Privacy Policy
In short: This policy explains what personal data Tvorya collects, why, who we share it with, how long we keep it, and the rights you have. We collect only what we need to run the Service, and we don't sell your data. The summaries like this are not the full story - please read the sections too.
This Privacy Policy explains how Tvorya ("we", "us", "our") handles personal data when you use our website and service (the "Service"). It is written to comply with the EU General Data Protection Regulation (GDPR) and the Bulgarian Personal Data Protection Act.
1. Who is responsible for your data (controller)
The controller of your personal data is ДИГИТАЛНО АТЕЛИЕ ТВОРЯ ЕООД (DIGITAL ATELIER TVORYA EOOD), a company registered in Bulgaria in the Commercial Register (Търговски регистър) under EIK 208876264, registered address ул. Стадионска 7, 6600 Кърджали (Kardzhali), Bulgaria. For any privacy question or request, contact us at privacy@tvorya.com or through the Help Center.
2. What personal data we collect
In short: Information you give us, things you create, a little technical information, and (only if you choose to upload it) photographs.
- Account information - if you create an account: your email address and authentication details. If you sign in with a third-party login (for example Google), we receive basic profile information from that provider.
- What you create and the details you enter - the event details, text, choices, and prompts you provide to generate and personalise a product, and the products ("creations") you make.
- Images you upload - for products that support it, any photographs you upload. These may include images of identifiable people, which is sensitive - see Section 9.
- Order and billing information - when you buy, we collect your email for delivery and receipts, and, if you request an invoice, the company and tax details you provide. Payment-card details are handled by our payment provider; we do not store full card numbers.
- Communications - messages you send us (for example, support requests or feedback).
- Technical and usage information - basic information your browser or device sends automatically, such as IP address, device/browser type, and how you interact with the Service. Some of this is collected through cookies - see our Cookies Policy.
3. How and why we use your data, and our legal basis
Under the GDPR we must have a lawful basis for using your data. The table below explains what we do and why.
| What we do | Why | Legal basis |
|---|---|---|
| Create and manage your account | To give you access to the Service | Performance of a contract |
| Generate and deliver your products (including sending your input to our AI provider) | To provide the Service you ask for | Performance of a contract |
| Process payments and provide invoices | To complete your purchase and meet tax/accounting duties | Contract; legal obligation |
| Provide customer support | To answer your questions and fix problems | Contract; legitimate interests (responding to people who contact us) |
| Keep the Service secure and prevent abuse or fraud | To protect you, us and others | Legitimate interests (keeping the Service secure and preventing abuse of free usage); legal obligation |
| Moderate content for safety and policy compliance | To keep the Service lawful and safe | Legitimate interests (preventing unlawful and harmful content); legal obligation |
| Improve and maintain the Service | To make Tvorya work better | Legitimate interests (maintaining and improving what we offer) |
| Keep a record of sales | To evidence what we supplied and to handle any later claim | Legitimate interests (keeping business records and defending legal claims) |
| Send you service messages (e.g. order confirmations) | To keep you informed about your use of the Service | Contract |
| Send optional marketing (if applicable) | To tell you about features and offers | Consent (you can withdraw at any time) |
| Analytics and similar technologies | To understand and improve usage | Consent (via the cookie banner) |
Where we rely on consent, you can withdraw it at any time; this does not affect processing carried out before withdrawal.
Do you have to provide this data? An email address is required to create an account and to buy, because it identifies you and it is how your purchase reaches you. Photographs are required only for the products that are made from one. Without them we cannot provide that part of the Service.
Automated checks. Content submitted to the Service is checked automatically, and a request may be blocked if it is flagged. These checks do not produce decisions with legal or similarly significant effects for you. If you think something was blocked in error, contact us through the Help Center.
4. Using your data to improve AI
We do not use the photographs you upload to train AI models. If we ever wish to use any of your content to improve AI features, we will only do so where we have a lawful basis, and we will give you clear information and controls first.
5. Who we share your data with
In short: Only the service providers we need to run Tvorya, and only for that purpose. We don't sell your data.
We share personal data with trusted third-party providers ("processors") who help us run the Service, under contracts that require them to protect your data and use it only on our instructions. Our main processors are:
| Provider | Purpose |
|---|---|
| OpenAI | AI image and text generation; content moderation |
| Supabase | Database, authentication and storage |
| Cloudflare | File storage and delivery (R2); content delivery, security, DDoS protection, and human/bot verification (Turnstile) |
| Stripe | Processing payments and preventing payment fraud |
| Brevo | Sending service and delivery emails |
| Serving the web fonts used by the design editor, which means your IP address is sent to Google while the editor is open | |
| Hosting providers (Vercel, Railway) | Running the website and backend |
We may also disclose personal data where required by law, to enforce our terms, to prevent fraud or harm, or in connection with a business sale or reorganisation (in which case we will notify you).
6. Sending data outside the EEA
Some of our providers are located outside the European Economic Area (for example, in the United States). Where personal data is transferred outside the EEA, we rely on appropriate safeguards - such as the European Commission's Standard Contractual Clauses or an adequacy decision - to make sure your data stays protected.
7. How long we keep your data
We keep personal data only as long as we need it for the purposes described here. In particular:
- Account data - for as long as your account exists. If you delete your account, your data is erased immediately, apart from the order records below.
- Creations you have not bought - 30 days after you last worked on them. If you are not signed in, 24 hours.
- Creations you have bought, and the files you export - 12 months.
- Uploaded photographs - not kept. We send the photo to our AI provider to create your design; we do not store it on our systems.
- Order records - we keep these as our record of what we supplied and in case of a later claim about a purchase. When you delete your account we remove your personal details from them, and 5 years after the sale they hold nothing that identifies you.
8. Your rights
In short: You can ask to see, correct, delete, or limit how we use your data, object to certain uses, and get a copy of it. Email privacy@tvorya.com.
Under the GDPR you have the right to:
- access the personal data we hold about you;
- rectify inaccurate data;
- erase your data ("right to be forgotten"), where applicable;
- restrict or object to certain processing;
- data portability - receive a copy in a structured, machine-readable format;
- withdraw consent at any time, where we rely on it.
To exercise any of these, contact privacy@tvorya.com. You also have the right to complain to the Bulgarian Commission for Personal Data Protection (CPDP / КЗЛД) or your local data-protection authority.
9. Photographs of people (sensitive data)
Some products let you upload photographs, which may show identifiable people - and potentially could include children. We treat these images with particular care: we use them only to generate and deliver your product, we send them to our AI provider only for that purpose, and we do not store them on our systems. You are responsible for having the right and consent to upload any image of a person - see our AI Terms and Acceptable Use Policy.
10. Children
The Service is not directed at children, and we do not knowingly collect personal data from children under 14. If you believe a child has provided us with personal data, please contact us and we will delete it.
11. Cookies
We use cookies and similar technologies as described in our Cookies Policy. Non-essential cookies (such as analytics) are used only with your consent.
12. How we protect your data
We use appropriate technical and organisational measures to protect your data - see our Security page. No system is perfectly secure, but we work to keep your information safe.
13. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you.
14. Contact
For any privacy question or to exercise your rights, email privacy@tvorya.com or reach us through the Help Center.