Privacy, without the mystery.
Privacy notice · version 2026-09-15-v5
Who is responsible
DigitaleBoost (eenmanszaak), Sportlaan 18, 6658 BJ Beneden-Leeuwen, Nederland. info@digitaleboost.nl
What becomes public
Your pixel drawing, creation number and the neighbor connection you select. Your name and purchase email never appear on the wall. A number or drawing can still identify someone, so avoid personal or sensitive information. Public pages can be copied by visitors.
What stays private
Order references, payment status, service timestamps and the private access token are used to deliver the contract, support you and handle refunds. Stripe collects payment, billing and tax information on its checkout. We never receive your full card details. Order emails use the purchase email returned by Stripe; we do not use it for marketing. Pending email bodies and their original recipient are encrypted in a delivery queue, with provider references for retry and support. Only the original purchase email can receive a recovered private link.
Private living-world preview
If you choose to link an existing purchase to a signed-in account, we store a one-way hash of the Site account identifier with the creation number, link time, assigned neighborhood and plot, and selected house color. If you save an interior, we also store the furniture types, positions, rotations, colors, materials, wall and floor choices, with a revision number and last-save time. This layout is currently visible only through its linked account; visitors are not yet connected. The separate model-house demo keeps changes only for the current visit. The purchase must be proved with its private receipt link. Account email and name are not added to the public world. Approved homes can be shown to other eligible preview participants as a creature number, drawing and address; a saved house does not mean its owner is online. The current preview is solo and has no chat, voice or shared presence. The link and address remain in the preview database so you can return; payment or moderation restrictions immediately block server access. Contact the seller to request unlinking or removal. Removing a public drawing does not delete legally required purchase records.
Who processes data
The site runs on OpenAI Sites with Cloudflare Workers and D1. Stripe handles payments. If checkout opens, Resend is used for transactional receipts and withdrawal acknowledgements. These providers receive data needed for their role. The roles and international arrangements are described below.
Stripe Payments Europe and relevant Stripe entities process checkout, payment, fraud-prevention and legal records. Resend (Plus Five Five, Inc.) sends transactional mail from eu-west-1 Ireland; account data, email metadata, logs and API records are stored in the United States. Resend documents 30-day retention for email content and related delivery records and 7-day recovery backups; account/legal retention can differ. Open and click tracking remain disabled. Cloudflare Sites and D1 host the application and order records. The seller keeps only the order, consent, fulfillment and refund records needed for delivery, support, accounting and legal obligations.
OpenAI Sites data processing terms · Stripe privacy · Cloudflare privacy · Resend privacy
Device storage and optional measurement
Your draft and private order access link may be held in session storage on this device to complete your purchase and restore your draft. A draft expires when this tab session ends. Your optional measurement choice and a random visit identifier are stored for the same session. We do not install ad pixels or upload address books.
Only after you allow measurement do we record visit, edit, creator-completion, checkout-start, invitation, download and share-button events. For consented visits we also record a broad device category from the browser and a country code from hosting geolocation when available. No precise location is stored. Each event is deduplicated per visit identifier and UTC day. The server stores a day-specific hash, source label and event name for 90 days, with expired records removed on subsequent measurement requests or during operator maintenance. These counts exclude people who decline; a share-button click does not prove a published share. Reopen Measurement choices in the footer to withdraw permission for future events. The checkout provider and the private-preview sign-in layer can use their own necessary cookies.
Security and retention
Minute-scoped hashed network identifiers limit abuse. The application expires them after two minutes and removes expired entries on subsequent requests. Cloud hosting may keep separate security logs; its exact retention is specified in the processing details above. Abandoned drafts without a payment-provider session are removed after 30 days during maintenance. Orders linked to a provider session are reconciled before deletion so a delayed payment cannot lose its record. Paid accounting records are retained for the applicable statutory period, generally seven years for a Dutch seller, or ten years where OSS requires this. Public entries remain for the promised service period unless removed or refunded. Entry removal does not erase legally required accounting records.
Your choices and rights
Use your private order link to remove your public entry. For access, correction, erasure, restriction, portability or objection, contact the seller. We use the least information needed to verify a request and normally respond within one month. Where processing uses legitimate interests, you may object. You can complain to your competent data protection authority, including the Dutch Autoriteit Persoonsgegevens. We do not make significant eligibility decisions by automated profiling.
Age and legal bases
The initial paid offer is for people 18 and older. We use contract necessity for fulfilment and selected neighbor connections, legal obligations for tax records, legitimate interests for proportionate security, and consent for optional measurement. No marketing consent is bundled with purchase.