Privacy policy
Last updated 3 November 2026
This notice explains how Codepower OÜ (“we”) processes personal data when you use bgready (bgready), in accordance with Regulation (EU) 2016/679 (“GDPR”) and Estonian law. It is a draft for review — not legal advice.
1. Controller
Codepower OÜ, registry number 17543223 (Estonia). Registered office: Ahtri tn 12, 10151 Tallinn, Estonia. Data-protection contact: info@codepower.io · Contact.
Lead supervisory authority: Andmekaitse Inspektsioon (AKI), Republic of Estonia — aki.ee. You may also complain to your local EU/EEA authority.
2. Scope and roles
This Policy applies to registered customers, API and plugin users, affiliate participants, and website visitors.
- Account and service data. For your account, billing identifiers, technical logs and affiliate programme data, Codepower OÜ acts as controller.
- Images and shop content you upload. Product photos and related content can contain people or other personal data. For that content, you (the customer) are the controller and we act as your processor to the extent we process images to provide background removal, AI fill, storage during retention, and plugin sync. See the DPA.
3. Data categories
- Account and authentication: email, hashed password or Google OAuth basics when enabled, session identifiers.
- Uploaded images and results: source files, cutouts, masks, previews and AI outputs, retained about 24 hours then deleted.
- Billing: credit balance, purchases, Stripe customer/session/invoice identifiers. Card data stays with Stripe.
- Affiliate and payout: referral codes, attribution, commissions, encrypted payout details when provided.
- API usage logs: API key metadata (not secrets), rate limits, usage events and webhook URLs you configure.
- Plugin / shop data: WooCommerce and Shopify — shop domain, product image references, encrypted tokens.
- Technical data: IP address, user agent, server/error logs, cookies (see Cookie Policy).
- Feedback: messages and optional screenshots/tech details you submit.
4. Purposes and legal bases (Art. 6)
- Providing the Service (accounts, processing, API, plugins) — Art. 6(1)(b) contract; processor instructions for customer images.
- Billing, accounting, tax — Art. 6(1)(b) and (c).
- Security, abuse prevention, fraud — Art. 6(1)(f).
- Transactional email — Art. 6(1)(b)/(f).
- Affiliate attribution via the marketing cookie — Art. 6(1)(a) consent where required.
- Legal claims and DSAR responses — Art. 6(1)(c)/(f).
5. Recipients and processors
We use the recipients below. We do not sell personal data.
| Name | Purpose | Location | Transfer |
|---|---|---|---|
| Contabo GmbH | Application hosting (web, workers, PostgreSQL, Redis) for bgready | EU (Contabo GmbH, Germany; server AS51167, observed FR) | EEA hosting — no third-country transfer for primary store |
| Replicate, Inc. | Background removal and optional AI generation; uploaded images are sent | United States | EU Standard Contractual Clauses (SCCs) / provider DPA |
| Codepower GPU (FLUX Fill) | Local Precise AI fill on our GPU host (FLUX_FILL_URL) | Bulgaria (Cooolbox AD / ITD Network, Plovdiv — AS9070) | EEA — operated by Codepower OÜ |
| Stripe, Inc. / Stripe Payments Europe | Payment processing for credit packs (no full card data stored by us) | EEA / United States (Stripe) | Stripe DPA + SCCs as applicable |
| Transactional mail (mail.mybookslot.com) | Transactional email (Postfix on Contabo mail VPS, task 047) | EU (Contabo GmbH; mail host 77.237.235.175) | EEA hosting |
| Shopify Inc. | Shop domain, product image references and encrypted tokens when the Shopify app is used | Canada / United States (Shopify) | SCCs / Shopify DPA when the app is connected |
| WordPress / WooCommerce (customer site) | Customer-operated shop; plugin calls our API with images they select | Customer-controlled | Customer is controller of their shop data |
| Google (optional sign-in) | OAuth identity when Google sign-in is enabled | EEA / United States | SCCs / Google DPA when feature enabled |
Pexels is a stock source (images downloaded into our library; we do not send your personal data to Pexels).
6. International transfers
Where a recipient processes data outside the EEA (notably Replicate in the US, and Stripe/Shopify/Google as applicable), we rely on Chapter V GDPR safeguards including the European Commission’s Standard Contractual Clauses (SCCs) and the provider’s DPA.
7. Retention
- Uploads / results: about 24 hours.
- Server / error logs: up to 90 days.
- Usage event details: up to 12 months, then aggregated; details deleted.
- Feedback: up to 24 months.
- Affiliate clicks (hashed visitor id): up to 13 months.
- Stripe webhook records in our systems: up to 12 months.
- Infrastructure backups: target 14–30 days.
- Fiscal / billing records: as required by Estonian accounting rules (commonly up to 7 years), with identifiers anonymised on account deletion where possible.
8. Rights and how to exercise them
You may request access, rectification, erasure, restriction, portability and objection, and withdraw consent for marketing cookies. In Settings you can export your data and delete your account. Other requests: info@codepower.io. We respond without undue delay and within one month unless the law allows an extension. Complaints: AKI or your local authority. See also GDPR.
9. Cookies
See the Cookie Policy. Non-essential (affiliate) cookies are set only after consent.
10. Security
We apply technical and organisational measures appropriate to the risk (access control, encryption in transit, private media storage, token encryption, retention jobs). Summary: GDPR page; internal TOMs for staff.
11. Children
The Service is not directed at persons under 16. We do not knowingly collect their data.
12. Changes
We may update this Policy. The “Last updated” date appears at the top. Material changes will be highlighted where practical.
13. Related documents
Terms · Cookies · DPA · GDPR · Refund · Legal notice · Affiliate terms.