Privacy policy

Nordkod Media AB (Swedish org. no. 559591-6759), Jordal 111, 444 92 Jörlanda, Sweden, is the data controller for the personal data processed in Tilti. Questions? Write to hello@nordkod.io.

• Photos of your pet that you take or upload. When a photo is uploaded we automatically strip hidden metadata such as GPS location and camera details.
• Generated images – the previews and the full-resolution portraits created from your photos.
• Order details – name, e-mail address, delivery address, phone number if you give one, what you ordered, the price and the payment status. We never see or store your card details.
• Technical data – your IP address, used briefly to keep the service secure and to limit how many previews can be made per day.
• Your account, if you create one – your e-mail address, and if you sign in with Google also the name and profile picture Google shares with us. Your saved designs and your orders are linked to the account.
• Reviews you choose to write – the stars, your text, the first name you type, your country and, if you add one, a photo of your product. Location data is removed from the photo before it's stored.
• Your progress in the creator is saved only in your own browser (local storage), so a reload doesn't lose your work. At checkout, your contact details and delivery address are also remembered on this device so you don't have to type them again.

• To create your previews and portraits and to deliver your order – necessary to perform our agreement with you (GDPR art. 6(1)(b)).
• To send order confirmations and delivery updates, and to answer your questions – also part of our agreement (art. 6(1)(b)).
• To keep accounting records – a legal obligation under the Swedish Bookkeeping Act (art. 6(1)(c)).
• To prevent abuse and keep the service secure – our legitimate interest (art. 6(1)(f)).
• To give you an account with your saved designs and orders – part of our agreement when you sign up (art. 6(1)(b)).
• To send you ONE e-mail some weeks after delivery asking how you liked your product – our legitimate interest (art. 6(1)(f)). We never send newsletters.
• To publish your review on the site – your consent, which you give with the tick box on the review form and can withdraw at any time (art. 6(1)(a)).

We never sell your data, we don't use it for advertising, and we don't make automated decisions about you that have legal or similarly significant effects. The AI only looks at your pet.

• Pet photos, previews and generated images: deleted automatically within 30 days. If you order, the portrait you ordered (and its print files) is kept as long as we keep the order, so we can reprint or resend it; the photos you took are still deleted within 30 days.
• Order details: 7 years, as required by Swedish accounting law.
• Your account: until you delete it on your account page (or ask us to). Deleting it removes your e-mail address, name and picture; orders are kept for the accounting period above. Saved designs follow the 30-day rule unless you ordered them.
• Reviews: until you ask us to remove them, or until we stop showing them.
• Technical data for abuse protection: the daily counters are deleted within 2 days. They only hold a scrambled code made from your IP address with a secret key – never the address itself. The same kind of code is stored with each preview and is deleted together with it.
• Local storage in your browser: until you clear it or tap "Start over" in the creator (which also forgets the saved checkout details).

We use carefully chosen providers (processors) that only handle data on our behalf and according to our instructions:

• Vercel – hosting and file storage. Files are stored in Stockholm, Sweden.
• Kie.ai – generates the portraits from your photos and the style you chose.
• OpenAI – checks that each photo shows the right angle (a small, low-resolution copy is sent). Data sent through OpenAI's API isn't used to train their models.
• Gelato – prints and ships your products, and receives the print file plus the name, address and contact details needed for delivery.
• Stripe – handles payments. The payment form on our checkout page is embedded from Stripe, so your card details go straight to Stripe and never pass through us.
• Nordkod – our platform that sends order confirmations, delivery e-mails, sign-in codes and the review request.
• Google – only if you choose "Continue with Google": Google confirms who you are and shares your name, e-mail address and profile picture with us.

Some of these companies are based outside the EU/EEA, for example in the US. When data is transferred there, it's protected by appropriate safeguards such as the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.

Stripe and Gelato may act as independent controllers for parts of their own processing (for example Stripe's fraud prevention). Their own privacy policies apply to that.

When you use the camera guide, your browser downloads the open-source detection model it runs from jsDelivr and Google's file servers. Like any server you load a file from, they see your IP address. The camera picture itself is analysed on your device and is not sent to them.

We set a few small cookies that the service needs to work: tilt_user keeps you signed in (30 days), tilt_dev is a random device code that counts today's free previews, tilt_cur and tilt_cc remember your currency and the country used for prices and delivery, and tilt_oauth protects a Google sign-in while it's in progress (10 minutes). None of them track you across other sites.

Tilti doesn't use cookies for tracking, analytics or advertising – which is why there's no cookie banner. We also use your browser's local storage to remember your progress in the creator (your photos, chosen style and basket) and, at checkout, your contact details and delivery address on this device. That's strictly necessary to provide the service you asked for, so no consent is needed. You can clear it at any time in your browser settings.

The payment form at checkout is embedded from Stripe and may set Stripe's own strictly necessary cookies for fraud prevention. Stripe's cookie policy applies to those.

Uploaded photos and previews are stored at random addresses that can't be guessed. Full-resolution portraits and print files are stored privately and are only delivered to you if you buy the digital file. All traffic is encrypted (HTTPS).

You have the right to:

• find out what data we hold about you and get a copy of it,
• have incorrect data corrected,
• have your data deleted – unless the law requires us to keep it, as with accounting records,
• restrict or object to how we use it,
• get your data in a machine-readable format (data portability).

E-mail hello@nordkod.io and we'll reply within a month. You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se, or to the data protection authority where you live.

If we change this policy, we update the date at the top. Bigger changes are announced clearly on the site.