Controller and contact
FLASHMASON is operated by a sole trader in Khon Kaen, Thailand. Seller identity and outstanding disclosures are listed in Business information. Contact support.flashmason@gmail.com for privacy questions or use Privacy requests.
This notice describes the implemented service, including Firebase, Google Cloud, Cloudflare R2, Stripe, optional Gemini/Vertex metadata processing and email delivery when configured. It does not claim an EU establishment, appointed representative, DPO, certification or approval that has not been confirmed.
Data and purposes
We process account email, authentication identifiers and profile information; saved designs and shopping bag; order, subscription, License and payment references; support/rights/privacy requests; administrative artwork and metadata; security and operational records; and optional analytics after consent. Full payment-card numbers are handled by Stripe rather than stored by FLASHMASON.
Processing supports accounts, contracts and file delivery, legal/accounting duties, proportionate fraud and security controls, and optional consent-based analytics. Where GDPR/UK GDPR applies, the relevant legal bases include contract, legal obligation, legitimate interests subject to applicable balancing, and consent for optional tracking. Consent is not required for every operational purpose.
Providers and international processing
Firebase/Google Cloud support identity and database/hosting; Cloudflare R2 holds private artwork and delivery files; Stripe processes payments; Gemini or Vertex may analyse previews only when an administrator requests metadata; Resend may send transactional email when configured. Providers can act as processors or independent controllers depending on the service.
Data may be processed in Thailand, the United States and other provider locations. Required processing agreements and lawful international transfer mechanisms must be assessed for the actual entities and locations. This notice does not assert that every transfer is automatically covered by an adequacy decision or certification.
Retention and security
Account data is kept while needed for the account and reasonable closure handling. Order, License, refund and accounting evidence may be retained for up to 7 years under the working retention schedule, or longer where a specific legal duty or dispute requires it. This period must be reviewed against the operator’s actual obligations. Routine support requests should normally be reviewed for deletion or minimisation within 24 months after closure; substantiated rights disputes may need longer retention.
Recently viewed history is limited to 30 entries and older entries are excluded after 30 days. Expired entries are physically removed on a later history write; inactive accounts do not have a daily automatic purge. History can be cleared or recording paused in Recently viewed and exported through My requests & data. Browser copies refresh on synchronization; an offline device may retain its previous local cache until it reconnects or its site data is cleared.
Private originals are not exposed through public previews. Licensed delivery uses short-lived links with owner checks, and account records are access-controlled. No service can promise absolute security. Retention review and deletion are operational tasks; the current site does not claim that every record is automatically purged on a fixed date.
Your rights
Depending on applicable law, you can request access, correction, deletion, restriction, portability or object to certain processing, and withdraw optional consent. Verify your identity through your account or contact support. We may retain records needed for legal duties, payment disputes or existing License evidence and explain any limitation.
You can complain to the relevant supervisory authority, including an EU/EEA data protection authority, the UK ICO or Thailand’s PDPC where applicable. This notice does not require you to contact us before exercising a right to complain.
Use Account → My requests for an authenticated request and account data exports. Account deletion is reviewed by the operator; submitting a request does not immediately cancel a subscription or erase records. Cancel renewal separately if you also want to stop future billing.