Privacy Policy

1. Controller

O.D.E.R.S.O. GmbH, Labesstraße 7, 27404 Zeven, Germany, represented by Managing Director Fynn Kliemann.

Privacy contact: Fynn Kliemann, mail@vector-boy.com

2. Image processing stays local

Images selected for editing and vectorization are processed locally in your browser. They are not uploaded to our servers, Stripe, Vercel, Neon or our email provider. Account, payment, credit and technical connection data are processed separately from image data.

3. Hosting and technical delivery

The website is provided by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Static content may be delivered through a global content delivery network; application functions are configured in the Frankfurt region. When you access the site, technically necessary data such as IP address, time, requested resource, browser identifier and referrer is processed to provide the service securely and reliably. The legal basis is Article 6(1)(f) GDPR. Technical application logs are generally retained for no more than 30 days unless a security incident requires longer preservation.

4. Accounts and sign-in

When credits are purchased for the first time, an account is automatically created with the email address used in Stripe Checkout. We process the email address, a one-way protected password, sessions, credit balance, preferred language and necessary usage data. A one-time password setup link is valid for 24 hours. A separate one-time secret kept only in the purchasing browser may claim the account and continue the download for up to two hours after confirmed payment. Only cryptographic hashes are stored for these secrets. The legal basis is Article 6(1)(b) GDPR. Sessions expire after no more than 30 days. Expired links, payment completion secrets and sessions are deleted regularly.

When an account deletion is confirmed, access is disabled immediately, sessions are deleted and directly associated contact data is pseudonymized. Download and credit details that are no longer required are deleted. Tax, invoice and contract records are retained only where statutory retention or legal defence obligations apply. The account cannot be restored.

5. Database

Account, contract, credit and billing data is stored in a PostgreSQL database operated by Neon, Inc. The production project runs in the Frankfurt region. Neon may use subprocessors and transfer data to third countries on the basis of appropriate safeguards. The legal bases are Article 6(1)(b), (c) and (f) GDPR.

6. Payments, invoices and taxes through Stripe

Only when you start a purchase and open Stripe Checkout do we send the information required for checkout, payment processing, invoices, fraud prevention and automatic tax calculation to Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, and affiliated Stripe companies. This includes email address, billing address, tax ID, payment, device and transaction data. We do not store complete payment credentials in our systems.

Stripe processes certain data as an independent controller where required for payment processing, its own legal duties, fraud prevention and the security of the Stripe network. Where Stripe acts on our behalf, Stripe's applicable data processing terms apply. The legal bases are Article 6(1)(b) and (c) GDPR and, for abuse prevention, Article 6(1)(f) GDPR. Stripe may process data outside the EEA using recognized safeguards. More information: https://stripe.com/privacy

7. Transactional emails

We use email infrastructure from STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, for required contract confirmations and account or password messages. Recipient address, subject, message content and technical delivery data are processed. The legal bases are Article 6(1)(b) and (c) GDPR. We do not send marketing email without a separate legal basis.

8. Credits, downloads and invoices

We store purchases, credit movements, download times and file formats to maintain balances, authorize downloads, match invoices and prevent abuse. The processed image is not transmitted. A download authorization contains only a random request key and the selected file format.

Invoices, payments and tax records are generally retained for eight years. Contract acceptances are retained for as long as required to demonstrate the transaction and until relevant limitation periods expire. Operational download details are deleted or aggregated when no longer required for account history, abuse prevention or legal claims.

9. Referral program

When a personal invitation link is used, its referral code is stored locally in the browser and transmitted only during registration or a guest checkout. We process the relationship between inviting and invited accounts, registration time, first confirmed payment status and the resulting credit reward. The invited person's email is shown to the inviter only in masked form. Processing is required to operate and protect the voluntary referral program under Article 6(1)(b) and (f) GDPR. Referral credits may be reversed after refunds, chargebacks or abuse.

10. Cookies and local storage

We use a strictly necessary session cookie to keep signed-in users authenticated. Presets, image-processing preferences, language selection, referral codes and pending checkout details may be stored locally in your browser. These entries support requested functionality and are not advertising trackers. You can remove local storage through your browser settings; doing so also removes local presets and pending state.

11. Recipients and international transfers

Recipients are limited to providers required for hosting, database, payment, tax, invoice and email delivery, as well as authorities where required by law. Where data is processed outside the EEA, adequacy decisions, standard contractual clauses or another legally recognized transfer mechanism are used where necessary.

12. Your rights

Subject to applicable law, you may request access, rectification, erasure, restriction, data portability and objection. You may withdraw consent for the future where processing is based on consent. You may also complain to a competent data protection authority. Contact mail@vector-boy.com to exercise these rights.

13. Security

We use encrypted connections, HttpOnly session cookies, one-way password hashing, expiring single-use tokens, rate limits and server-side authorization. No internet service is completely risk-free. Keep your password confidential and sign out on shared devices.