Privacy policy

Who we are

Crispost is run by [legal name, address and tax ID], the controller of your data. Contact: hello@crispost.com.

What we collect

• The flyer you upload and everything in it, including photos of people.
• The details we read from it and any changes you make, whether you'd post one of the designs, your brand colours, your email (when you pay, or if you ask us to send a preview), the page language, the time, and your approximate country based on your IP address.
• A scrambled (hashed) form of your IP address, to limit free tries.
• If you accept cookies: Meta Pixel data (pages visited, flyer checks, previews viewed, checkout clicks and purchases).
• If you pay: Stripe handles the payment. We receive your name, email and payment status, never your card number.

Why we use it

• To check your flyer, make your previews and, if you pay, your designs, and email you the files. Legal basis: our contract with you (UK GDPR and GDPR, Art. 6(1)(b)).
• To limit free tries and keep out bots. Legal basis: legitimate interests (Art. 6(1)(f)).
• To measure our ads, only with your consent (Art. 6(1)(a)). Withdraw it any time with the "Cookies" link at the bottom of the page.
• To meet tax obligations when you pay (Art. 6(1)(c)).

We use photos of people only to make your design. We never use your flyer, or anyone in it, in ads or examples without asking.

Who processes it for us

• Vercel (website hosting and bot protection).
• Cloudflare (file storage).
• Resend (email).
• OpenRouter and the AI model providers it connects to, such as OpenAI, to read and redesign your flyer.
• Meta (ad measurement, only with consent).
• Stripe (payments).

Some of these providers are in the United States. Transfers rely on the UK Extension to the EU-US Data Privacy Framework, or on standard contractual clauses with the UK Addendum.

How long we keep it

• Your flyer, the details we read, your designs and the scrambled IP address are deleted 30 days after you upload.
• Your email and our messages: up to 12 months.
• Payment records: as long as tax law requires.

Your rights

You can ask to access, correct, delete, port or restrict your data, or object to its use, by writing to hello@crispost.com. You can also complain to the Information Commissioner's Office (ICO) in the UK, or to the data protection authority where you live.

Children

Crispost is not meant for anyone under 16.

Changes

If this policy changes, we update this page and the date at the top.