Privacy policy

The controller of your personal data is Fleetiqo LLC, 1130 Ogletown Road, Ste #2, Newark, DE 19711, United States ("StitchMyPic", "we", "us"). For anything related to privacy, write to support@stitchmypic.com.

This policy explains what personal data we process when you use stitchmypic.com and the StitchMyPic app, and the rights you have, including under the EU and UK General Data Protection Regulation (GDPR).

• Account data: your email address, name, password (stored only as a secure hash, never in readable form), language, and whether you agreed to receive news by email.

• Google sign-in data (only if you choose it): your Google account identifier, email address, name and profile picture, as shared by Google.

• Your designs: the pictures you upload, your design settings and details such as size, stitch count and number of colours, and your download history.

• Payment data: what you bought, when, the amount, and the order and transaction references and payer email address that PayPal sends us. We never receive your card number or bank details.

• Credit history: credits added and spent on your account.

• Messages: what you send us through the contact form or by email.

• Technical and security data: IP address, browser type (user agent) for your active sessions, security and audit logs (such as sign-ins and account changes), and counters used to stop abuse such as password guessing.

We don't collect special categories of data, and we don't use analytics, advertising or social media tracking tools.

The digitizing itself (turning your picture into stitches) runs in your web browser, on your own device. We store your original upload and settings on our servers, linked to your account, so you can reopen, edit and re-download your designs later.

Your images are private to your account. We don't sell them, show them to other users or use them for advertising. Our team only looks at a design when you ask us for help with it, or when needed to investigate abuse or a legal request.

• To provide the Service (your account, saving designs, downloads, credits): performance of our contract with you (Art. 6(1)(b) GDPR).

• To process payments, issue receipts and keep accounting records: performance of the contract and our legal obligations under tax and accounting law (Art. 6(1)(b) and (c)).

• To send service emails such as email verification, password resets and receipts: performance of the contract (Art. 6(1)(b)).

• To answer your questions and support requests: performance of the contract, or our legitimate interest in helping people who contact us (Art. 6(1)(b) and (f)).

• To keep the Service secure, prevent fraud and abuse, and fix problems: our legitimate interest in protecting our users and the Service (Art. 6(1)(f)).

• To send news and offers by email, only if you opt in: your consent (Art. 6(1)(a)), which you can withdraw at any time.

• To comply with the law and respond to valid legal requests: legal obligation (Art. 6(1)(c)).

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

We share personal data only with service providers that help us run StitchMyPic, and only as much as they need:

• Hosting: Hostinger International Ltd. (virtual private server, Boston, United States), which hosts our servers and database.

• PayPal: processes payments and subscriptions. PayPal acts as an independent controller for the data you give it during checkout; see PayPal's own privacy statement.

• Google: if you use "Sign in with Google", Google authenticates you and shares your basic profile with us. Google's privacy policy applies to your Google account.

• Email delivery: Hostinger International Ltd., which sends our transactional emails (verification, password reset, receipts).

We may also disclose data if required by law, to protect our rights or users' safety, or to a successor if our business is sold or merged (you would be informed). We never sell your personal data.

Some of our providers, such as PayPal and Google, may process data outside the European Economic Area or the UK. Where they do, the transfer is protected by an adequacy decision (such as the EU–US Data Privacy Framework, for certified companies) or by the European Commission's Standard Contractual Clauses. You can ask us for more information about these safeguards.

• Account data: for as long as your account exists. When you delete your account, we delete or anonymise your personal data within 30 days, except for what we must keep for the reasons below.

• Designs and uploaded pictures: until you delete the design or your account. Deleted items are removed from our servers within 30 days, and from backups when they rotate.

• Payment and order records: as long as tax and accounting law requires (typically up to 10 years, depending on the country).

• Contact messages: up to 24 months after the conversation ends, so we can follow up if you contact us again.

• Sessions: a sign-in session lasts up to 30 days unless you log out earlier.

• Security logs and abuse counters: kept only as long as needed for security purposes, after which they are deleted.

You have the right to:

• access the personal data we hold about you and receive a copy;

• correct inaccurate data (most of it you can edit yourself in your account);

• have your data deleted (you can delete your account yourself at any time);

• restrict or object to certain processing, in particular processing based on legitimate interests;

• receive your data in a portable, machine-readable format;

• withdraw your consent at any time, for example to marketing emails, without affecting earlier processing.

To exercise these rights, email support@stitchmypic.com from the address linked to your account. We'll reply within one month. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work.

We protect your data with measures such as encrypted connections (HTTPS), passwords stored only as salted scrypt hashes, session tokens stored only in hashed form, rate limiting against password guessing, and access to production systems restricted to the people who need it. No system is perfectly secure, but if a breach ever affects your data, we will inform you and the authorities as required by law.

StitchMyPic is not intended for children under 16, and we don't knowingly collect their personal data. If you believe a child has given us personal data, contact us and we'll delete it.

We only use cookies that are needed for the site to work: one to keep you signed in and one to remember your language. Our Cookie policy lists them in detail.

We may update this policy when our Service or the law changes. The date at the top shows the latest version. If a change significantly affects how we use your data, we'll tell you by email or in the app before it takes effect.

Fleetiqo LLC

1130 Ogletown Road, Ste #2

Newark, DE 19711

United States

Email: support@stitchmypic.com