1. Who is responsible
The operator of joannerobson.shop is the data controller for the personal data described here. All privacy requests go to support@joannerobson.shop. Replies within one business day, Monday to Friday.
2. What is collected
| Data | Why | Lawful basis | Kept for |
|---|---|---|---|
| Email address | Account identity, receipts, cancellation confirmations, support replies | Performance of the contract | While the account exists, then 30 days |
| Briefs you submit (occasion, theme, tiers, palette, finish, plaque wording) | Producing your renders and decoration brief | Performance of the contract | 30 days, then deleted automatically |
| Renders generated | Letting you return to and download recent work | Performance of the contract | 30 days, then deleted automatically |
| Subscription status and billing records | Running the subscription and meeting tax and accounting duties | Contract and legal obligation | As long as tax law requires, typically 6–7 years |
| Aggregate usage counts (renders per month) | Enforcing plan limits and spotting abuse | Legitimate interests | 13 months |
| Server logs (IP address, user agent, timestamps) | Security, rate limiting, fault diagnosis | Legitimate interests | 30 days |
3. What is never collected
- Card numbers. Payment details are entered on, and held by, an independent PCI-DSS compliant payment processor. Caketta receives only the fact that a payment succeeded, the amount, and the last four digits shown on your receipt.
- Photographs of people. Caketta has no image upload. It cannot receive a photograph of you, a child, or anyone else.
- Special category data. No health, biometric, religious, political or similar data is asked for. Please do not put any into a brief.
4. Your work is not training data
Briefs and renders are not used to train, fine-tune or evaluate any model — not ours, and not a provider's. Where an external image model is used to produce a render, the brief is sent for that single generation under terms that forbid retention for training. Nothing you create is published, sold, or shown to another user.
Every image shown in the public gallery on this site was generated by the operator specifically for the site, not taken from anyone's account.
5. Who your data reaches
- Hosting provider — serves the site and holds the database. Acts only on instruction.
- Payment processor — takes the payment and holds the card data. Has its own privacy policy, shown to you at the payment step.
- Image model provider — receives the text of the brief to produce the render, and nothing that identifies you.
- Email provider — sends receipts, cancellation confirmations and support replies.
Your data is never sold, rented, or shared for advertising. There are no advertising trackers on this site.
6. International transfers
These providers may process data outside your country. Transfers are made under appropriate safeguards — standard contractual clauses or an adequacy decision — and only for the purposes above.
7. Your rights
Wherever you live, Caketta honours the following on request:
- A copy of the personal data held about you.
- Correction of anything inaccurate.
- Deletion of your account and its data.
- A machine-readable export of your data.
- Objection to processing based on legitimate interests.
- Withdrawal of any consent you have given, at any time.
Email support@joannerobson.shop from the address on the account. Requests are answered within 30 days, usually within one business day. There is no charge. If you are in the EEA or the UK you may also complain to your national data protection authority.
8. Deleting everything
Ask for deletion and the account, its briefs and its renders are removed within 30 days. Billing records are kept for the period tax law requires and nothing more. Files you have already downloaded to your own device are yours — we cannot reach them.
9. Security
- The whole site is served over HTTPS; there is no unencrypted route to it.
- Data is encrypted in transit and at rest by the hosting provider.
- Access to the production database is limited to the operator.
- No card data touches Caketta's systems at any point.
10. Children
Caketta is for adults. It is not directed at children, does not knowingly collect data from anyone under 18, and has no image upload through which a child's photograph could be submitted. If you believe a child has created an account, write to us and it will be removed.
11. Cookies
Caketta sets only what is needed to keep you signed in and to remember your plan. There is no advertising or cross-site tracking. See the Cookie Policy.
12. Changes
Material changes to this policy are emailed to account holders before they take effect, and the date at the top of this page always shows the current version.