Soft Spot is a trading name of Endive Limited, a private company limited by shares registered in Ireland, no. 828414, with its registered office at 10 Nutley Lane, Donnybrook, Dublin 4, D04 X3D0. Endive Limited decides how your data is used, which makes it the controller of your data under data protection law.

To ask anything about your data, or to see, correct, download or delete it, email hello@softspotgifts.com. We answer within a month.

If you are unhappy with how we handle your data, you can complain to the Data Protection Commission, Ireland's data protection authority, at dataprotection.ie.

The photos you choose, so we can build your mosaic from them. Nothing leaves your device until you have paid.

The email address you give at checkout, so Stripe can send your receipt and we can reach you about your order.

What you bought, when, and for how much, because the law requires us to keep sales records.

How long each step takes on your device: choosing your photos, paying, uploading, waiting for your mosaic, and opening and zooming it from your order page. These are numbers only (times, counts, and how large the mosaic was drawn on your screen), sent only once you have paid and kept against your order so that we can make the slow steps faster, along with whether it was a phone, a tablet or a computer. They never include anything from your photos, not even a file name, and we do not time anyone who opens a gift link you share.

When something goes wrong on a page of this website, your browser sends us an error report so that we can fix it. This happens on any page, including a gift link and before you have paid. The report holds the error's message, where in our code it happened, and which page it was on, with the private part of any order or mosaic link removed. It never includes your photos, and any email address in it is removed before it is stored.

Your main photo, the picture the mosaic recreates, is deleted as soon as your mosaic has been made.

Your mosaic, and the photos it shows when a tile is tapped, are kept for 5 years from the day you paid, then deleted, unless you delete them sooner.

The record of your order, including the email address it was sent to, is kept for 6 years, because Irish tax law requires sales records to be kept for that long.

Error reports are deleted 7 days after that error last happened.

Open your private order link and choose to delete. Your mosaic links stop working at once and every photo and image stored for your order is deleted for good. The order record stays, as above.

A full refund deletes your mosaic and photos the same way.

Four companies process data on our behalf, each for one purpose:

• Stripe: takes your payment; we never see your card details.
• Supabase: stores your photos and your mosaic, in the European Union.
• Vercel: runs this website.
• Resend: sends our emails about your order.

Your photos and your mosaic sit in private storage that only this service can read. A mosaic opens only through its links, which are long and unguessable, and you can switch a link off by making a new one from your order page.

We never look at your photos, use them to train anything, or show them to anyone but whoever holds your links.