Privacy Policy
Last updated: July 19, 2026
This Privacy Policy explains how Leah Spengler operates Picture Weaver (the "Service") and collects, uses, and shares personal data. Leah Spengler is the data controller for the personal data described here.
Personal data we collect
- Account data: email address, authentication identifier, and third-party sign-in profile identifiers if you use Google sign-in.
- Uploaded images: images you add to a weave are processed in your browser and are not uploaded to our servers.
- Purchase records: product purchased, purchase status, and unlock status. Card, billing, tax, and invoice details are handled by Paddle.
- Technical data: IP address, browser type, device data, and basic request logs for security, reliability, and fraud prevention.
- Support messages: information you choose to send when asking for help.
How we use personal data
- To provide accounts and the Service — contract performance.
- To process purchases and unlock paid features — contract performance.
- To keep the Service secure, prevent fraud, and maintain reliability — legitimate interests.
- To respond to support requests — legitimate interests.
- To meet tax, accounting, and legal obligations — legal obligation.
We do not sell personal data or use uploaded images to train models.
Data sharing
- Paddle, our Merchant of Record, for checkout, payments, tax compliance, invoicing, subscription or purchase management, and refunds. See Paddle's Privacy Notice.
- Hosting, infrastructure, and authentication providers that run the Service and keep accounts secure.
- Professional advisers and public authorities where required by law.
Retention and deletion
We keep account and purchase records while your account is active and for a reasonable period afterwards to meet legal, tax, accounting, security, and dispute-resolution needs. Uploaded images are processed locally in your browser and are not retained by us. Data is deleted or anonymised when it is no longer needed.
International transfers
Our providers may process data outside your country. Where UK or EEA data is transferred, we rely on appropriate safeguards offered by those providers, such as adequacy decisions or Standard Contractual Clauses.
Your rights
Depending on your location, you may have rights to access, correct, delete, restrict, or object to processing of your personal data; request portability; withdraw consent where processing is based on consent; and complain to a supervisory authority. Contact Leah Spengler through the Service to exercise these rights.
Security and cookies
We use appropriate technical and organisational measures, including encryption in transit and access controls. We use essential cookies and local storage for authentication and core functionality. We do not use advertising or cross-site tracking cookies.
Contact
Data controller: Leah Spengler. For privacy questions, contact us through the Service. For payment-related privacy questions, contact Paddle at paddle.net.