GDPR — your data rights

Updated: 2026-10-29

Your data is processed under the General Data Protection Regulation. Here is what rights you have and how each of them is met.

Data controller

Dalius Dobravolskas, trading as ffff.lt, Lithuania. For anything about your data, write to info@cardamon.lt.

Processors

Hetzner Online GmbH (Industriestrasse 25, 91710 Gunzenhausen, Germany). Its machine runs the application, the database files, the mail server the sign-in links come from and the font server, fonts.cardamon.lt: it is all one server. There is an Article 28 data processing agreement with them.

Stripe Payments Europe, Limited (1 Grand Canal Street Lower, Dublin 2, Ireland), only for accounts that subscribe to a paid plan: it takes the payments, and keeps the card details, name and billing address given on its pages. Stripe may transfer that data outside the European Union under the safeguards in its own privacy policy.

Anthropic (Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland), only when you send a message to Claude in the editor: its Claude models answer, from the message and what Claude reads of the project, on its servers in the United States. Card-a-mon's contract, and Anthropic's data processing terms under it, are with Anthropic Ireland; it is Anthropic that takes the data on to the United States, to its parent company and the services it runs on, under adequacy decisions or the standard contractual clauses, as its privacy policy says. Anthropic does not train its models on what is sent through its API.

Because the server stands in the European Union, Card-a-mon does not transfer your projects and artwork to third countries. What is sent to Claude, as above, is the exception. There are no other processors: no analytics, no advertising, no mail-sending service, no backups in anybody else's cloud. Stripe never receives your projects or artwork.

AI assistants you connect

An AI assistant you connect is not a processor of Card-a-mon's. It is a recipient you choose: when you approve it, you instruct Card-a-mon to hand it what it asks for from your projects, and from then on the company that runs it handles that data under its own terms, as a controller in its own right. That company may be outside the European Union, in which case the transfer is made at your request. Card-a-mon gives an assistant access only to the account that approved it, and only until you disconnect it.

Your rights

• Access. Everything kept about you is in the application itself: your address and the AI assistants you have connected on the account page, and your projects and their artwork in the editor. A paid plan, whether it is paid monthly or yearly, and when it renews are on the account page too, and the billing details Stripe holds are under Manage billing there. Each invoice is emailed to you when the payment is taken. For a copy of anything else kept about you, such as the identifier Stripe gives you or the reports of errors in your editor, write to info@cardamon.lt from the address you sign in with.
• Rectification. Your projects, their cards and their artwork are yours to change at any time in the editor.
• Erasure. You delete the account and all of its data yourself on the account page. It takes one click, needs no request and no waiting, and cannot be undone. A connected assistant can be removed on its own from the same page. What an assistant's provider already received is held by that provider; erasure there is a request to them.
• Portability. The account page has a download button: it hands you the SQLite database this account is kept in. Its projects table holds one row per project, with the card set document as JSON, and its images table holds every image you uploaded, as its own bytes. SQLite is an open, documented format that needs no licence and that any number of tools read.
• Restriction and objection. The data is processed only to run the service you asked for, so objecting to the processing leaves no service to provide — deleting the account is what that amounts to. Sharing with an AI assistant rests on your approval alone, and disconnecting it withdraws that at once. For a restriction, write to the address above.

Legal basis

Performance of a contract: to run the editor you signed up to use, and to give an AI assistant access to your projects when you ask for it by approving the connection. Legitimate interest: to keep the service safe, which is what the cap on sign-in link requests comes from, and to look into what went wrong with an AI call, which is what the notes of them are for, and to fix what goes wrong in the editor, which is what the reports of errors are for. Legal obligation: to keep the record of payments for a paid plan that tax and accounting law requires.

How long things are kept

Your data is kept until you delete the account. Inactive accounts are not deleted automatically. A sign-in link lasts fifteen minutes and works once; a session lasts 30 days, and signing out ends it at once. A connected AI assistant keeps its access until you disconnect it or leave it unused for 60 days; the token it sends with each request lasts an hour. A registration that is never approved is removed within a day. A chat with Claude in the editor is kept with the project for 12 months after its last message, and deleted with the project before then. The note of an AI call, which says how it went and not what was said, is kept 90 days, and so is the report of an error in the editor. What Card-a-mon knows of a paid plan goes with the account; the record of payments Stripe keeps is kept for as long as Lithuanian tax and accounting law requires, which is ten years.

Security

• Each account's projects and artwork are in a database file of their own.
• HTTPS only, with HSTS; the session cookie is HttpOnly and Secure.
• Sign-in links, sessions and AI assistants' tokens are stored as digests, never as the secret itself.
• An AI assistant's token opens only the account that approved it, and never works as a sign-in to the site.
• Images fetched from a link are only downloaded from public internet addresses, never from the server's own network.
• Pages are served under a content security policy that allows no inline script, and the app pages are marked not to be cached to disk.
• The server and the data are in the European Union, in Germany.
• Email addresses appear in the log only as a short digest.

Breach notification

If data did leak and that put your rights at risk, you will be told, and so will the supervisory authority, within 72 hours, as the GDPR requires.

Supervisory authority

If you are unhappy with how your data is handled you may complain to the Lithuanian State Data Protection Inspectorate: vdai.lrv.lt.