Privacy Policy

Who is responsible

SOV GLOBAL VENTURES SL, tax ID ESB01992601, registered at C/ Rufino Gea, 2, 03300 Orihuela, Alicante, Spain. For questions or requests about your data: team@grafiksbox.com.

What data we process and why

When you access your account, we process your email, profile details and necessary authentication information. We manage subscription status, credit movements, downloads and orders to provide the contracted service. Full card details are entered with the payment provider; never email them or include them in a brief.

Signing in with Google is optional. If you choose it, Google shares your account identifier, verified email, name and profile picture with Grafiks+. Supabase stores the linked identity and manages your session. We use this information to authenticate you and manage your account. We do not request access to Gmail, Drive or your Google password. If the verified email matches an existing Grafiks+ account, Supabase links the sign-in to that account. You can revoke the connection in your Google Account; this does not automatically delete your Grafiks+ account. Contact team@grafiksbox.com to request its deletion.

Signing in with Grafiksbox is optional. If you choose it, Shopify shares your customer identifier and email with Grafiks+ to authenticate you through your Grafiksbox account. Supabase stores that identity and manages your Plus session. If the provider confirms an email matching an existing Plus account, Supabase can link the sign-in to that account. A different email corresponds to a different account. This sign-in does not import orders or grant a plan, credits or administrative permissions. Grafiksbox and Plus sessions are independent: signing out of Plus does not sign you out of the store.

If you contact us, we use your message and contact details to respond. Necessary technical logs help maintain site availability and investigate unauthorized access.

In design previews, drafts, favorites and test actions are saved in your browser. AI and admin simulations do not send drafts to a model or update your account balance. Do not enter sensitive information in a demo.

Legal bases for processing

Managing an account, download or order is based on performing your contract or taking steps you request before entering a contract. Billing and tax obligations are processed to comply with legal requirements. Security and abuse prevention rely on legitimate interests, with respect for your rights.

Marketing communications requiring consent and optional tracking technologies will not be activated without the appropriate legal basis. You may withdraw consent without affecting prior processing.

Services involved

The platform uses Vercel for hosting and Supabase for authentication and account data. Shopify serves the catalog and some existing integrations. Stripe manages payments and subscriptions. Resend handles transactional communications where enabled. Each provider receives the data needed for its role.

Klaviyo maintains our Grafiks+ member directory in the same account used by Grafiksbox. After you verify your email and access Grafiks+, we store your email, account identifier, language, registration and platform entry dates, and account provider there. Signing in does not subscribe you to marketing or restore a previous unsubscribe. Optional browsing tracking requires separate consent.

Opening a catalog image sends a request to Shopify infrastructure. Following an external link or opening a payment portal also subjects you to the destination service’s policies.

Cloudflare storage and an AI provider are being prepared. This information will be updated before new processing is enabled. Where a provider processes data outside the European Economic Area, safeguards required by law must apply, such as an adequacy decision or standard contractual clauses, as appropriate.

Retention and security

We retain necessary data during the service relationship and for applicable legal periods. After an erasure request, some data may remain restricted where needed for obligations or claims. Local drafts remain in your browser until you delete them.

Account access requires authentication. Do not share your credentials. If you suspect unauthorized access, contact us from your account email.

Your rights

You may request access, rectification, erasure, restriction, objection and portability where applicable by emailing team@grafiksbox.com. We only request information needed to verify your identity. You may lodge a complaint with the Spanish Data Protection Agency (aepd.es).

Requests relating to previous data or contracts remain valid while we renew the platform.

Updates

Relevant changes will be published here. This policy describes Grafiks+; the main store has its own policy at grafiksbox.com/policies/privacy-policy.