HandyCrafts

Personal data

Privacy policy

Last updated: 24.09.2026

  1. 1Controller

    HandyCrafts is operated from Ruse, Bulgaria. Email: handycraftshelp@gmail.com. HandyCrafts does not yet carry out commercial activity: the company is being registered. Until then the site is a demonstration of how the shop will work — you can try the studio and see previews, but orders are not accepted as sales and nothing is charged. The full company details (name, company ID and registered address) will be published here as soon as the company is registered.

    The controller processes personal data under Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act.

  2. 2What we collect

    • The photo you upload in the studio, your description of clothes and pose, any extra photos and changes you ask for in the chat, and the generated previews.
    • When you order: name, phone, email (optional), city, address or courier office, and your order note.
    • Unfinished order: if you enter a phone or email at checkout but don't send the order — what you entered and the items in your cart.
    • Preview by email: if you ask us in the studio to send you your preview — your email and the preview.
    • Review: the rating, the text, the name you give and the city from the order. It is shown on the site only with your consent and after we have read it.
    • When you join the newsletter: email and language.
    • When you use the contact form: name, email, phone (optional) and your message.
    • Technical data: IP address, used only briefly to protect the site from abuse (rate limiting).

  3. 3Purposes and legal basis

    • Making and delivering the order and talking to you about it — performance of a contract (Art. 6(1)(b) GDPR).
    • Accounting and tax duties — legal obligation (Art. 6(1)(c)).
    • Newsletter — consent (Art. 6(1)(a)), which you can withdraw at any time via the link in each email.
    • Protecting the site from abuse — legitimate interest (Art. 6(1)(f)).
    • Unfinished order — a call or up to 3 reminder emails to help you finish the order you started — legitimate interest (Art. 6(1)(f)). Every email has a link to stop them.
    • Review — published on the site with your consent (Art. 6(1)(a)); you can ask us to remove it at any time.
    • Preview by email — we send it at your request, then up to 2 reminders about it — steps taken at your request before a contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)). Every email has a link to stop them.

  4. 4Photos and artificial intelligence

    To create the preview, your photo is sent for processing to xAI (Grok Imagine model), USA. We use it only to generate the preview of your figurine. We don't use photos to train models and don't publish them without your explicit consent.

  5. 5Who we share data with

    • Vercel Inc. — website hosting and private photo storage (Vercel Blob).
    • Upstash (Redis) — order database, in the EU (Frankfurt).
    • xAI — generating previews.
    • Resend — sending order and newsletter emails.
    • Econt Express and Speedy — delivering the parcel (name, phone, address).

    Transfers outside the EU rely on an EU adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses.

  6. 6How long we keep data

    • Photos and previews that were not ordered — deleted automatically within 30 days.
    • Photos for completed orders — deleted automatically 12 months after the order, or sooner if you ask.
    • Order data (name, address, amount) — as long as accounting and tax law requires.
    • Newsletter — until you unsubscribe.
    • Unfinished orders — deleted automatically within 30 days.

  7. 7Cookies

    The site uses no advertising or tracking cookies. Your cart is stored in your browser (localStorage), and one necessary session cookie is used when logging in to the order panel. That's why there is no cookie banner.

  8. 8Your rights

    You have the right of access, rectification, erasure, restriction, portability, objection and withdrawal of consent. To use them, email handycraftshelp@gmail.com. We reply within 30 days.

    You can also complain to the Bulgarian Commission for Personal Data Protection — 2 Prof. Tsvetan Lazarov Blvd, Sofia, cpdp.bg.

  9. 9Changes

    Last updated: 24.09.2026.

Questions? Write to us.