PRIVACY POLICY

1. Information We Collect

1.1 Information You Provide

We collect information you provide directly when you:

• Create an account: Name, email address, password (stored only as a hash — we never hold the password itself)
• Buy credits or subscribe: Billing information, entered on and held by Stripe, our payment processor. Card numbers never reach our servers.
• Contact us: Name, email, message content, and any other information you choose to provide
• Upload content: Images you upload to create posters, including creator photographs
• Use the service: Poster titles, dates, times, creator names and handles, and design preferences
• Join or run a network: Your membership of a network, your role in it, and the artwork a network uploads

1.2 Information We Collect Automatically

When you use PosterGen, we automatically collect:

• Usage information: Pages viewed, features used, time spent on the platform
• Device information: Browser type, operating system, device identifiers
• Log data: IP address, access times, referrer URLs, error logs
• Cookies: Session and preference cookies (see section 5)

1.3 Information from Third Parties

We may receive information from:

• Stripe: payment confirmations, the last four digits and brand of your card, and subscription status
• A network you belong to: if a network invites you, its owner or admin gives us your email address, and your name if they have it, so we can send the invitation

PosterGen does not offer social sign-in. Accounts are email and password only, so we never receive a profile from Google, Facebook, TikTok or any other provider.

2. How We Use Your Information

We use your information for the following purposes:

2.1 Providing Services

• Create and manage your account
• Process poster generation requests
• Store and deliver your created posters
• Provide customer support
• Send transactional emails (account confirmations, password resets, receipts)

2.2 Improving Services

• Analyze usage patterns to improve features
• Conduct research and development
• Test new features and functionality
• Monitor and prevent technical issues

2.3 Communication

• Respond to your inquiries and support requests
• Send service announcements and updates
• Send marketing communications (with your consent)
• Notify you of plan changes or important updates

2.4 Security and Legal

• Detect and prevent fraud, abuse, and security incidents
• Enforce our Terms of Service
• Comply with legal obligations
• Protect our rights and property

3. Legal Basis for Processing (UK GDPR)

Under UK GDPR, we process your personal data based on:

• Contract performance: To provide the services you've signed up for
• Legitimate interests: To improve our services, prevent fraud, and conduct business operations
• Consent: For marketing communications and optional features (you can withdraw consent anytime)
• Legal obligations: To comply with applicable laws and regulations

4. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

4.1 Service Providers

We share information with trusted third-party service providers who help us operate our business:

• Stripe: payment processing, subject to Stripe’s own privacy policy
• Our hosting provider: the United Kingdom server the platform and your posters run on
• Our email provider: delivery of transactional email such as invitations, password resets and receipts

We do not currently use any third-party analytics or advertising service, so no usage data about you is shared with one.

These providers are contractually obligated to protect your data and use it only for the services they provide to us.

4.2 Within a Network

If you are a member of a network, that network’s owners and admins can see your name and email address, your role and status in the network, and every poster you make in it — including the creator photographs and names used on those posters. This is how a network account works, and it is the basis on which you accept an invitation. We share nothing about you with a network you are not a member of.

4.3 Legal Requirements

We may disclose information if required by law or in response to:

• Legal process (subpoenas, court orders)
• Government or regulatory requests
• Enforcement of our Terms of Service
• Protection of our rights, property, or safety
• Investigation of fraud or security issues

4.4 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and the choices you have.

4.5 With Your Consent

We may share information with other parties when you give us explicit consent to do so.

5. Cookies and Tracking Technologies

5.1 What Are Cookies?

Cookies are small text files stored on your device that help us provide and improve our services. We use the following types of cookies:

5.2 What We Actually Set

Today PosterGen sets only two kinds:

• Essential: your sign-in session and the anti-forgery token that protects it. These cannot be turned off without breaking sign-in.
• Functional: small preferences such as your cookie choice itself, remembered in your browser.

We set no analytics or advertising cookies at present, and we share no usage data with a third party. Our cookie banner offers analytics and marketing categories so that the choice already exists if we ever add them; until then, selecting them enables nothing. If that changes, they will stay switched off until you turn them on, and we will update this policy first.

5.3 Managing Cookies

You can control cookies through your browser settings. Note that disabling essential cookies may affect platform functionality. Most browsers allow you to:

• View and delete cookies
• Block third-party cookies
• Block all cookies (may impact functionality)
• Receive notifications when cookies are set

6. Data Security

We implement industry-standard security measures to protect your information:

• Encryption in transit: the whole site is served over HTTPS/TLS
• Passwords: stored only as bcrypt hashes, never in a form we or an attacker could read back
• Invitation and reset links: stored only as one-way hashes, single use, and expiring
• Private artwork storage: uploaded template artwork is held outside the publicly served part of the server and can only be reached through an authenticated request
• Access controls: access to personal data is limited to the people who need it to run the service
• Logging: account and payment actions are logged so we can investigate suspicious activity

While we strive to protect your information, no method of transmission over the internet is 100% secure. You are responsible for maintaining the confidentiality of your account credentials.

7. Your Data Protection Rights (UK GDPR)

Under UK GDPR, you have the following rights:

7.1 Right to Access

You can request a copy of all personal data we hold about you. You can also export your account data and poster history yourself from your account settings, without asking us.

7.2 Right to Rectification

You can update incorrect or incomplete personal information through your account settings or by contacting us.

7.3 Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal data. We will comply unless we have a legal obligation to retain it. You can delete your account from account settings.

7.4 Right to Restrict Processing

You can request that we limit how we use your data in certain circumstances.

7.5 Right to Data Portability

You can request a copy of your data in a machine-readable format to transfer to another service.

7.6 Right to Object

You can object to processing based on legitimate interests or for marketing purposes.

7.7 Right to Withdraw Consent

Where processing is based on consent, you can withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.

7.8 Exercising Your Rights

To exercise any of these rights, email us at privacy@postergen.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO).

8. Data Retention

We retain your information for as long as necessary to provide services and comply with legal obligations:

• Account data: Retained while your account is active
• Posters and uploads: Retained while your account is active, plus 30 days after deletion
• Payment records: Retained for at least 6 years, and normally 7, because HMRC requires it. These survive the deletion of the account they relate to.
• Support communications: Retained for 3 years
• Marketing data: Retained until you unsubscribe or object
• Log data: Retained for 90 days

After these periods, we securely delete or anonymize your data. Some data may be retained longer if required by law.

9. International Data Transfers

PosterGen runs on a server in the United Kingdom, and that is where your account, your uploads and your posters are stored and processed. The exception is payment data: Stripe is an international processor and handles your card details under its own safeguards. Where any transfer outside the UK/EEA happens, we rely on:

• Standard Contractual Clauses approved by the UK ICO
• Transfers to countries with adequacy decisions
• Appropriate technical and organizational security measures

10. Children's Privacy

PosterGen is not intended for children under 13 years of age (or 16 in some jurisdictions). We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal information, we will take steps to delete it. If you believe we have collected information from a child, contact us immediately.

11. Third-Party Links

Our platform may contain links to third-party websites, services, or resources. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any information.

12. Marketing Communications

12.1 Opt-In

We will only send you marketing emails if you have opted in. You can opt in during account creation or through your account settings.

12.2 Opt-Out

You can unsubscribe from marketing emails at any time by:

• Clicking the "unsubscribe" link in any marketing email
• Updating preferences in your account settings
• Emailing us at support@postergen.co.uk

Note: You will continue to receive transactional emails (receipts, password resets) even if you unsubscribe from marketing.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by:

• Sending an email to your registered email address
• Posting a notice on the platform
• Updating the "Last Updated" date at the top of this policy

Your continued use of PosterGen after changes take effect constitutes acceptance of the updated policy. We encourage you to review this policy periodically.

14. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information we collect and how we use it
• Right to delete your personal information
• Right to opt-out of the sale of personal information (we do not sell personal information)
• Right to non-discrimination for exercising your CCPA rights

To exercise these rights, contact us at privacy@postergen.co.uk.

15. Who to Contact About Privacy

We are not required to appoint a statutory Data Protection Officer and have not done so. Privacy questions and data protection requests are handled directly by TekSpert LTD:

16. Contact Us

If you have questions or concerns about this Privacy Policy or our privacy practices, please contact us: