Privacy policy
Last updated October 31, 2026
This policy explains what personal data UglySweater.shop collects, why, who we share it with and what your rights are. The controller is Matthias Van Gorp Kft.; you can reach us at info@uglysweater.shop (more details on the contact page).
What we collect and why
| Data | What for | Legal basis |
|---|---|---|
| Account: name, email, password (stored hashed), or your Google profile name and email if you sign in with Google | Your account, signing in, emails about your designs and orders | Contract |
| Designs: your chat messages, yarn choices and the drawings, patterns and previews made from them | Making and showing your designs; producing orders | Contract |
| Photos you upload: a subject to draw (a pet, a house…) or yourself for a try-on | Drawing the subject; making the try-on picture; our staff checking how well designs come out and handling support (photos to draw from only) | Contract, and your consent for try-on photos of people; legitimate interest for our quality checks |
| Orders: name, shipping address, email, phone number, what you ordered | Producing and delivering your order, customer service, accounting | Contract; legal obligation (tax and accounting records) |
| Creators: commissions earned and your Stripe payout account reference | Paying commissions | Contract |
| Technical: IP address, browser, request logs, a random guest ID in a cookie | Security, preventing abuse, remembering your designs before you sign in | Legitimate interest |
| Analytics and advertising: pages you view, how you got here, device and browser type, approximate location (country/city), and events such as signing up, starting checkout and ordering (with the order value) | Seeing which pages and designs people use, to improve the site; measuring and improving our ads on Facebook and Instagram; session recordings (clicks, scrolling, what the page shows; no typed text, photos or addresses), kept for 30 days on our own server and read by our staff and an AI assistant (without names or email addresses), to find and fix problems | Your consent (“Accept all” in the cookie banner). Outside the EU/EEA, the UK and Switzerland: on by default, and you can opt out (see “Your choices in the United States”) |
On your first visit we look up which country your IP address is in, to show prices in your currency. The lookup happens on our own server, in a database from DB-IP, and the result is not stored.
We only send emails about your account, designs and orders. We don’t send marketing emails, and we don’t sell your data.
Your photos
Uploaded photos and try-on pictures made from them are private: they never appear in the gallery or in session recordings, and you see them through links that expire. Photos you upload for us to draw from (since 1 November 2026) can also be seen by our staff, to check how well the designs made from them come out and to help you if you contact us; nobody else sees them. Photos of yourself for a try-on, and try-on pictures, only you can see. Everything is deleted automatically after 30 days, or straight away when you delete it or your account.
What is public
Nothing you make is public unless you share it to the gallery. A shared design shows its title, description, tags, your display name, the knitted previews and pictures of our AI models wearing it. You can withdraw it at any time.
Who we share data with
We use these service providers, each only for its task and only with the data that task needs:
- Akamai (Linode): hosting; our servers are in Frankfurt, Germany.
- Printful: knits and ships your order; receives your name, shipping address, email, phone number and the design files.
- Stripe: payments, sales tax calculation and creator payouts; collects card and payout details directly.
- xAI: the AI image model; receives your design requests and any photos you attach.
- OpenAI: automatic moderation of design requests, designs and pictures.
- Mailgun: sends our emails (EU region).
- Google: sign-in, only if you choose to sign in with Google; and Google Analytics, only if you accept analytics cookies (on by default outside the EU/EEA, the UK and Switzerland).
- Meta (Facebook, Instagram): the Meta Pixel, only if you accept analytics and advertising cookies (on by default outside the EU/EEA, the UK and Switzerland, unless you opt out of selling or sharing). Meta may combine this with what it knows about you if you have a Meta account; see Meta’s privacy policy.
Some of these companies are based in, or process data in, the United States. Those transfers are covered by the EU–US Data Privacy Framework where the company is certified, or by the European Commission’s standard contractual clauses.
How long we keep data
- Photos and try-on pictures: 30 days at most.
- Your account and designs: until you delete your account.
- Order and payment records: as long as tax and accounting law requires, even after you delete your account.
- Server logs: a few weeks.
Your rights
You can ask for access to your data, a copy of it, corrections, deletion, restriction or to object to how we use it, and you can withdraw consent at any time. Most of this you can do yourself: Settings → Privacy has “Download my data”, and Settings → Profile lets you delete your account. For anything else, email info@uglysweater.shop. You can also complain to a data protection authority, in the country where you live or work, or in Hungary.
Your choices in the United States
Some US state laws (such as California’s CCPA/CPRA) treat sharing data with advertising partners for ads as “selling” or “sharing” personal information. We don’t sell your data for money, but the Meta Pixel and Google’s advertising features count. Click “Do not sell or share my personal information” at the bottom of any page to turn them off in that browser; we also honour the Global Privacy Control signal your browser may send. To switch off analytics as well, use Settings → Privacy or contact us.
Cookies
See our cookie page.
Children
UglySweater.shop is not meant for children under 16, and we don’t knowingly collect their data.
Changes
If we change this policy, we update this page and the date at the top. For important changes we let account holders know by email.