Privacy Policy

1. Who is responsible

Dezajn is operated by Ladislav Hájek. Company ID: 74349155. VAT ID: CZ8501231156. Address: Zlatnická 247, 25073 Jenštejn, CZ. Contact: support@dezajn.com.

2. Information and purposes

Accounts: email, password or Google sign-in identity, profile name, username, region, avatar, optional social/profile information, settings, and onboarding answers. These provide and secure your account under our contract and legitimate interests in preventing abuse. Profiles, artwork, and listings you publish are visible to others.

Orders and payouts: contact and shipping details, billing details and tax IDs, cart and purchased items, payment status and provider identifiers, invoices, refunds, legal confirmations, and designer ledger/withdrawal information. These fulfil contracts, meet accounting obligations, and resolve fraud and disputes. Card details are entered into Stripe’s service; Dezajn does not store full card numbers or security codes.

Support and moderation: submitted contact details, messages, evidence, uploaded images, reports, appeals, and handling notes. These support responses, user and rights-holder protection, and legal obligations. Operational/security logs can contain IP addresses, browser information, request paths, and errors for abuse prevention and reliability, not advertising.

AI tools: chat sends your question and up to eight recent messages to Google Gemini. Dezajn keeps chat history in the current page state, not its application database. Image/design tools can send supplied prompts or images to configured Google AI or moderation services. Provider processing and retention also apply. Do not submit confidential, payment, or health information in prompts.

Optional analytics: after current consent, public discovery pages record product/profile visits and cart additions. Records include a visitor ID, signed-in user ID when present, target product/profile, route category, referring hostname, device category, and time. If you later create an account, where you first arrived from (referring hostname, landing route category, and any utm_source/utm_medium/utm_campaign tags) is attached to that account once at onboarding, so we can learn which channels bring new members. We do not collect form/chat contents, search text, other URL queries, payment fields, or health fields for analytics. This version loads no session replay, advertising pixels, PostHog, Google Analytics, or Vercel Speed Insights.

With the same consent, Vercel Web Analytics measures visits to selected public pages on dezajn.com, including referral sources, device/browser information, and approximate location. It uses a visitor hash that changes daily rather than an analytics cookie. Product and creator URLs are grouped into route categories; page URL queries and fragments are removed. Account, editor, checkout, order, support, and authentication pages are excluded. This integration sends page views only, without custom event payloads, and is disabled on local and preview deployments.

Promotions: email, campaign/delivery status, and suppression records support permitted promotional email and opt-outs. Consent must be obtained where required. Essential account, order, and payout notices continue after a promotional opt-out.

Children: Dezajn is intended for people aged 16 or over, and designer agreements require adulthood. We do not knowingly collect personal data from younger children. A parent or guardian can ask us to delete a child’s data through Privacy Rights Requests.

3. Providers and transfers

Supabase provides authentication, database, and file storage. Stripe handles payments and payout onboarding. Printify and fulfillment partners receive production/delivery information. Fakturoid processes invoices. Resend delivers transactional and permitted promotional email. Google provides sign-in, configured address validation, AI, and moderation. Cloudflare Turnstile protects forms. The hosting provider (Vercel for Vercel deployments) delivers the app and processes operational logs. Vercel also processes optional public-page analytics after consent.

When configured, Discord receives staff order notifications containing buyer email, status, region, amount, and product preview, and administrative security notifications. Records may also be shared with advisers or authorities for legal obligations or claims. Publicly posted content is accessible to the public.

Providers may process data outside the EEA or your country. Where required, transfers must be covered by an applicable adequacy decision or suitable safeguards such as standard contractual clauses. Contact us for the safeguards and transfer details applicable to your data. The service-provider page lists integrations; contact us for current contractual, regional, and transfer details.

4. Retention

Account/profile information remains while needed for your account or until removal or erasure, subject to legal obligations and unresolved disputes. Published content remains until removed; order and rights records can survive removal.

Order, invoice, tax, and payout records remain for the statutory accounting/tax period applicable to the seller and for unresolved disputes or enforceable claims. The law, record type, financial year, and legal holds determine the end date.

Support, privacy, and moderation records remain while a case is handled and for its applicable compliance-evidence or legal-claim period. Case type, closure date, appeal rights, statutory limitation periods, and legal holds determine retention. Contact us for the period applicable to a particular case.

Identifiable first-party analytics events are kept for up to 90 days and purged daily. Aggregate product/profile counts without visitor IDs can remain for historical reporting. Visitor and consent cookies expire after one year; consent can be withdrawn earlier. Suppression records remain while needed to prevent further promotions, including after account closure.

Vercel Web Analytics on our Pro plan has a 12-month reporting window. Its daily visitor hash does not link visits across different days. Vendor retention and deletion processes also apply.

Chat state ends when the page is closed or reloaded. Human-verification tokens expire at their recorded expiry. Vendor logs and backups follow their contracted retention/deletion processes; application deletion does not mean immediate erasure from every backup or vendor system.

5. Choices and rights

Use Cookie preferences in the footer or Cookie Notice to refuse or withdraw analytics consent. Withdrawal does not change the lawfulness of earlier processing. Promotional emails have an unsubscribe link applied immediately online; support also accepts opt-outs.

You can request access, correction, erasure, restriction, portability, or object to legitimate-interest processing, subject to applicable exceptions, through Privacy Rights Requests or our contact address. Parents/guardians can select the child-data option. We verify authority proportionately, restrict confirmed under-13 accounts, and handle deletion without asking children for more information.

You may complain to the Czech Office for Personal Data Protection (ÚOOÚ), or the competent authority where you live, work, or an alleged infringement occurred. Necessary account/order data is needed for those services; optional profile fields and analytics can be declined. Analytics is not used for decisions with legal or similarly significant effects about you.