Privacy Policy
Last updated: June 2026
This policy explains how Kakavaanen (kakavaanen.com), operated by Aleksandar Donchev (sole trader, United Kingdom), collects and uses your personal data. We are committed to protecting your privacy in line with the UK General Data Protection Regulation (UK GDPR).
1. Who We Are
Data controller: Aleksandar Donchev, trading as Kakavaanen, United Kingdom.
Contact: admin@kakavaanen.com
2. What Data We Collect
| Data | Why we collect it | Legal basis |
|---|---|---|
| Email address | Account creation, login, transactional emails | Contract |
| Password (hashed) | Authentication | Contract |
| Credit balance and transaction history | Managing your purchased credits | Contract |
| Prompts you submit | Generating images — sent to OpenAI's API | Contract |
| Billing address and country | Payment processing and UK-only enforcement | Contract / Legal obligation |
| Stripe payment reference | Reconciling purchases, preventing duplicate grants | Contract |
We do not collect your card number. Payment details are handled entirely by Stripe.
3. Third Parties
Stripe — processes payments. Your billing details and payment method are subject to Stripe's Privacy Policy.
OpenAI — processes the text prompts you submit to generate images. Prompts are sent to OpenAI's API and subject to OpenAI's Privacy Policy. Do not include personal information in your prompts.
We do not sell your data to any third party.
4. How Long We Keep Your Data
- Account data — kept for as long as your account is active, plus 12 months after deletion
- Payment records — kept for 7 years (UK legal requirement for financial records)
- Prompts — not stored by us beyond the API call; OpenAI's retention policy applies
5. Your Rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your account and data (subject to legal retention requirements)
- Object to processing
- Data portability
To exercise any of these rights, email admin@kakavaanen.com. We will respond within 30 days.
6. Cookies
We use a single session cookie to keep you logged in. We do not use tracking, advertising, or analytics cookies.
7. Security
Your data is stored on a secured private server in the United Kingdom. Passwords are hashed and never stored in plain text. All connections use TLS encryption.
8. Changes to This Policy
We may update this policy. The date at the top of this page will reflect the latest version. Significant changes will be communicated by email.
9. Complaints
If you have concerns about how we handle your data, you can contact the UK Information Commissioner's Office (ICO) at ico.org.uk.