Datenschutzerklärung

OVERVIEW
Every eragoya item is printed with a photograph you upload and a name you enter. This section explains what happens to that photograph: what we do with it, what we never do with it, who else sees it, and how long we keep it. It adds to our general privacy policy and does not replace it. Nothing here limits the rights you have under the GDPR or under mandatory Austrian or EU law.

SECTION 1 - WHAT WE DO WITH YOUR PHOTOGRAPH
To personalise a garment we ask you to upload one photograph containing one clearly visible face.
The photograph is uploaded directly from your browser to our private storage. Our image service then detects the face, crops to the area around it, separates the head and hair from the background, and produces a cut-out image of the head. That cut-out is combined with fixed artwork and the name you enter to produce the exact print file used for production.
You are shown a preview derived from that same print file, and you must approve it before the item can be added to your basket.

SECTION 2 - WHAT WE NEVER DO WITH IT
We do not use your photograph, or anything derived from it, to identify you or anyone else.
We do not create biometric templates or face-recognition profiles.
We do not use it to train machine-learning models.
We do not sell it, and we do not use it for advertising or profiling.
It is used only to make the item you ordered.

SECTION 3 - WHERE IT IS STORED
Your photograph, the cut-out, the preview and the print file are held in private storage that is not publicly listable and cannot be reached by guessing a web address.
Access requires a secret token issued to your personalisation session. We store only a hashed form of that token and never the token itself, and the token is sent in a request header rather than in a web address, so it cannot leak through a link you share or a page you visit next.
Our servers and database are hosted by Railway in the European Union.

SECTION 4 - WHO ELSE SEES IT
To fulfil your order the finished print file is sent to our print partner, Printful, which prints and ships the garment. Payment and checkout are handled by Shopify.
Neither receives your original photograph. Printful receives only the finished print file. We do not share your photograph with anyone else.

SECTION 5 - HOW LONG WE KEEP IT
Every image is given a deletion date at the moment it is created, and an automated process deletes it once that date passes.
- Your original photograph is deleted 7 days after you upload it.
- The head cut-out and the preview are deleted 14 days after they are created.
- If you do not place an order, the print file is deleted 30 days after it is created, so a personalisation you do not complete is fully deleted within 30 days.
- If you do place an order, we keep the print file until your order has shipped and then for 2 years, so that we can reprint your item if you make a warranty claim about a printing defect.
- While an order of yours has not yet shipped, we keep everything relating to it until it has, even if one of the periods above has already passed.
When a deletion date passes we delete the image file itself. We keep the non-image records of your order — dates, internal identifiers, and a checksum that proves which file was printed — and these contain no picture of you.

SECTION 6 - YOUR RIGHTS
You can ask us at any time to delete your photograph and any images derived from it, and to give you a copy of the data we hold about you. You can also ask us to correct it, to restrict how we use it, or to object to our use of it.
Write to hello@eragoya.com. Please note that if you ask us to delete data relating to an order that has not yet shipped, we may be unable to complete that order.
You also have the right to complain to the Austrian Data Protection Authority (Datenschutzbehörde, dsb.gv.at).

SECTION 7 - LEGAL BASIS
We process your photograph in order to perform the contract you enter into when you order a personalised item (Art. 6(1)(b) GDPR). Without it we cannot make the product.
We keep the print file after your order has shipped on the basis of our legitimate interest in being able to honour a warranty claim (Art. 6(1)(f) GDPR).

SECTION 8 - CONTACT
Questions about this section, or any request concerning your data, should be sent to hello@eragoya.com.
eragoya
Viktor Oskar Gehringer
Mühlweg 29
2102 Hagenbrunn
Austria