Designora | 曜象 ("we", "us", "our") operates the AI-powered design platform at https://designora.co.uk (the "Service"). This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our merchant portal and AI design services, in compliance with the UK GDPR and Data Protection Act 2018.

1. Who We Are

We are the data controller for the personal data processed through this Service.
For any privacy-related enquiries, please contact us at: privacy@designora.co.uk (or via the contact form on our website).
We recommend replacing the email with your official support address once set up.

2. What Personal Data We Collect

To deliver our AI design services, we collect the following categories of data:

• a. Account & Contact Data: Name, email address, WhatsApp / phone number, brand or company name, industry sector.
• b. User Content & Creative Assets: Product photographs, brand logos, reference images and other assets you upload; AI-generated designs, posters, banners and marketing materials created for you (stored in your secure personal workspace).
• c. Payment & Transaction Data: Package purchases and payment history (processed securely via Stripe; we do not store raw credit/debit card details).
• d. Usage & Technical Data: How you interact with the platform (features used, designs generated, etc.); IP address, browser type, device information, and usage logs (collected automatically via Vercel hosting and analytics tools).
• e. Communications Data: Records of support requests and correspondence with our team.

3. How We Use Your Data & Legal Basis

We process your data for the following purposes:

• Provide and operate the AI design Service (including processing your uploads via our Aura Glow Engine and Vision Engine to generate visuals)
• Create and manage your merchant account and personal workspace
• Process payments and deliver purchased design packages
• Communicate with you regarding your account, orders, and support
• Improve our Service and AI quality (using aggregated/anonymised data where possible)
• Detect fraud, ensure platform security, and comply with legal obligations

Legal bases under UK GDPR:

• Contractual necessity – to deliver the design services and manage your account
• Legitimate interests – service improvement, security, and platform functionality
• Consent – for optional marketing communications (you may withdraw consent at any time)
• Legal obligation – for accounting, tax, and regulatory compliance

Important Note on AI Processing:
Your uploaded brand assets and product images are processed solely to generate the designs you request. We do not use your proprietary brand assets, logos, or generated outputs to train our AI models or any third-party models without your explicit prior consent. All AI processing occurs under strict data processing agreements with our trusted infrastructure providers.

4. Data Sharing & Third-Party Processors

We do not sell your personal data. We only share it with the following categories of trusted processors under formal Data Processing Agreements:

• Vercel – website hosting and infrastructure
• Supabase – encrypted database, authentication, and file storage
• Stripe – secure payment processing (PCI DSS Level 1 compliant)
• Reputable third-party AI image generation and processing services (used only to fulfil your design requests)
• Essential operational service providers (e.g. transactional email)

International Transfers:
Some processors (including Vercel, Supabase and Stripe) are based outside the UK (primarily in the United States). We ensure appropriate safeguards are in place, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, to maintain a level of protection equivalent to UK standards.

5. Data Retention

We retain personal data only for as long as necessary:

• Active account data and creative assets: retained while your account remains active.
• After account deletion or extended inactivity: we may retain minimal data for up to 7 years for legal, tax, and accounting purposes.
• Usage and technical logs: typically retained for 12–24 months for security and analytics.

You may request earlier deletion of your data at any time (subject to legal retention requirements).

6. Your Data Protection Rights

Under UK GDPR you have the following rights:

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing (including direct marketing)
• Rights in relation to automated decision-making and profiling

To exercise any of these rights, please email us at the address above. We aim to respond within one calendar month. We may need to verify your identity before actioning certain requests.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at https://ico.org.uk if you are dissatisfied with how we handle your data.

7. Security

We protect your data using industry-standard measures, including:

• 256-bit SSL/TLS encryption in transit
• Encrypted storage in Supabase databases and file storage
• Strict access controls and authentication
• Secure payment handling via Stripe

While we take these measures seriously, no system is completely immune to risk. We recommend using a strong, unique password for your account.

8. Cookies & Tracking Technologies

We use cookies and similar technologies for:

• Strictly necessary cookies – login sessions, security, and core platform functionality (no consent required)
• Analytics & performance cookies – to understand usage and improve the Service (we use privacy-friendly tools such as Vercel Analytics where possible)

We currently do not use cookies for targeted advertising. You can manage preferences through your browser settings.

9. Children's Privacy

Our Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have done so, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email (for account holders) or prominent notice on the website, with the updated "Last updated" date. Continued use of the Service after changes constitutes acceptance of the revised policy.

11. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact:
Email: privacy@designora.co.uk
Website: https://designora.co.uk/