Privacy policy

Last updated: 2 November 2026 (revision 2)

Sobaluma is the photo-editing service provided by Edi Pavlesic, the data controller, Galija 30, 51500 Krk, Croatia; hello@sobaluma.com, +385 98 178 3786.

Data use and service providers

We process checkout contact and order details, payment status and references, photographs or listing links, filenames, editing instructions and correspondence to take and perform orders, deliver files and handle related requests. The legal basis is performance of a contract or steps requested before ordering. Required financial and complaint records are processed to meet legal obligations. Technical request information and pseudonymised upload-limit identifiers are used for security and abuse prevention, based on legitimate interests. Optional tracking uses consent where required. Required order information is necessary to provide the service; optional marketing consent is separate. We do not make decisions with legal or similarly significant effects solely by automated processing.

Shopify and payment providers operate the store, checkout, payments, records and notifications. Our photo inbox does not collect card numbers. Cloudflare hosts private photo uploads and downloads, linked order references and instructions, and Turnstile security checks. OpenAI receives image content and relevant instructions when its AI-assisted editing tools are used. Email and file-delivery providers process the contact details and material needed for delivery or correspondence. Submit only material needed for the order and avoid people, documents or other unnecessary personal information.

Providers may process data outside the European Economic Area. Where required, transfers rely on an applicable adequacy decision or safeguards such as standard contractual clauses; contact us for information about the safeguards applicable to your data. Shopify may also act as an independent controller. Shopify Network Intelligence is enabled: depending on location and consent, interactions may be used with data from other merchants for personalisation, analytics and advertising. See Shopify's consumer privacy information. Optional device-data use requiring consent is subject to your choices.

Retention

Incomplete uploads expire after 2 hours and complete unpaid uploads after 24 hours. Paid originals remain available until delivery, then expire after 48 hours. Downloads stop at expiry; hourly cleanup normally removes files within the following hour, with delays possible if cleanup fails. Local working copies and finished client photographs are deleted 7 days after delivery, except for a separate retention agreement, an active dispute or a legal obligation. Expired inbox metadata is removed once more than 7 days old, delivery-reconciliation records after 30 days, and security/quota identifiers through the short operational cleanup cycle.

Photo deletion does not delete order, payment or email records. Those records are retained for applicable legal record-keeping periods and as necessary to perform the contract or establish, exercise or defend claims. Written-complaint records are kept for at least one year. Providers have their own applicable retention periods. Keep your own delivered copies. Use of client photographs in our portfolio or advertising requires separate permission.

Cookies and privacy choices

Necessary technologies support checkout, security and consent settings. Optional preference, analytics and advertising technologies are subject to consent where required; optional consent is not needed to order. Use Cookie settings in the footer to manage or withdraw consent. See Shopify's cookie information for cookie purposes and durations. Our language preference is stored until cleared or preference consent is withdrawn; the country-detection session marker lasts for the browser tab's session.

Subject to applicable conditions, you may request access, correction, deletion, restriction or portability, object to processing based on legitimate interests, or withdraw consent without affecting earlier lawful processing. Contact the controller above; proportionate identity checks may be needed. We normally respond within one month, with any lawful extension explained. You may complain to AZOP or another competent supervisory authority.