Privacy

Who processes your data

The controller is Webskill s. r. o., Haburská 16, 821 01 Bratislava, Slovenská republika, operating the Fotelier service at fotelier.sk.

For any privacy matter, reach us at atelier@fotelier.sk. We reply within 30 days at the latest.

What data we process

The photos you upload and the portraits we create from them. These are personal data of the people in the photos, including children.

Your e-mail address — used for signing in and for updates about your session.

Order data: the package chosen, the amount, the date and a payment identifier. Your card number never reaches us; it is handled solely by the payment gateway.

Basic technical data about your use of the site (such as device type), needed to run and secure the service.

Purpose and legal basis

Creating portraits and delivering results — performance of the contract you enter into by ordering.

Processing photos of children — your explicit consent, given as their legal guardian at upload. You may withdraw it at any time and we will erase the data without delay.

Accounting and handling complaints — compliance with our legal obligations.

Securing the service against abuse — our legitimate interest.

How long we keep data

Original uploaded photos are deleted automatically within 30 days.

Created portraits are kept for 90 days from the last activity in a session so you have time to download them. We send a warning seven days before deletion.

Accounting records for orders are kept for the period required by law (10 years). These records contain no photos.

Everything else is deleted as soon as the purpose it served has ended.

We never train AI on your photos

We do not use your photos to train or improve artificial intelligence models, and we do not provide them to anyone for that purpose. They serve solely to create the portraits you ordered.

We do not publish your photos or use them in marketing unless you give us separate, voluntary consent.

Who we share data with

We work with suppliers who provide parts of the service and act solely on our instructions:

Database, storage and sign-in — Supabase, with its data centre in Germany (EU).

AI portrait generation — fal.ai. Photos are processed only for as long as needed to create the result, and the provider may not use them for its own purposes or for training models. Where this processing involves a transfer outside the European Economic Area, it is covered by standard contractual clauses approved by the European Commission.

Payments — Stripe Payments Europe, Ltd. (Ireland).

E-mail delivery — Resend, delivered from European infrastructure.

Website hosting — Vercel, hosted in Frankfurt (EU).

Analytics — PostHog, on European servers. It runs only if you consented; photos and e-mail are never sent to it.

Error monitoring — Sentry. It records technical crash details, not the content of your photos.

We do not sell your data and do not provide it to anyone for marketing.

How we protect your data

Photos are stored in private storage that no unauthorised party can reach. They are served only through short-lived links tied to your sign-in.

At the database level, each account can reach only its own records.

Traffic between your device and our servers is always encrypted.

Your rights

You have the right to access your data, to rectification, erasure, restriction of processing, data portability, and the right to object.

You can delete all your data including your account yourself at any time — one click in the Account section. Deletion is immediate and irreversible.

You can also download a complete export of your data in a machine-readable format in the Account section.

For any request, write to atelier@fotelier.sk.

If you believe we handle your data improperly, you may lodge a complaint with the Slovak Data Protection Authority, Hraničná 12, 820 07 Bratislava.

Changes to this document

If the way we process data changes, we update this page and the date shown above. For material changes we notify you by e-mail.