Privacy Policy

In short: This policy explains what personal data Tvorya collects, why, who we share it with, how long we keep it, and the rights you have. We collect only what we need to run the Service, and we don't sell your data. The summaries like this are not the full story - please read the sections too.

This Privacy Policy explains how Tvorya ("we", "us", "our") handles personal data when you use our website and service (the "Service"). It is written to comply with the EU General Data Protection Regulation (GDPR) and the Bulgarian Personal Data Protection Act.

1. Who is responsible for your data (controller)

The controller of your personal data is ДИГИТАЛНО АТЕЛИЕ ТВОРЯ ЕООД (DIGITAL ATELIER TVORYA EOOD), a company registered in Bulgaria in the Commercial Register (Търговски регистър) under EIK 208876264, registered address ул. Стадионска 7, 6600 Кърджали (Kardzhali), Bulgaria. For any privacy question or request, contact us at privacy@tvorya.com or through the Help Center.

2. What personal data we collect

In short: Information you give us, things you create, a little technical information, and (only if you choose to upload it) photographs.

• Account information - if you create an account: your email address and authentication details. If you sign in with a third-party login (for example Google), we receive basic profile information from that provider.
• What you create and the details you enter - the event details, text, choices, and prompts you provide to generate and personalise a product, and the products ("creations") you make.
• Images you upload - for products that support it, any photographs you upload. These may include images of identifiable people, which is sensitive - see Section 9.
• Order and billing information - when you buy, we collect your email for delivery and receipts, and, if you request an invoice, the company and tax details you provide. Payment-card details are handled by our payment provider; we do not store full card numbers.
• An order we make for you - if you order a finished piece from us: your phone number and, if you give them, your name and email; what you want and your description; whether you allow us to show the finished piece; and our notes on the order. If you order a printed piece: the recipient's name and phone number, the address or courier office to deliver it to, the courier you prefer, and our delivery notes. If the parcel is for someone else, these are their details, and we use them only to deliver it to them. Our conversation with you and the photos you send us are in Viber (see Sections 5, 7 and 9).
• Communications - messages you send us (for example, support requests or feedback).
• Technical and usage information - basic information your browser or device sends automatically, such as IP address, device/browser type, and how you interact with the Service. Some of this is collected through cookies - see our Cookies Policy.

3. How and why we use your data, and our legal basis

Under the GDPR we must have a lawful basis for using your data. The table below explains what we do and why.

Where we rely on consent, you can withdraw it at any time; this does not affect processing carried out before withdrawal.

Do you have to provide this data? An email address is required to create an account and to buy, because it identifies you and it is how your purchase reaches you. Photographs are required only for the products that are made from one. Without them we cannot provide that part of the Service.

Automated checks. Content submitted to the Service is checked automatically, and a request may be blocked if it is flagged. These checks do not produce decisions with legal or similarly significant effects for you. If you think something was blocked in error, contact us through the Help Center.

4. Using your data to improve AI

We do not use the photographs you upload to train AI models. If we ever wish to use any of your content to improve AI features, we will only do so where we have a lawful basis, and we will give you clear information and controls first.

5. Who we share your data with

In short: Only the service providers we need to run Tvorya, and only for that purpose. We don't sell your data.

We share personal data with trusted third-party providers ("processors") who help us run the Service, under contracts that require them to protect your data and use it only on our instructions. Our main processors are:

When you order a piece from us, we talk with you in Viber, which also carries the photos you send us. Viber handles that conversation under its own terms and privacy policy.

If you accept marketing cookies on the pages our ads link to, the Meta Pixel sends Meta Platforms Ireland Ltd. the page you opened, technical data from your browser (such as IP address and browser type), its cookie identifiers, and whether you sent the form or pressed the Viber button. For collecting and sending this data, we and Meta are joint controllers and have an agreement setting out who is responsible for what: we inform you about this processing, and Meta enables your rights over the data it stores after receiving it. How Meta processes your data, on what basis, and how to exercise your rights with Meta is described in its privacy policy. You can exercise your rights with us or with Meta. Meta may transfer the data to the United States under the EU-US Data Privacy Framework.

When you order a printed piece, we send the finished design to a print studio, which prints it on our instructions. We give the recipient's name, phone number and the delivery address to the courier company that delivers the parcel and collects the cash on delivery; it also handles them under its own terms.

We may also disclose personal data where required by law, to enforce our terms, to prevent fraud or harm, or in connection with a business sale or reorganisation (in which case we will notify you).

6. Sending data outside the EEA

Some of our providers are located outside the European Economic Area (for example, in the United States). Where personal data is transferred outside the EEA, we rely on appropriate safeguards - such as the European Commission's Standard Contractual Clauses or an adequacy decision - to make sure your data stays protected.

7. How long we keep your data

We keep personal data only as long as we need it for the purposes described here. In particular:

• Account data - for as long as your account exists. If you delete your account, your data is erased immediately, apart from the order records below.
• Creations you have not bought - 30 days after you last worked on them. If you are not signed in, 24 hours.
• Creations you have bought - 12 months.
• The files you export - 90 days. While your creation is kept, you can export it again at any time.
• Uploaded photographs - not kept. We send the photo to our AI provider to create your design; we do not store it on our systems.
• An order we make for you - if we never start work on it, 30 days after we receive it. If the conversation stops, we close it after 30 days with no change and delete it 7 days after closing. Once we have delivered it, we keep it for 12 months. Its delivery details, designs and files are deleted with it, and the sale stays in the order records below, without your personal details.
• Our Viber conversation and the photos in it - deleted when you ask, and otherwise once we no longer need them for your order.
• Complaints about a printed piece - recorded in the complaints register the law requires, and kept for 5 years from the complaint.
• Order records - we keep these as our record of what we supplied and in case of a later claim about a purchase. When you delete your account we remove your personal details from them, and 5 years after the sale they hold nothing that identifies you.

8. Your rights

In short: You can ask to see, correct, delete, or limit how we use your data, object to certain uses, and get a copy of it. Email privacy@tvorya.com.

Under the GDPR you have the right to:

• access the personal data we hold about you;
• rectify inaccurate data;
• erase your data ("right to be forgotten"), where applicable;
• restrict or object to certain processing;
• data portability - receive a copy in a structured, machine-readable format;
• withdraw consent at any time, where we rely on it.

To exercise any of these, contact privacy@tvorya.com. You also have the right to complain to the Bulgarian Commission for Personal Data Protection (CPDP / КЗЛД) or your local data-protection authority.

9. Photographs of people (sensitive data)

Some products let you upload photographs, which may show identifiable people - and potentially could include children. We treat these images with particular care: we use them only to generate and deliver your product, we send them to our AI provider only for that purpose, and we do not store them on our systems. You are responsible for having the right and consent to upload any image of a person - see our AI Terms and Acceptable Use Policy.

When you order a piece from us, we use the photos you send us in Viber only for that piece: we make your design from them in Tvorya without storing them on Tvorya's systems, and we delete them from Viber when you ask, or once we no longer need them.

10. Children

The Service is not directed at children, and we do not knowingly collect personal data from children under 14. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Cookies

We use cookies and similar technologies as described in our Cookies Policy. Non-essential cookies (for analytics and marketing) are used only with your consent.

On the pages our social media posts link to, we count anonymously how many times the page is opened and how many times its buttons are pressed. We use no cookies for this, read or store nothing on your device and keep nothing that could identify you, so we do not ask for consent. If you accept marketing cookies, the Meta Pixel also runs on these pages (see Section 5).

12. How we protect your data

We use appropriate technical and organisational measures to protect your data - see our Security page. No system is perfectly secure, but we work to keep your information safe.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you.

14. Contact

For any privacy question or to exercise your rights, email privacy@tvorya.com or reach us through the Help Center.