Privacy Policy

TechBuilds EOOD (UIC 206521446), registered in Bulgaria at Bulgaria, Nesebar, operates Spotlight Paws and is the data controller for your personal data under the GDPR and Bulgarian data-protection law.

Contact: privacy@spotlightpaws.com.

We collect only what we need to deliver and operate the service. We do not sell your personal data.

• Account data: email address, sign-in and session data, and account-creation timestamp.
• Marketing preferences: whether you have opted in to product-update emails (via an optional waitlist signup when offered), and any unsubscribe requests.
• Pet photos: reference images you upload. Uploads may incidentally include people, locations, or other personal data in the background — you are responsible for what you submit.
• Generation metadata: scene template selected, generation status, output image, and timestamps.
• Payment records: limited checkout metadata from our payment provider (session ID, amount, currency, country). Card details never reach our servers.
• Technical data: IP address, user-agent, timestamps, and basic request logs used for security and abuse prevention.
• Cookies: see the Cookie Policy.

Transactional emails (magic links, order confirmations, portrait delivery) are sent to perform your order and do not rely on marketing consent.

For security processing based on legitimate interest, we balance our needs against your rights. You may object to that processing where GDPR allows.

We do not make automated decisions about you that produce legal or similarly significant effects.

We use vetted third-party providers to operate the service. Each acts under a Data Processing Agreement and processes your data only on our instructions. The main categories are:

• Payment processing (United States and EU)
• Cloud hosting and database storage (EU)
• AI image generation — inference only (United States)
• Transactional and marketing email delivery (United States and EU)
• Security, rate limiting, and background processing (EU and global)

International transfers to the United States rely on the EU–US Data Privacy Framework where the recipient is certified, or on Standard Contractual Clauses (SCCs) where it is not, with supplementary measures in our processor agreements.

Pet photos and generation prompts are sent to our AI provider for inference only. We do not train Spotlight Paws models on your photos. We select providers whose terms restrict use of API customer content for model training; their terms govern how they handle inputs.

We keep personal data only as long as necessary for the purposes above:

• Account, reference photos, and generation outputs: retained while your account is active until you request deletion.
• Unpaid draft orders: reference photos and draft generation records for orders that never completed checkout are deleted after 24 hours.
• Payment records: retained for the period required by Bulgarian tax and accounting law (currently 10 years for primary accounting records).
• Security logs: typically up to 90 days.
• Deletion and privacy requests: kept as long as needed to demonstrate compliance with our legal obligations.
• Marketing opt-in and opt-out records: kept while relevant; if you unsubscribe, your email is added to a suppression list so we do not contact you again for marketing.

Under GDPR you have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data, and to withdraw any consent you have given. You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP) at https://www.cpdp.bg, or with the supervisory authority in your EU country of residence.

To exercise any of these rights, email privacy@spotlightpaws.com from the address associated with your account, with the subject "Data {access|deletion|export} request" and a brief description of what you want. We may ask you to verify that you control the account email before fulfilling a request.

We respond within 30 days (extendable by a further 60 days for complex requests, in which case we tell you why). We may refuse manifestly unfounded or excessive requests, or charge a reasonable fee where GDPR permits.

What gets deleted on a deletion request: your account, reference photos, generation outputs, and personal generation records. Payment-provider records and related accounting entries are retained for the legally required period, and we may retain data needed to establish, exercise, or defend legal claims.

Marketing emails: you can withdraw consent at any time by using the unsubscribe link in any marketing message or by emailing privacy@spotlightpaws.com from your account address with the subject "Unsubscribe". Opting out does not affect transactional or legally required messages.

We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls, and monitoring for abuse. No online service can guarantee absolute security; if we become aware of a personal-data breach that affects your rights, we will notify you and the relevant supervisory authority where the law requires it.

See the Cookie Policy for the full list. Non-essential cookies are loaded only after you opt in via the consent banner.

Spotlight Paws is not directed at anyone under 18. We do not knowingly process the personal data of anyone under 18. If you believe someone under 18 has used the service, contact us and we will delete the relevant account.

We may update this policy from time to time. The "last updated" date at the top reflects the most recent change. Material changes will be communicated by email to active accounts before they take effect.

Questions, requests, or complaints: privacy@spotlightpaws.com.