Privacy Policy
In short: This policy explains what personal data Tvorya collects, why, who we share it with, how long we keep it, and the rights you have. We collect only what we need to run the Service, and we don't sell your data. The summaries like this are not the full story — please read the sections too.
This Privacy Policy explains how Tvorya ("we", "us", "our") handles personal data when you use our website and service (the "Service"). It is written to comply with the EU General Data Protection Regulation (GDPR) and the Bulgarian Personal Data Protection Act.
1. Who is responsible for your data (controller)
The controller of your personal data is ДИГИТАЛНО АТЕЛИЕ ТВОРЯ ЕООД (DIGITAL ATELIER TVORYA EOOD), a company registered in Bulgaria in the Commercial Register (Търговски регистър) under EIK 208876264, registered address ул. Стадионска № 7, вх. Б, ет. 3, ап. 24, 6600 Кърджали (Kardzhali), Bulgaria. For any privacy question or request, contact us at privacy@tvorya.com or through the Help Center.
2. What personal data we collect
In short: Information you give us, things you create, a little technical information, and (only if you choose to upload it) photographs.
- Account information — if you create an account: your email address and authentication details. If you sign in with a third-party login (for example Google), we receive basic profile information from that provider.
- What you create and the details you enter — the event details, text, choices, and prompts you provide to generate and personalise a product, and the products ("creations") you make.
- Images you upload — for products that support it, any photographs you upload. These may include images of identifiable people, which is sensitive — see Section 9.
- Order and billing information — when you buy, we collect your email for delivery and receipts, and, if you request an invoice, the company and tax details you provide. Payment-card details are handled by our payment provider; we do not store full card numbers.
- Communications — messages you send us (for example, support requests or feedback).
- Technical and usage information — basic information your browser or device sends automatically, such as IP address, device/browser type, and how you interact with the Service. Some of this is collected through cookies — see our Cookies Policy.
3. How and why we use your data, and our legal basis
Under the GDPR we must have a lawful basis for using your data. The table below explains what we do and why.
| What we do | Why | Legal basis |
|---|---|---|
| Create and manage your account | To give you access to the Service | Performance of a contract |
| Generate and deliver your products (including sending your input to our AI provider) | To provide the Service you ask for | Performance of a contract |
| Process payments and provide invoices | To complete your purchase and meet tax/accounting duties | Contract; legal obligation |
| Provide customer support | To answer your questions and fix problems | Contract; legitimate interests |
| Keep the Service secure and prevent abuse or fraud | To protect you, us and others | Legitimate interests; legal obligation |
| Moderate content for safety and policy compliance | To keep the Service lawful and safe | Legitimate interests; legal obligation |
| Improve and maintain the Service | To make Tvorya work better | Legitimate interests |
| Send you service messages (e.g. order confirmations) | To keep you informed about your use of the Service | Contract |
| Send optional marketing (if applicable) | To tell you about features and offers | Consent (you can withdraw at any time) |
| Analytics and similar technologies | To understand and improve usage | Consent (via the cookie banner) |
Where we rely on consent, you can withdraw it at any time; this does not affect processing carried out before withdrawal.
4. Using your data to improve AI
We do not use the photographs you upload to train AI models. If we ever wish to use any of your content to improve AI features, we will only do so where we have a lawful basis, and we will give you clear information and controls first.
5. Who we share your data with
In short: Only the service providers we need to run Tvorya, and only for that purpose. We don't sell your data.
We share personal data with trusted third-party providers ("processors") who help us run the Service, under contracts that require them to protect your data and use it only on our instructions. Our main processors are:
| Provider | Purpose |
|---|---|
| OpenAI | AI image and text generation; content moderation |
| Supabase | Database, authentication and storage |
| Cloudflare | File storage and delivery (R2); content delivery, security, DDoS protection, and human/bot verification (Turnstile) |
| Stripe | Processing payments |
| Email provider (to be confirmed) | Sending service and delivery emails |
| Hosting providers (Vercel, Railway) | Running the website and backend |
We may also disclose personal data where required by law, to enforce our terms, to prevent fraud or harm, or in connection with a business sale or reorganisation (in which case we will notify you).
6. Sending data outside the EEA
Some of our providers are located outside the European Economic Area (for example, in the United States). Where personal data is transferred outside the EEA, we rely on appropriate safeguards — such as the European Commission's Standard Contractual Clauses or an adequacy decision — to make sure your data stays protected.
7. How long we keep your data
We keep personal data only as long as we need it for the purposes described here, and to meet our legal obligations (for example, tax and accounting records). In particular:
- Account data — for as long as your account is active, then deleted or anonymised within a reasonable period after closure.
- Drafts and creations — for a limited retention period; unpurchased drafts may be deleted after a set time.
- Uploaded photographs — kept only as long as needed to generate and deliver your product, then deleted on a short retention schedule.
- Order and invoice records — kept for the period required by Bulgarian tax and accounting law.
8. Your rights
In short: You can ask to see, correct, delete, or limit how we use your data, object to certain uses, and get a copy of it. Email privacy@tvorya.com.
Under the GDPR you have the right to:
- access the personal data we hold about you;
- rectify inaccurate data;
- erase your data ("right to be forgotten"), where applicable;
- restrict or object to certain processing;
- data portability — receive a copy in a structured, machine-readable format;
- withdraw consent at any time, where we rely on it.
To exercise any of these, contact privacy@tvorya.com. You also have the right to complain to the Bulgarian Commission for Personal Data Protection (CPDP / КЗЛД) or your local data-protection authority.
9. Photographs of people (sensitive data)
Some products let you upload photographs, which may show identifiable people — and potentially could include children. We treat these images with particular care: we use them only to generate and deliver your product, we send them to our AI provider only for that purpose, and we delete them on a short retention schedule. You are responsible for having the right and consent to upload any image of a person — see our AI Terms and Acceptable Use Policy.
10. Children
The Service is not directed at children, and we do not knowingly collect personal data from children under 14. If you believe a child has provided us with personal data, please contact us and we will delete it.
11. Cookies
We use cookies and similar technologies as described in our Cookies Policy. Non-essential cookies (such as analytics) are used only with your consent.
12. How we protect your data
We use appropriate technical and organisational measures to protect your data — see our Security page. No system is perfectly secure, but we work to keep your information safe.
13. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you.
14. Contact
For any privacy question or to exercise your rights, email privacy@tvorya.com or reach us through the Help Center.