Privacy Policy
Draft pending legal review. This text is not yet a final approved agreement.
1. Controller
GRAFICA UCLA SRL (CUI 44747718), Romania. Privacy requests: hello@oddlyshapes.com.
2. Data we collect
Account: name, email, password (stored hashed by our authentication provider) or Google/Apple sign-in details, and an optional avatar.
Billing: company or legal name, tax ID, address and country you save.
Orders and payments: items, prices, taxes, currency, payment references. Card details are handled by Stripe, not by us.
Evidence records: checkout consents, accepted terms version, payment, delivery and ownership timestamps, and download history.
Preferences: favorites, basket, notification choices and saved logo color customizations.
Optional marketing subscription, only if you opt in separately.
3. Why we use it
To perform our contract with you (accounts, checkout, delivery, ownership documents); to meet legal obligations (accounting and tax records); for our legitimate interests (fraud prevention, handling disputes and legal claims); and with your consent (marketing).
4. Service providers
Stripe (payments, fraud prevention, disputes); Lovable Cloud (database, authentication, file storage); Cloudflare (hosting and network delivery); Google and Apple (if you choose their sign-in); Google Fonts (web font delivery, which receives your IP address); our email delivery provider.
5. International transfers
Some providers process data outside the EEA. Where they do, transfers rely on safeguards such as the EU Standard Contractual Clauses or an adequacy decision.
Awaiting approval: Confirm each provider's transfer mechanism before publication.
6. Retention
Account data is kept while your account is open. Orders, invoices, payment records, ownership and consent evidence are kept for as long as required by accounting law and for possible legal claims, even after account closure.
Awaiting approval: Exact retention periods per category must be confirmed by the accountant or legal adviser.
7. Your rights
You may request access, correction, export, restriction, objection, account closure and erasure of eligible data. Use Privacy & Data Requests in your account or email us. Some records must be kept by law and cannot be erased. You may complain to your data protection authority (in Romania, ANSPDCP).
8. Security
We use access controls, encrypted connections and short-lived download links. No system is completely secure.