Privacy Policy

Version 1

1. Controller

The controller of your personal data is KK IT Solutions, Dokudów Drugi 95A, 21-500 Biała Podlaska, Poland (tax ID 5372547884). Contact for all privacy questions and requests: [email protected].

For payments, Paddle.com acts as Merchant of Record and is a separate controller of the payment data it collects (see section 4).

2. What we process and why

  • Account: a stable identifier from Google (stored only as a one-way hash, which is your account ID), your verified email address, plan and its period, accepted terms version and time, your optional marketing choice, and sign-in times. We request only the "openid" and "email" scopes from Google; no profile, contacts or files. Purpose: to create and run your account (contract, Art. 6(1)(b) GDPR).
  • Projects: app name, description and facts you enter, screenshots you upload, captions, store listing texts, Feature Graphic settings and generated backgrounds. Purpose: to provide the studio (contract, Art. 6(1)(b) GDPR). Screenshots can contain personal data if your app's screens show any; please use test data where you can.
  • AI usage: for each AI request we log the operation, model, token counts, cost, duration, status and the AI provider's request ID, plus hourly and daily request counters. We do not log prompts, screenshots or AI output. Purpose: credits, cost control and abuse prevention (contract and legitimate interest, Art. 6(1)(b) and (f) GDPR).
  • Purchases: purchase ID, project, plan, amount, currency, status, Paddle's transaction ID and the history of payment events (paid, refunded, disputed). No card or bank details. Purpose: to grant the pass you bought and keep accounting records (contract and legal obligation, Art. 6(1)(b) and (c) GDPR).
  • Technical data: IP address, time, requested address and browser type are processed by our servers and our network provider to deliver pages, keep the service secure and limit abuse; the IP address is also used in memory for per-address AI request limits (legitimate interest, Art. 6(1)(f) GDPR).
  • Product statistics: we count per day how many visits open the landing page or the demo and change a style there, without cookies, IP addresses or any identifier, so these counts cannot be linked to you. For your account we store only when you first created a project, saw a preview and exported. Purpose: to see where people drop off and whether the service pays for itself (legitimate interest, Art. 6(1)(f) GDPR); you can object by email. These dates are in your data export and are deleted with your account.
  • Marketing: only if you opt in, which is separate from accepting the terms and can be withdrawn at any time by email (consent, Art. 6(1)(a) GDPR). We do not send marketing emails today.

3. When data leaves ShotHatch for AI

AI features run only when you click them. Then we send to OpenAI (OpenAI, L.L.C., USA, via its API): for headlines, the screenshots of the language you generate for and your app name and description; for listing texts and Feature Graphic copy, the texts and facts you entered; for a Feature Graphic background, a text description only. Auto Theme, previews and exports run in your browser and send nothing to OpenAI.

Under OpenAI's API terms, data sent through the API is not used to train its models by default. OpenAI may keep it for up to 30 days to detect abuse, unless the law requires longer. We do not promise zero data retention or processing only in the EU.

You can always write and edit everything by hand instead of using AI.

4. Recipients

  • Hosting: UW-TEAM.ORG Jakub Mrugalski (MIKR.US), Poland, on servers of Hetzner Online GmbH in the European Union, which stores the server and its data on our behalf.
  • Cloudflare, Inc. (USA): network and security proxy in front of the site; processes IP addresses and traffic data.
  • Google LLC / Google Ireland Ltd: sign-in with Google. When you import a public Google Play listing, our server fetches that public page; no personal data is sent with it.
  • OpenAI, L.L.C. (USA): AI features you start, as described in section 3.
  • Paddle.com Market Ltd (United Kingdom): checkout, payment, tax, invoicing, refunds and chargebacks, as an independent controller under its own privacy notice (paddle.com/legal/privacy). The payment form is loaded from Paddle on the payment page only.
  • Authorities, only where the law requires it.

5. Transfers outside the EEA

Cloudflare, Google and OpenAI may process data in the USA. These transfers rely on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's standard contractual clauses. Paddle is in the United Kingdom, which the European Commission recognises as providing adequate protection. You can ask us for a copy of the safeguards.

6. How long we keep data

  • Account and projects: while your account exists. After a timed pass ends, projects with their screenshots and backgrounds are kept for 30 days and then deleted. Projects of a free trial account are deleted after 180 days without a sign-in or a project change. The studio shows the deletion date after a pass ends and from 14 days before a trial deletion, so you can download your data first; the account itself, its purchases and credit records stay. You can delete your account yourself at any time on the Your data page in the studio: projects, screenshots, generated backgrounds and remaining credits are removed at once and every open session is signed out. If you ask us by email instead, we do it within 30 days.
  • Purchase records: as long as tax and accounting law requires (in Poland, 5 years from the end of the year of the purchase).
  • AI usage records (without prompts, screenshots or results): 400 days, also after a deletion, for cost accounting, linked only to the pseudonymous account ID. Credit records are kept the same way, because granted, spent and refunded credits belong to the purchase records.
  • Pseudonymous account ID (a SHA-256 hash of your Google account ID, no email): kept after a deletion so that sessions opened before it stay closed and a new account with the same Google account gets no second free trial.
  • Technical logs: the web server in front of ShotHatch keeps access logs (IP address, time, requested address, browser type) for 14 days. Application logs record technical events with the pseudonymous account ID only, never your email, screenshots or texts; their size is capped and the oldest entries are overwritten as new ones arrive.

7. Cookies and browser storage

  • A session cookie (__Host-ShotHatch, secure, HTTP-only, ends after 12 hours) keeps you signed in, plus short-lived cookies that protect the Google sign-in. They are strictly necessary and need no consent.
  • Your browser's local storage remembers the last opened project, unsaved drafts and, in the demo, the demo project. It never leaves your browser and is cleared when you sign out or delete your account.
  • On the payment page, Paddle's checkout may set its own cookies to process the payment.
  • We use no analytics, advertising or tracking cookies. The notice at the bottom of the page only tells you this; closing it is remembered in your browser's local storage.

8. Your rights

You have the right to access, correct and delete your data, to restrict or object to processing based on legitimate interest, to data portability, and to withdraw consent at any time without affecting earlier processing. The Your data page in the studio downloads a copy of your data (a ZIP with your account, projects, original screenshots, purchases, credits and AI usage records) and deletes your account. For anything else, write to [email protected]; we answer within one month. You can also complain to the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl).

Giving your email through Google is needed to have an account; uploads and AI are up to you. We make no decisions about you based solely on automated processing.

9. Security

Data is transferred over HTTPS, every request is checked against your account, and projects are stored in a private area keyed by your account ID. Payment card data never reaches our servers.

10. Changes

This policy is version 1. We announce material changes in the studio before they apply.