2. Data We Process
- Your photograph and the image generated from it.
- Your email address and identity (when signing in with Google to claim a prize).
- Usage data: QR scans, prizes claimed, visits, and redemptions.
- Your IP address and the country derived from it, used solely to route you to the city channel relevant to your location and to prevent cross-border misuse. The IP address is also recorded with your consent record as proof of consent (GDPR Art. 7).
3. Purposes and Legal Basis
- Creating your personalized image: to provide the service you request, and with your explicit consent (it involves your image).
- Managing your account and prizes: performance of the service you request.
- Sending commercial communications: your consent (optional and revocable at any time).
- Analytics and CRM for partner venues: our legitimate interest in measuring and improving the service, and/or your consent.
4. Retention Periods
- Original photograph: deleted as soon as the image is generated. Generated image: kept while the album of the channel stays active. You can delete any image at any time from your album or by writing to privacy@kyskam.com.
- Email, identity, and account data: while you remain a user or until you withdraw your consent or unsubscribe.
- Aggregated or anonymized usage data: may be kept for statistical purposes, without identifying you.
5. Recipients
- Image processing provider (currently Replicate), acting as our data processor under contract and only following our instructions.
- Sign-in provider (Google) for authentication.
- Partner venues: only the information necessary to deliver your prize.
We do not sell your data, and we do not use your face to train AI models.
6. International Transfers
Some data may be processed in the United States by our image-processing provider. Such transfers are covered by the EU–US Data Privacy Framework and/or the Standard Contractual Clauses, together with additional technical and organizational safeguards.
7. Your Rights
You may exercise, at any time and by writing to privacy@kyskam.com, your rights of access, rectification, erasure, objection, restriction, and data portability, as well as withdraw your consent (without affecting the lawfulness of processing carried out before withdrawal). You may also lodge a complaint with the competent supervisory authority — in Poland the UODO, or the authority in your country of residence.
8. AI-Generated Content
The images we create are labeled as "AI-generated" in accordance with applicable regulations.
9. Minors
The service is exclusively for individuals aged 18 or over. We do not knowingly process the personal data of minors; if we become aware of any such processing, we will delete the data.
10. Security
We apply reasonable technical and organizational measures, including the deletion of original photos as soon as the image is generated, to minimize risk to your data.
11. Changes to This Policy
We may update this Privacy Policy from time to time. The current version, together with its date, will always be published here.