Privacy

The data controller is [registered name of the operating entity], with its registered office at [registered address]. For any question about how your data is handled you can write to [support email address].

This notice explains which data is collected when you use Kiroku, why, how long it is kept and what rights you have. It covers the site kiroku.it and the application app.kiroku.it.

We collect only the data needed to create, print and ship your book:

• the photographs you upload, to compose and print the photo book;
• your email address, for your account and for messages about your order;
• the shipping address and phone number, which the courier requires for delivery;
• the order data (what you ordered, when, for how much);
• payment data, handled directly by Stripe: the card number never passes through our systems and we do not store it.

We do not ask for data we do not need, and we do not build a profile of who you are from your photographs.

We process your data on precise legal bases:

• performance of the contract: composing, printing and shipping the book you ordered, and helping you if something goes wrong;
• compliance with legal obligations, in particular tax and accounting ones;
• keeping the service safe and working (preventing abuse, handling errors). The draft of the book is free and requires no payment.

We do not run profiled advertising and we do not sell your data to anyone.

Your photographs are the most personal part of what you entrust to us, and they are treated accordingly. They are used only to compose the preview of the book and to print it.

• They are never used to train artificial-intelligence models.
• They are not shown to other users and not published: your project is reachable only by you.
• They are shared only with the print lab, and only to produce your book.

The layout is automatic and deterministic: a program arranges the photos according to fixed rules, not a model that “learns” from your images.

• Projects and photographs: for as long as your account exists. If you delete the account, or a single project, the data is deleted.
• Order data and tax documents: for the period imposed by legal obligations (typically ten years for accounting records).
• Backups: encrypted backups are kept for up to 14 days, then overwritten.

We rely on a few suppliers that process data on our behalf, as processors, each only for the part that concerns them:

• the print lab (Cloudprinter) and the courier, to produce and deliver the book;
• Stripe, to take payments securely;
• the email provider (Resend), to send you service emails;
• the hosting provider (Hetzner, data centres in the European Union), where the service is hosted.

A data processing agreement is in place, or being finalised, with each of them. The full list with locations and roles is available on request at [support email address].

You can always exercise the rights the GDPR gives you over your data:

• access, rectification and portability of the data concerning you;
• erasure: the app offers «Delete account and data», which really does delete photographs, projects and orders (except for records we are legally obliged to keep);
• complaint to the supervisory authority — [competent supervisory authority for the operator] — if you believe the processing is not lawful.

To exercise them, or simply to understand more, write to [support email address]: we reply within the statutory deadlines.