Privacy Policy

1. Data controller

1.1FluffyFile is operated by [legal name], [registered address], Czech Republic, identification number (IČO) [number] (“FluffyFile”, “we”, “us” or “our”), which is the controller of the personal data processed through the FluffyFile website and services (the “Service”).

1.2Enquiries regarding personal data may be sent to privacy@fluffyfile.com.

2. Children

2.1The Service is intended solely for adults, as set out in our Terms and Conditions, and is not directed at children. We do not knowingly collect personal data from minors, including children under the age of 13.

2.2If we become aware that we have collected personal data from a minor, we will close the relevant account and delete that data, save where retention is required by law. Parents and guardians may contact us at privacy@fluffyfile.com.

3. Personal data we collect

3.1Account data: your email address, display name and password, which is stored in hashed form only.

3.2Third-party account data: where you sign in with Google or Discord, the account identifier, name, email address and profile picture link provided by that service; where you connect a Twitch account, the account identifier and username provided by Twitch.

3.3Commission data: information you submit in connection with a commission, including your brief, reference images, reviews and any communications you send through the Service in connection with a commission.

3.4Payment data: the amount and status of your payments. Card details are handled by our payment processor and are not received by FluffyFile.

3.5Technical data: your IP address and sign-in activity.

3.6Application data: where you apply for a role with FluffyFile, the information you choose to send us by email, including your portfolio.

4. Purposes and legal bases

4.1Performance of a contract (Article 6(1)(b) GDPR): to operate your account, produce and deliver commissions, and process payments.

4.2Legitimate interests (Article 6(1)(f) GDPR): to secure accounts and payments; to prevent fraud, spam and abuse; and to enforce our Terms and Conditions, including by reviewing content and communications submitted through the Service.

4.3Legal obligation (Article 6(1)(c) GDPR): to maintain tax and accounting records.

4.4Providing personal data is not mandatory; however, without it we are unable to create an account or fulfil a commission. We do not send marketing communications and do not sell personal data.

4.5Reviews: a review you submit may be published on the Service together with the display name on your account. You may ask us to remove it at any time.

5. Recipients and international transfers

5.1Personal data is shared only with service providers engaged in operating the Service: our hosting and email provider, our payment processor Revolut, which receives your email address in order to issue a payment receipt, our bot-protection provider, Google or Discord where you choose to sign in with them, and Twitch where you choose to connect it.

5.2Some of these providers are located outside the European Economic Area. Where personal data is transferred outside the EEA, it is protected by appropriate safeguards under the GDPR, such as the European Commission's Standard Contractual Clauses.

6. Retention

6.1Personal data is retained for as long as your account remains active and as necessary for the purposes described in this policy.

6.2Upon a request to delete your account, we will erase your personal data, except where retention is required by law. Payment and accounting records are retained for the period required by Czech tax and accounting legislation.

6.3Commission communications and reference material are deleted within 12 months of delivery. Technical data such as IP addresses is deleted within 90 days. Accounts that are never verified are deleted within 30 days. Discount codes issued to a connected Twitch account that were never used are deleted within 90 days of expiring. Application data is deleted within 6 months of our decision on the application, unless you ask us to keep it on file.

7. Your rights

7.1Under the GDPR, you have the right to access your personal data, to request its rectification or erasure, to restrict or object to its processing, and to data portability.

7.2Requests may be submitted to privacy@fluffyfile.com from the email address associated with your account. We will respond within one month of receipt.

7.3You also have the right to lodge a complaint with the Czech Office for Personal Data Protection (ÚOOU) or with the supervisory authority in your country of residence.

7.4We may ask you to confirm your identity before acting on a request, for example by writing to us from the email address associated with your account.

8. Changes to this policy

8.1We may update this Privacy Policy from time to time. The date shown at the top of this page indicates the current version.