Where the data is held and how we treat authority requests

Who runs the service

VISUAL SPACE Hanna Półtorak, ul. Świemirowska 15 lok. 1, 81-877 Sopot.

Where we hold data

• The service and its database run on Hetzner Online servers in Germany (Nuremberg), in the European Union.
• Uploaded files and photos are stored in S3-compatible object storage, also in Germany (Nuremberg).
• E-mail is sent through Lettermint (Lettermint B.V., the Netherlands). Under its data processing agreement, Lettermint stores and processes message data only in the European Union.
• Messages sent to our contact address land in a mailbox hosted by OVH, a French hosting company, in the European Union.

Providers we do not say hold data only in the Union

• Cloudflare provides network protection: connections to the service pass through its network.
• Our code repository and the pipelines that build and check the service run on GitLab.com (GitLab Inc., USA). When we check that our database backups can be restored, or rebuild the server after a failure, an encrypted copy of the database passes through GitLab for at most one day; GitLab also holds the key that opens it. The copy is decrypted only on a build server we control in Poland.
• Our team receives operational alerts in Slack (Slack Technologies, LLC, part of Salesforce, USA). An alert carries an account or studio identifier, never a name, an e-mail address or the content of anyone's work.
• Signing in with Google (Google Identity Services) works only when someone chooses it. Google then processes data under its own privacy policy.

Requests from public authorities

We disclose data to public authorities only where the law requires it.

This applies to requests from authorities of countries outside the European Union too. A person reads every letter from an authority and considers it individually: we do not answer such requests automatically.