Privacy Policy.
This policy explains what personal data rawa collects, why, and what you can do about it. The data controller is [LEGAL ENTITY NAME], [NIF/CIF], [REGISTERED ADDRESS], Melilla, Spain. Contact: hello@rawa.im.
1. What we collect
| Data | Why | Legal basis |
|---|---|---|
| Your email address | It is your account. Used to send sign-in links and essential service messages. | Performance of a contract |
| Photographs you upload, and the images generated from them | To provide the editing service you asked for. | Performance of a contract |
| Job records (garment type, fabric, colour, prompts, timestamps, credit movements) | To run your queue, show your history, and keep an accurate credit ledger. | Performance of a contract |
| Billing data (country, VAT number if you give one, payment status) | To take payment and issue correct invoices. | Contract and legal obligation (tax law) |
| Basic technical data (IP address, browser type, server logs) | Security, fraud and abuse prevention, keeping the service running. | Legitimate interests |
We do not ask for your name, address or phone number to use the Service. Card details are handled by Stripe and never reach our servers.
2. Cookies
We use one strictly necessary cookie to keep you signed in. We do not use advertising or third-party analytics cookies, so no consent banner is required.
3. Your images
Uploaded photographs and generated results are deleted 30 days after they are created. We never use your images to train AI models, and we never sell or license them. Access is limited to the account that created them and, where strictly necessary, to maintenance access by us.
4. Who processes data for us
| Provider | Purpose | Location |
|---|---|---|
| Vercel | Application hosting, image storage | EU (Frankfurt); company in the US |
| Neon | Database (accounts, jobs, credit ledger) | EU (Frankfurt) |
| fal.ai | AI image processing | US |
| Stripe | Payments, invoicing, tax calculation | EU/US |
| Resend | Sending sign-in and service emails | US |
Transfers outside the EEA are covered by the European Commission’s Standard Contractual Clauses. Each provider acts as our processor and may only use the data to provide its service to us.
5. How long we keep things
- Uploads and generated images: 30 days.
- Account and job records: while your account exists, then deleted within 90 days of closure.
- Invoices and payment records: as required by Spanish tax law (currently up to 10 years).
- Server logs: up to 12 months.
6. Your rights
Under the GDPR you may request access to your data, correction, deletion, restriction of processing, portability, and you may object to processing based on legitimate interests. Write to hello@rawa.im and we will respond within 30 days. If you believe we have handled your data badly, you can complain to the Spanish data protection authority (AEPD, aepd.es) or to the authority in your own country.
7. Closing your account
Email hello@rawa.im from your account address and we will delete your account and its data, keeping only what tax law obliges us to retain.
8. Changes
If we change this policy materially, we will email registered users before the change takes effect.