GDPR and data protection
Last updated 3 November 2026
Plain-language summary under Arts. 13/14 GDPR. Details in the Privacy Policy and Cookie Policy prevail if wording differs.
1. Controller
Codepower OÜ, registry 17543223, Ahtri tn 12, 10151 Tallinn, Estonia. Contact: info@codepower.io. Lead authority: Andmekaitse Inspektsioon (AKI).
2. What we process
Account data, images you upload (often as your processor), billing via Stripe, affiliate data, API/plugin metadata, logs/cookies, and optional feedback. Full list: Privacy Policy §3.
3. Why
To run the Service (contract), meet legal duties (accounting), keep the platform secure (legitimate interests), and — for affiliate cookies — consent.
4. Sub-processors
| Name | Purpose | Location | Transfer |
|---|---|---|---|
| Contabo GmbH | Application hosting (web, workers, PostgreSQL, Redis) for bgready | EU (Contabo GmbH, Germany; server AS51167, observed FR) | EEA hosting — no third-country transfer for primary store |
| Replicate, Inc. | Background removal and optional AI generation; uploaded images are sent | United States | EU Standard Contractual Clauses (SCCs) / provider DPA |
| Codepower GPU (FLUX Fill) | Local Precise AI fill on our GPU host (FLUX_FILL_URL) | Bulgaria (Cooolbox AD / ITD Network, Plovdiv — AS9070) | EEA — operated by Codepower OÜ |
| Stripe, Inc. / Stripe Payments Europe | Payment processing for credit packs (no full card data stored by us) | EEA / United States (Stripe) | Stripe DPA + SCCs as applicable |
| Transactional mail (mail.mybookslot.com) | Transactional email (Postfix on Contabo mail VPS, task 047) | EU (Contabo GmbH; mail host 77.237.235.175) | EEA hosting |
| Shopify Inc. | Shop domain, product image references and encrypted tokens when the Shopify app is used | Canada / United States (Shopify) | SCCs / Shopify DPA when the app is connected |
| WordPress / WooCommerce (customer site) (customer-side) | Customer-operated shop; plugin calls our API with images they select | Customer-controlled | Customer is controller of their shop data |
| Pexels (source) | Stock background images downloaded into our library (no personal data sent) | Global CDN | Listed as a content source, not a personal-data processor |
| Google (optional sign-in) | OAuth identity when Google sign-in is enabled | EEA / United States | SCCs / Google DPA when feature enabled |
5. Retention
Images ~24 h; logs 90 days; usage details 12 months then aggregates; feedback 24 months; affiliate clicks 13 months; Stripe webhook copies 12 months; backups 14–30 days; billing as required by law.
6. Your rights
Access, rectification, erasure, restriction, portability, objection, withdraw consent, complain to AKI. Export and delete from Account → Settings. Other requests: info@codepower.io.
7. Automated decisions
We do not use Art. 22 automated decision-making that produces legal or similarly significant effects about you.