Privacy Policy

1.Overview

Crimsie ("we", "us", "our") operates the photo-book creation service at crimsie.com (the "Service"). This Privacy Policy applies to all users worldwide and describes our practices in accordance with:

• The EU/UK General Data Protection Regulation (GDPR/UK GDPR)
• The California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA)
• Applicable international data protection laws

Crimsie is based in Pakistan and applies the standards in this policy to all users worldwide. For users in the European Economic Area (EEA) or UK, Crimsie acts as the data controller for the personal data described below. Where we engage subprocessors, they act as data processors under our instruction.

2.Data We Collect

2.1 Account Information

When you create an account: email address, display name, password hash (stored by Supabase Auth, so we never see your plaintext password), profile photo (optional), and country/locale (inferred from browser).

2.2 Photos & Book Content

Photos you upload, captions, layouts, titles, and design choices you make within the Service. These are stored in your private storage bucket and are not accessible to other users or made public unless you explicitly share or submit a book for our curated showcase.

2.3 Usage & Analytics Data

Pages visited, features used, buttons clicked, time spent in editor, book completion rate, device type, browser, OS, screen resolution, and referring URL. Collected via our analytics provider (see §7). This data is aggregated and used to improve the product. It is never sold.

2.4 Payment Information

We do not store your card number, CVV, or full payment details. All payment processing is handled by Stripe. We receive a tokenised payment reference, your billing name, and the last four digits of your card for support purposes.

2.5 Order & Fulfilment Data

Shipping name, delivery address, order history, and tracking references. We share the minimum necessary with our print partner (see §7) to fulfil your order and do not retain your address beyond the period required for order support and legal obligations.

2.6 Communications

Emails, support tickets, and survey responses you send to us. If you opt in to marketing, your email is added to our mailing list (see §6 for how to unsubscribe).

2.7 Technical & Log Data

IP address, request timestamps, HTTP method and path, response codes, error stack traces, and session identifiers. Used for security, debugging, and abuse prevention. Retained for 90 days.

3.How We Use Your Data

4.Lawful Basis for Processing (GDPR)

For users in the EEA and UK, we rely on the following lawful bases under Article 6 GDPR:

• Contract (Art. 6(1)(b)): Processing necessary to provide the Service you have signed up for: account management, book creation, order fulfilment.
• Consent (Art. 6(1)(a)): Marketing emails, optional analytics cookies, and AI feature processing of your photos. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
• Legitimate Interest (Art. 6(1)(f)): Security monitoring, fraud prevention, product improvement (using aggregated data), and direct marketing to existing customers (where permitted). We have balanced these interests against your rights.
• Legal Obligation (Art. 6(1)(c)): Tax records, order history for statutory retention periods, responding to lawful requests from authorities.

Where we process special category data (for example, photos that may reveal information about health or religion), the lawful basis is your explicit consent (Art. 9(2)(a)) given when you upload and use those photos within the Service.

5.AI Feature Processing

5.1 What AI features do

Crimsie offers optional AI-assisted features including automatic caption suggestions, layout recommendations, and theme selection. These features send image data and/or text you have entered to a third-party AI provider (currently Anthropic Claude) for processing. The provider processes your data under a data processing agreement and is bound by strict data minimisation and security obligations.

5.2 Your consent

AI features are enabled by default but you may decline their use at any time. To process your photos without AI involvement, use the manual design tools throughout the editor. Choosing manual mode does not affect the quality or availability of your book.

5.3 No training on your data

5.4 AI output limitations

AI-generated captions and suggestions may contain inaccuracies, cultural insensitivities, or errors. They are starting points for your review and are not published without your explicit confirmation. Crimsie is not liable for any AI-generated content you choose to include in your book.

6.Cookies & Tracking

We use cookies and similar technologies. You can manage your preferences at any time using the Cookie Settings button in the footer. The categories below describe what each type does:

We do not use third-party advertising networks or sell data to advertisers. Analytics are used solely byCrimsie for product improvement.

To unsubscribe from marketing emails, click the unsubscribe link in any email we send or email us at privacy@crimsie.com.

7.Sharing & Subprocessors

We do not sell, rent, or trade your personal data. We share data only with the following subprocessors, each bound by a Data Processing Agreement:

We may also disclose personal data where required by law, court order, or regulatory authority, or to protect the rights, property, or safety of Crimsie, our users, or the public.

In the event of a business acquisition, merger, or sale, personal data may be transferred to the acquiring entity, subject to the same privacy commitments in this policy. We will notify you by email and/or prominent notice on our website at least 30 days before any such transfer.

8.International Transfers

Crimsie is incorporated in Pakistan. Some of our subprocessors are based in the United States or other countries outside the EEA/UK. We ensure appropriate safeguards are in place for all international transfers:

• EU-US Data Privacy Framework (DPF): Where our US subprocessors are DPF-certified, transfers are covered by the DPF adequacy decision.
• Standard Contractual Clauses (SCCs): For transfers not covered by an adequacy decision, we rely on the European Commission's standard contractual clauses (2021 SCCs / UK IDTA).
• Data Processing Agreements: All subprocessors sign our DPA, which includes the applicable SCCs and technical/organisational security measures.

You may request a copy of the relevant transfer mechanisms by contacting us at privacy@crimsie.com.

9.Data Retention

When a retention period expires, data is securely deleted or anonymised. You may request early deletion of your data at any time (see §10).

10.Your Rights

Depending on your location, you have the following rights regarding your personal data. We respond to all verifiable requests within 30 days (extendable by a further 60 days for complex requests, and we will notify you).

To exercise any right, email privacy@crimsie.com with the subject line "Privacy Request: [Right]" and sufficient information to verify your identity. We will never charge a fee for valid requests.

11.California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) grant you additional rights in addition to those described in §10:

11.1 Categories of personal information collected

In the preceding 12 months, we have collected: identifiers (email, IP), commercial information (orders), internet activity (usage logs), and inferences drawn from usage data. We have not sold personal information to third parties.

11.2 Your CCPA rights

• Know: request disclosure of categories and specific pieces of personal information collected about you
• Delete: request deletion of personal information (with exceptions)
• Correct: request correction of inaccurate personal information
• Opt-out of sale/sharing: we do not sell or share personal information for cross-context behavioural advertising
• Limit sensitive PI use: we do not use sensitive personal information for purposes beyond those listed in the CPRA
• Non-discrimination: we will not discriminate against you for exercising any CCPA right

11.3 Submitting a request

Email privacy@crimsie.com with subject "CCPA Request". We respond within 45 days (extendable by 45 days with notice). You may designate an authorised agent; we will verify the agent's authority before responding.

12.Children's Privacy

The Service is not directed to children under 13 (or 16 in the EEA/UK). We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided personal data to us, contact us at privacy@crimsie.com and we will promptly delete the data.

Users between 13–17 (or 16–17 in jurisdictions where 16 is the age of digital consent) should use the Service only with parental consent.

13.Security

We implement industry-standard technical and organisational security measures including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Row-level security on all database tables
• Private storage buckets with signed URL access for personal photos
• Multi-factor authentication available for all accounts
• Regular security reviews and dependency audits

Despite these measures, no system is completely secure. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify affected users and relevant supervisory authorities within 72 hours of becoming aware of the breach.

If you discover a security vulnerability, please disclose it responsibly to security@crimsie.com.

14.Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes (changes that affect your rights or how we process your data), we will notify you by email at least 14 days before the changes take effect. For minor clarifications, we will update the "Effective" date above.

Continued use of the Service after the effective date of any updated policy constitutes acceptance of the revised terms, except where law requires fresh consent (in which case we will ask for it explicitly).

15.Contact & DPO

For all privacy-related enquiries, requests, and complaints:

This Privacy Policy is also available in conjunction with our Terms of Service. Both documents together constitute the full legal agreement between you and Crimsie.