Privacy Policy

The controller responsible for the processing described here (Art. 4 (7) GDPR) is:

SourceArt Ltd
Evagora Pallikaridi 38, 8010 Pafos, Cyprus
info@airsoft-locker.com

For anything not covered here, the same contact handles data protection inquiries.

• Account & profile — email, password (hashed, never stored in plain text), username, display name, and anything you add to your profile (bio, country, team, playstyles, avatar/header images). Legal basis: performance of the contract you enter by creating an account (Art. 6 (1)(b) GDPR).
• Locker & loadouts — the gear you record as owned, wishlisted or previously owned, any photos you attach to it, and the loadouts you build from it. This is the core of the service; the same legal basis applies. Setting a loadout to public makes it, and the profile it is built under, visible to other visitors and to search engines — that visibility is your choice, made per loadout and per profile.
• Uploaded photos for AI renders — if you use the paid AI Operative Render feature, the photo you upload is processed to generate a stylised render. Legal basis: performance of the contract for that purchase (Art. 6 (1)(b)) and, for the confirmation that it is a photo of you or someone who gave you permission, your consent (Art. 6 (1)(a)).
• Payment data — handled by Stripe (see below); we receive confirmation that a payment succeeded and a reference to it, never your card number. Legal basis: performance of the contract (Art. 6 (1)(b)).
• Technical data — IP address and request metadata, kept briefly to operate the service securely (rate-limiting login and signup attempts, diagnosing errors). Legal basis: legitimate interest in running a secure service (Art. 6 (1)(f)).

The following processors act on our behalf under Art. 28 GDPR. None of them may use your data for their own purposes.

• Hetzner Online GmbH (Germany) — hosts the application server. Purpose: running the site. Legal basis: Art. 6 (1)(f) (necessary to operate the service). Retention: for as long as your account or the relevant data exists, per the retention rules in section 4.
• Hetzner Online GmbH — Object Storage (Germany/EU) — stores uploaded and generated images (avatars, headers, locker photos, loadout cards, AI renders) separately from the application server. Same purpose and legal basis as above. Retention: per section 4.
• Stripe Payments Europe, Ltd. (Ireland, part of the Stripe group) — processes payments for the AI Operative Render and Profile Kit. Purpose: payment processing. Legal basis: Art. 6 (1)(b) (necessary for the purchase). Stripe may transfer data outside the EEA under its own Standard Contractual Clauses; see stripe.com/privacy. Retention: financial records are kept for the statutory period required under German commercial and tax law (up to 10 years, §§ 147 AO, 257 HGB) — see section 4.
• Brevo SAS (France) — sends transactional email (verification, password reset, moderation decisions). Purpose: account and service communication. Legal basis: Art. 6 (1)(b) for account emails. Retention: delivery logs are kept by Brevo for a limited period per its own policy; we do not import your inbox.
• Google Ireland Limited — Gemini API — generates the stylised image when you use the paid AI Operative Render or Profile Kit. Purpose: rendering the image you purchased. Legal basis: Art. 6 (1)(b) for the purchase, and Art. 6 (1)(a) for your confirmation that the uploaded photo is of you or someone who gave permission. The uploaded photo and the render may be processed on Google infrastructure outside the EEA, under Google's Standard Contractual Clauses; see policies.google.com/privacy. This only happens if you choose to use the feature — it is off for every other part of the site.

• Uploaded photos (the source photo for an AI render) — deleted 30 days after upload, whether or not it was used, purchased, or led to a successful render.
• Loadout cards and AI renders — kept for as long as the loadout or render they belong to exists. A superseded version (e.g. after you edit and re-save a loadout) is removed within about 7 days of being replaced.
• Avatar, header and locker photos — kept for as long as your account, or the item they are attached to, exists.
• Purchases — the transaction record survives account deletion, anonymised (disconnected from your account), for the statutory period German commercial and tax law requires (currently up to 10 years, §§ 147 AO, 257 HGB). It is never displayed as "yours" again once your account is deleted.
• Everything else tied to your account — deleted when you delete your account (see section 6): your profile, locker, loadouts, images, and the storage objects they reference are removed within a short time of the request (the database rows immediately; the matching files in object storage by a background job that runs right after).

Under the GDPR, you have the right to:

• access the personal data we hold about you (Art. 15),
• have inaccurate data corrected (Art. 16),
• have your data erased (Art. 17) — or delete your own account at any time, which does this directly,
• restrict processing in certain circumstances (Art. 18),
• receive your data in a portable format (Art. 20) — see the export below,
• object to processing based on legitimate interest (Art. 21),
• withdraw consent at any time, without affecting processing carried out before the withdrawal (Art. 7 (3)),
• lodge a complaint with a supervisory authority.

Because the controller (section 1) is established in Cyprus, its lead supervisory authority is the Cyprus Commissioner for Personal Data Protection (Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), 1 Iasonos Street, 1082 Nicosia, Cyprus, dataprotection.gov.cy. If you are resident in Germany, you may instead or additionally lodge a complaint with the data protection authority of your own federal state (Landesdatenschutzbehörde) — the GDPR (Art. 77) gives you this choice explicitly.

Settings → Download my data gives you a JSON export of your profile, locker, loadouts, purchase and entitlement records — everything the account section above covers, in one file, on demand. Settings → Delete account permanently removes your account, profile, locker, loadouts and their images; purchase records survive, anonymised, as described in section 4. For anything the interface does not cover directly, write to the contact in section 1.

We set exactly one cookie: a session cookie that keeps you signed in. It is strictly necessary for the service to function and carries no tracking, analytics or advertising purpose, which is why this site has no cookie banner — German and EU law (§ 25 TDDDG, ePrivacy) only requires consent for cookies that are not strictly necessary, and we set none.

Creating an account requires you to be at least 16 years old, the age at which the GDPR (Art. 8) lets a person consent to an information-society service on their own in Germany.

If this policy changes, the "last reviewed" date above changes with it. Material changes affecting how your data is used will be announced on the site.

Each purchase grants 3 render attempts against one uploaded photo. The photo and every rendered output are private (not visible to anyone but you) until you choose one as your loadout's hero image or profile picture; the photo itself is never published. See section 4 for how long each of these is kept, and the Terms for the stylised-render disclaimer and refund policy.