Privacy Policy

The short version: we collect only what we need to deliver your order and improve the product. We do not sell your data, do not train AI models on your inputs, and delete your photo (Phase 2) within 24 hours of fulfillment. You can request deletion of everything except the anonymised order line we keep for tax reasons.

1. Who we are

Witprinted is operated by Sawary Trading LLC, a Wyoming limited liability company. References to "we", "us", or "Witprinted" in this policy refer to Sawary Trading LLC. Contact us at hello@witprinted.com.

2. What we collect

2.1 Information you give us directly

• First name and selected vibe when you use the generator. Required to produce your dictionary entry.
• Email address at checkout. Required to send order confirmation, shipping updates, and (if you opt in) marketing.
• Shipping address at checkout. Required to deliver your order.
• Payment details are entered directly with our payment processor (Stripe). We never see or store your card number, CVC, or full bank details.
• Photos (Phase 2 only). When we launch image-based products, you may upload a photo of yourself or someone with their permission. EXIF metadata (GPS, device, timestamp) is stripped on upload. Photos are deleted from our storage within 24 hours of order fulfillment, and hard-purged within 7 days at the latest.

2.2 Information collected automatically

• Anonymous analytics via Plausible Analytics: page views, referrer, country (no IP stored, no cross-site tracking, no Meta or Google pixels).
• Hashed IP and user-agent on consent and privacy actions. We hash with a per-deployment salt and never store raw values. This is for fraud prevention and audit only.
• Cookies. See our Cookie Policy.

2.3 Information from third parties

Stripe shares limited transaction metadata with us (payment status, last four digits of the card, billing country) so we can fulfill your order and resolve disputes. Stripe does not share your full card details with us.

3. How we use it

• Generate your dictionary entry and (Phase 2) cartoon portrait.
• Process your payment, route your order to our print partner, and ship it.
• Send you transactional emails about your order: confirmation, production updates, shipping, delivery.
• Send you marketing emails only if you check the optional opt-in box at checkout. You can unsubscribe at any time.
• Detect and prevent fraud, abuse, and AI-safety violations.
• Improve the product (anonymised, aggregated metrics only).

4. Who we share it with

We share specific data with the following sub-processors strictly for the purposes of running Witprinted. Each is bound by a Data Processing Agreement (DPA).

• Gelato (print and shipping partner) — your shipping name, address, phone (if provided), and the print file. Gelato is ISO 27001 + SOC 2 Type II certified.
• Stripe (payments) — payment information.
• Supabase (database and storage) — encrypted at rest. SOC 2 certified.
• Anthropic (AI text generation) — only your name and selected vibe, with zero-retention enabled. Anthropic does not retain inputs after generating the response and does not use them to train models.
• Resend (transactional email) — your email address and the email content.
• Plausible (analytics) — anonymous aggregated metrics. No IP storage, no cookies, no cross-site tracking.
• Phase 2 only: OpenRouter / Google (image AI, zero-retention), Replicate (upscaling), remove.bg (background removal, no-storage option enabled), AWS Rekognition (celebrity face detection on uploaded photos for safety).

We do not sell your personal information. We do not share it with advertising networks. We do not share it with anyone for purposes other than running this service.

5. How long we keep it

• Uploaded photos (Phase 2): deleted within 24 hours of order fulfillment, hard-purged within 7 days at the latest.
• Generated outputs (text, future images): retained for 30 days after delivery for support and refund handling, then purged.
• Order records: retained for 7 years for US and Canadian tax compliance. We can anonymise your name, email, and shipping address on request, but we keep the de-identified order line.
• Email address: retained until you request deletion.
• Hashed IPs in audit logs: retained for 12 months, then purged.

6. Your rights

6.1 Everyone

• Access: you can request a copy of the personal data we hold about you.
• Correction: you can ask us to correct inaccurate data.
• Deletion: you can ask us to delete your data. We honor this within 30 days. We will keep an anonymised order line for tax purposes; everything else is purged. To start: email hello@witprinted.com or POST to /api/privacy/delete with your email — we'll send a one-time confirmation link.
• Marketing opt-out: every marketing email has an unsubscribe link. You can also email us.

6.2 EU and UK residents (GDPR / UK GDPR)

You also have the right to: data portability, restrict processing, object to processing, and lodge a complaint with your local data protection authority.

Legal basis for processing: contract performance (your order), legitimate interest (fraud prevention, product improvement), and consent (marketing).

Service base and EU representative. Our service base is in the United States. We do not currently sell or ship to the EU or UK; those markets are planned for Phase 2. Before any sale to an EU or UK resident, we will appoint a representative under GDPR Art. 27 / UK GDPR Art. 27 and update this policy with their contact details. Until then, EU and UK residents who have nonetheless interacted with the site (for example used the free generator) may exercise GDPR rights directly via hello@witprinted.com.

6.3 California residents (CCPA / CPRA)

You have the right to know what we collect, request deletion, request correction, opt out of "sale" or "sharing", and limit use of sensitive personal information.

Witprinted does not sell or share your personal information — full stop. We do not sell personal information for monetary or other valuable consideration, and we do not share personal information for cross-context behavioral advertising. We have not done so in the preceding 12 months and we have no plans to.

To exercise any CCPA right, email hello@witprinted.com with subject line "CCPA Privacy Rights Request" and indicate which right you wish to exercise. We will verify your identity (typically by replying to the email on file) before fulfilling the request and will respond within 45 days. You may also designate an authorised agent to make a request on your behalf.

6.4 Quebec residents (Law 25)

Our privacy officer is the Director of Sawary Trading LLC; reach them at hello@witprinted.com. We will support French-language privacy notices before EU/Quebec launch in Phase 2.

6.5 Canadian residents (PIPEDA)

You can request access, correction, or withdraw consent. Same contact channel.

7. International data transfers

Our database and storage are hosted in us-east-1 (Virginia, USA). Gelato fulfillment routes through their nearest facility (32-country network). Stripe and Anthropic process data in the regions they operate in. By using Witprinted, you accept that your data may be transferred to and processed in the United States. We rely on Standard Contractual Clauses with sub-processors for cross-border transfers from the EU/UK/Canada.

8. Security

Data is encrypted in transit (TLS 1.2+) and at rest (Supabase AES-256). Payment processing happens entirely on Stripe — we never see your card details. We use Row Level Security on our database and service-role isolation on PII tables (orders, shipping addresses, consent log, deletion requests).

9. Children's privacy

Witprinted is not directed at children under 13, and we do not knowingly collect data from them. If you are a parent and believe we have collected your child's data, contact us and we will delete it.

10. Changes to this policy

We will post any changes here with a new "last updated" date. Material changes will also be emailed to customers we have an email on file for. Each version is git-tracked; you can request a specific historical version from us.

11. Contact

Sawary Trading LLC (operating Witprinted)
c/o Wyoming registered agent — mailing address available on request
Email: hello@witprinted.com
Privacy requests: hello@witprinted.com (subject "Privacy Request")

The full registered-agent mailing address is on file with the State of Wyoming and will be provided on written request to the email above.