Privacy notice

1. Who is responsible

[owner name to be confirmed], trading as Obiitronics and EazyThreads, at [address to be confirmed], is responsible for personal data processed to operate this platform. Contact [support email to be confirmed] with a privacy question or request. KVK: [kvk to be confirmed].

Creators may independently control the customer data they need for their sales. Payment providers independently process information for payment and identity-verification duties. Where Obiitronics processes buyer data solely on a creator's instructions for fulfilment, the parties must have the appropriate processing agreement. Calling every participant a processor would not reflect these different purposes.

2. Information and purposes

Account information includes your name, email, username, authentication records and chosen profile details. We use it to provide your account and protect access, relying on performance of the account agreement and our legitimate interest in preventing abuse.

Design information includes uploads, prompts, generated images, garment layouts, drafts and publication choices. We use it to provide the tools and authorised production. Content you deliberately publish, including store details and social links, is visible to visitors. A private setting must be enforced through access controls before we describe a file as private.

Transaction information includes order items, seller identity, delivery details, payment references, invoices, refunds and settlement records. It is used to perform contracts, meet accounting obligations and resolve disputes. We do not need your full card number or banking password.

Seller information includes legal identity, address, business and VAT status, provider account reference and verification status. The payment provider should collect identity documents and bank-verification information through its own secure process. We collect national identifiers only where a verified legal obligation permits and requires it.

Technical and support information includes service logs, error reports, security events and messages you send us. We use the minimum information needed to operate, secure and support the service. Any use of optional advertising tracking or non-essential profiling requires a separate valid basis and, where required, prior consent.

3. Recipients and international transfers

Service recipients may include the hosting and database operator, email delivery service, AI generation provider, payment provider, carrier and professional advisers. Only information needed for the relevant purpose is shared. A creator receives only the buyer information needed for their obligations and must not reuse it for unrelated marketing.

The repository uses PocketBase software and a Replicate integration, with Stripe code for digital purchases. This does not establish the final hosting contract, active providers, processing locations or retention terms. The final provider register must name the contracted entities and relevant processing locations before this notice is published as final.

When data is transferred outside the EEA, we use a valid transfer mechanism, such as an applicable adequacy decision or the relevant contractual safeguards and assessment. Ask [support email to be confirmed] for information or a copy of relevant safeguards. Do not upload sensitive personal data into an AI prompt unless the service has expressly been designed and approved for that use.

4. Retention

Proposed operational retention is: account and draft data while your account remains active; deletion from active systems within 30 days after an approved deletion request unless a justified exception applies; routine security logs for 90 days; ordinary support records for 24 months after resolution; rolling backups for 35 days. These are launch design requirements and must be technically verified before publication as active policy.

Accounting records are normally kept for 7 years, with a longer period where a specific rule applies, such as relevant OSS records. We retain only the records necessary for that duty. An unresolved dispute, legal claim or product-safety obligation may justify a different documented period. A lawful accounting obligation does not justify keeping every artwork file forever.

5. Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction or portability, and object to processing based on legitimate interests. You may withdraw consent at any time without affecting the lawfulness of earlier processing. We respond within the applicable GDPR period, normally one month, and explain any lawful extension.

We may request proportionate information to verify your identity, but do not require a full identity-document copy by default. If a request cannot be fulfilled fully, we explain why and how you can challenge the decision. You can complain to the Dutch Autoriteit Persoonsgegevens or another competent supervisory authority.

Marketing is optional and separate from necessary service messages. You can unsubscribe from marketing without closing your account. Restock notifications should be sent only for the item you requested unless you separately choose broader marketing.

6. Security and automated processing

We use access controls, protected administrative accounts and other measures appropriate to the information and risk. The release checklist requires tested backups, deletion procedures and secure handling of drafts and credentials. No service can promise absolute security.

Marketplace ranking may use relevance, product type, freshness, availability and paid placement. We explain the principal factors on the Discovery and promotions page. Any future decision with a legally significant effect based solely on automated processing requires separate assessment, information and safeguards.