IP address, device and browser characteristics. Processed only where consent to analytics has been given.
• Correspondence — the content of enquiries sent to the Controller.

Payment-card data is not received, processed or stored by the Controller. Session recording, keystroke capture and profiling for advertising purposes are not performed.

3. Purposes and legal bases

• Performance of the contract — provision of access to purchased packs and transmission of sign-in links. Article 6(1)(b) GDPR.
• Legitimate interests — security of the service, prevention of unauthorised access and abuse of licences. Article 6(1)(f) GDPR.
• Consent — analytics and any non-essential storage. Article 6(1)(a) GDPR, in conjunction with the applicable national implementation of Directive 2002/58/EC. Consent may be withdrawn at any time with effect for the future.
• Compliance with legal obligations — retention of transaction records where required by accounting or tax law. Article 6(1)(c) GDPR.

4. Payment transactions

Purchases are concluded with Creem acting as Merchant of Record. Creem determines the purposes and means of processing the payment data it collects and acts as an independent controller in that respect, pursuant to its privacy policy. The Controller receives only the purchaser’s email address and the identifier of the pack purchased.

5. Recipients and processors

Personal data is disclosed only to the following service providers, each engaged under a data-processing agreement or acting as an independent controller where indicated:

• Creem — payments, invoicing and VAT as Merchant of Record — the seller of record for your purchase (privacy policy)
• Cloudflare — website hosting, and the storage that records which packs an email owns (privacy policy)
• Resend — sending sign-in links and purchase confirmations (privacy policy)
• Cloudinary — hosting and delivering the images you see (privacy policy)
• PostHog — product analytics (United States) — loaded only if you accept analytics (privacy policy)
• Telegram — if you buy through our Telegram bot, the purchase is processed by Telegram (privacy policy)

Personal data is not sold, rented or otherwise transferred for advertising or third-party marketing purposes.

6. Retention

• Contract and identification data: as long as your access is active, plus 3 years.
• Usage data: 12 months.
• Correspondence: 2 years.
• Record of consent: 12 months.

Data is erased or anonymised upon expiry of the applicable period, unless further retention is required by law.

7. Rights of the data subject

7.1. Subject to the conditions laid down in the GDPR, the data subject has the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), as well as the right to withdraw consent at any time (Art. 7(3)) without affecting the lawfulness of processing carried out before withdrawal.

7.2. Requests shall be submitted to support@slp.gallery and will be answered within one month in accordance with Article 12(3) GDPR.

7.3. Erasure of identification and contract data necessarily terminates access to purchased packs; data subjects are advised to export their packs beforehand. Transaction records held by Creem are retained under its own statutory obligations.

8. International transfers

The Controller is established in Ukraine. Certain processors are located in the European Union and the United States, so personal data may be transferred outside the data subject’s jurisdiction. Such transfers are carried out on the basis of appropriate safeguards within the meaning of Article 46 GDPR, in particular the Standard Contractual Clauses adopted by the European Commission, or on the basis of an adequacy decision where applicable.

9. Security

Technical and organisational measures appropriate to the risk are implemented pursuant to Article 32 GDPR, including transport encryption, cryptographically signed authentication tokens of limited validity and restricted administrative access.

10. Automated decision-making

No automated decision-making or profiling producing legal effects within the meaning of Article 22 GDPR is carried out.

11. Minors

The service is not directed at persons under 18 years of age and no data is knowingly collected from them.

12. Amendments

This policy may be amended to reflect changes in the service or in applicable law. The version in force is the one published on this page, identified by the date shown above.

13. Right to lodge a complaint

Without prejudice to any other remedy, data subjects have the right to lodge a complaint with the supervisory authority of their habitual residence, place of work or place of the alleged infringement (Article 77 GDPR). Enquiries may also be addressed to the Controller at support@slp.gallery.