Data Retention

Uploaded photos & generated artworks

• Without purchase: uploaded photos, masks, and previews are deleted automatically 7 days after upload. That window gives you time to complete payment later if you do not check out right away.
• After generation: the original uploaded photo is deleted after the handprint files are generated. We try to keep only the data we need and remove everything else as fast as possible. The finished full-resolution files and previews stay in your library for as long as your account is active, so you can re-download them anytime via the magic link we email you.
• If you request account deletion, we remove those files as part of that process (see Right to deletion below). Payment records may still be kept for tax purposes.

No identification or biometric templates

Uploaded hand photos are used to create your digital keepsakes. We do not use them to identify anyone, verify identity, or create biometric templates.

Account & order records

• Email addresses tied to a purchase remain in our system to support re-download and refund handling while your account is active.
• Invoice and payment records (handled by Stripe) are kept for 10 years as required by German tax law (§ 147 AO).

Right to deletion (DSAR)

You may request deletion of your account and uploads at any time by emailing support@handprintmagic.com. We respond within 30 days. Note that we are required to retain payment records for tax purposes even after deletion of your other data.

Sub-processors

• Supabase (database, auth, file storage) — EU region
• Stripe (payments, VAT, invoicing)
• Replicate (image generation runtime)
• Cloudflare Turnstile (bot prevention)
• Cloudflare Web Analytics (cookieless page analytics)
• Sentry (error monitoring)
• Render (hosting) — EU region