Privacy Policy

1. Who we are and how to contact us

1.1. Controller of personal data: Kotliar Yana Mykhailivna, sole proprietor (private entrepreneur) registered in Ukraine, tax ID (RNOKPP) 3389002660, address: 12 Poshtova St., apt. 8, Berezan, Brovary district, Kyiv region, 07540, Ukraine ("the Studio", "we", "us"). We trade as Vidlunnya / «Відлуння». The Site is https://vidlunnya.com together with our Telegram bot @vidlunnyastudio.

1.2. Privacy contact: hello@vidlunnya.com, +380 97 075 34 46.

1.3. Responsible person for personal-data protection (Article 24 of the Law of Ukraine "On Personal Data Protection"): Kotliar Yana Mykhailivna, hello@vidlunnya.com. We have not appointed a separate Data Protection Officer within the meaning of Article 37 GDPR; every data request is handled by this responsible person.

1.4. EU representative (Article 27 GDPR): not appointed. We will appoint a representative before regular sales in the EU/EEA begin and list their details here; until then, please raise any matter under this Policy directly with us at hello@vidlunnya.com. You can always act directly against us and complain to the supervisory authority of your country.

1.5. UK representative: not appointed; contact hello@vidlunnya.com.

2. Who this Policy covers

2.1. Customers — adults who order a Package, add Printed Items or use the Free Restoration.

2.2. Depicted Persons — the people in the photographs: the Customer, living relatives, children, people who have died, and bystanders. If you are reading this because a family member ordered a Film with your photo in it, sections 6 and 10 are written for you.

2.3. Site visitors, Telegram bot users and newsletter subscribers.

2.4. This Policy applies to every Order, the Free Restoration and the Site from its effective date. The terms of an Order are in the Terms of Service (Public Offer); cookies are covered by the Cookie Policy; face data is covered additionally by the Face-Data Notice (section 5).

3. What we collect and where it comes from

3.1. We collect only what is needed for the Order, to run the Site and to comply with the law:

3.2. Your contact details, Source Materials and Descriptions are needed to perform the Order: without them we cannot deliver it. A delivery address is needed only for Printed Items. Everything else is your choice.

4. Why we process data and on what basis

4.1. For each purpose we rely on one of the bases provided by the GDPR / UK GDPR and by the Law of Ukraine "On Personal Data Protection" (2297-VI):

4.2. You may withdraw consent at any time (section 10); this does not affect the lawfulness of processing done before withdrawal. Where we rely on legitimate interests you may object, and we will stop unless we can show compelling grounds.

5. Face Similarity Check

5.1. What it is. After restoration we want to be sure that the face in the new image is the same face as in your original — not "someone else". Software computes a numerical representation of facial features (an embedding) for the original and for the restoration and compares the two numbers. It is quality control, not recognition.

5.2. Temporary, never stored. Both representations exist only in working memory for a few seconds while the comparison runs and are destroyed immediately afterwards. We do not write them to disk, keep them in databases, include them in backups or pass them to anyone.

5.3. Not identification, not authentication. This data is not used to work out who is in a photo or to confirm anyone's identity. It is never compared against any database of faces, never sold, never shared with third parties and never used to train models — ours or anyone else's.

5.4. Why we ask for consent. In some places (the EU, the UK, Canada, Australia, several US states) such a numerical representation may be regarded as biometric data. So we ask for your separate consent at checkout (checkbox 3) — for yourself; for other living Depicted Persons you confirm that they have agreed.

5.5. People who have died. Data-protection laws do not apply to the deceased (with a few exceptions — section 16.1), but we apply the same destruction rules to every face without exception.

5.6. Declining or withdrawing. You may decline or withdraw consent — write to hello@vidlunnya.com before production starts. We will then check the likeness manually: a person will compare the images by eye, and no numerical representation is computed. This is free of charge, and declining the automated check is never a reason to refuse you the service.

5.7. US and Canada. For Orders from the US and Canada the Studio may not run the automated check at all and rely on manual review only. Residents of Illinois, Texas, Washington and Colorado are also addressed by the separate Face-Data Notice and Retention & Destruction Policy — https://vidlunnya.com/legal/en/face-data.html. It forms part of this Policy.

6. Other people in your photos: living relatives, children, the deceased

6.1. Living people. Before uploading a photo that shows a living person other than you, tell them what you are ordering, show them this Policy and get their agreement. You confirm this at checkout. We do not contact these people ourselves — we have no way to reach them — but we act on their requests (6.4).

6.2. Children. You may upload a child's photo only if you are the parent or guardian, or have that person's consent. We never show children publicly.

6.3. The deceased. The GDPR, the UK GDPR and Ukrainian law do not apply to the data of people who have died. We nevertheless respect the family-consent rules for public display of a person's image: in Ukraine, Article 308 of the Civil Code (children and the surviving spouse; failing them, parents and siblings); in Germany, § 22 KUG (10 years after death); and the extended protection in Denmark (10 years) and Estonia (10 years; 20 for minors). That is why we show Deliverables publicly only under a separate Marketing Release, and why at checkout we ask you to confirm that you are a family member and know of no objection from those entitled to consent.

6.4. If you are a Depicted Person or a relative of someone who has died. Write to hello@vidlunnya.com. We will explain what data we hold and, on your request, remove your image from the Source Materials and Deliverables or stop processing, and tell the Customer. Section 10 explains how we verify who is asking.

7. Who we share data with

7.1. We share data only with those needed to perform the Order, run the Site or comply with the law. Every processor (a "розпорядник" under Ukrainian law) works under a data-processing agreement (DPA) and may not use your data for its own purposes. AI providers process photos solely to perform your Order and, under their contracts with us, do not use them to train models. The current list is in the table in section 7 of this Policy.

7.2. Payment providers and carriers are independent controllers for their own services and have their own policies. Print partners see only what they need to print and ship.

7.3. We may also disclose data where the law or a court order requires it, or where necessary to defend our rights in a dispute.

8. International transfers

8.1. We are in Ukraine. Your data is processed by a controller located outside the EU/EEA and the UK. Ukraine has no adequacy decision from the EU or the UK. The GDPR (Article 3(2)) and the UK GDPR apply to us because we offer services to people in those places, and we apply their standards to every Customer, wherever you live.

8.2. Where data is stored. The application and database run on a Hetzner server in Helsinki, Finland (Hetzner, EEA), i.e. within the EEA. Files (Source Materials, Result) are stored in Cloudflare R2: Cloudflare R2, bucket with European Union jurisdiction (files are stored only in the EU; the CDN serves them from the nearest edge) — the bucket's jurisdiction is restricted to the European Union, so the files themselves do not leave the EU. Cloudflare remains a US company in its role as CDN operator, so delivery metadata (IP addresses, edge logs) is processed under SCC and Cloudflare's EU-US DPF certification. Image restoration takes place at OpenAI in the US (8.3). We access Order data and correspondence from Ukraine.

8.3. Transfers to the US. We transfer data to AI and marketing providers in the US under the European Commission's Standard Contractual Clauses (SCCs) built into their data-processing agreements and, for data covered by the UK GDPR, under the UK-recognised transfer mechanisms contained in those same agreements. Where a provider is certified under the EU-US Data Privacy Framework (DPF) we may rely on that certification as well. The Studio itself is not a DPF participant.

8.4. Copy of safeguards. Write to hello@vidlunnya.com and we will send you the relevant clauses (with commercial terms redacted).

8.5. For residents of Ukraine (Article 29 of Law 2297-VI). Transfers to EEA countries and to parties to Convention 108 (Finland, Germany, Ireland) need no further conditions. Transfers to the US (OpenAI, Cloudflare, Google, Meta, TikTok) rest on your unambiguous consent, given at checkout or in the cookie banner, and on their necessity for performing a transaction in your interest.

9. How long we keep data

9.1. Retention periods by category:

9.2. When a period ends, we delete or anonymise the data. If a dispute or audit is under way, we may keep the relevant data until it is closed.

10. Your rights

10.1. Wherever you live, you have the right to: access your data and get a copy; correct inaccurate data; have data deleted ("right to be forgotten"); restrict processing; receive your data in a machine-readable format (portability); object to processing based on legitimate interests; withdraw consent; and not be subject to decisions made solely by automated means that have legal effects (we make none — section 14).

10.2. How to exercise them. Write to hello@vidlunnya.com from the address or account you used for your Order; otherwise we may ask you to confirm your identity (for example, the Order number or a detail only the Customer would know). We reply within one month (for requests under Ukrainian law, no later than 30 calendar days); for complex requests we may extend by two further months and will tell you. Requests are free unless clearly excessive.

10.3. Depicted Persons and relatives of the deceased have the same rights over their own data (6.4). Relatives of a deceased person may contact us on behalf of the family; we take into account the national rules described in sections 6 and 16.1.

10.4. Withdrawing consent. Newsletter — the "unsubscribe" link in every e-mail or an e-mail to hello@vidlunnya.com; cookies — "Cookie settings" in the footer; Similarity Check — 5.6; Marketing Release — an e-mail to hello@vidlunnya.com: we stop further display and remove the publications from our own channels without undue delay (withdrawal takes effect for the future).

10.5. Complaints. Write to us first at hello@vidlunnya.com: we acknowledge within 2 business days and reply within 5 business days. You also have the right to complain to a regulator:

• Ukraine — the Ukrainian Parliament Commissioner for Human Rights, ombudsman.gov.ua;
• EU/EEA — the supervisory authority of your country of residence (list at edpb.europa.eu), for example Germany — the BfDI and the state authorities, Poland — UODO, Czechia — ÚOOÚ, Italy — the Garante, Spain — the AEPD;
• UK — the ICO, ico.org.uk;
• Canada — the Office of the Privacy Commissioner (OPC), priv.gc.ca; Quebec — the Commission d'accès à l'information (CAI);
• Australia — the OAIC, oaic.gov.au;
• US — your state Attorney General.

11. Marketing messages

11.1. We send news and offers only with your separate consent — an unticked checkbox at checkout or a subscription form. Every e-mail carries the Studio's name and postal address and a one-click "unsubscribe" link; we process unsubscribes within 5 business days at the latest. Transactional messages about your Order (confirmation, receipt, delivery) are not marketing and are always sent.

11.2. We comply with CAN-SPAM (US), CASL (Canada), the Spam Act 2003 (Australia), PECR (UK) and Ukrainian advertising law. We do not buy mailing lists and do not e-mail without consent.

12. Cookies and analytics

12.1. Necessary cookies (session, consent state, security, the Delivery Page player) always run. Functional, analytics (GA4) and marketing cookies (Meta Pixel, TikTok Pixel, Google Ads) run only after you choose "Accept" in the banner; no such script loads before consent. "Accept all" and "Reject all" are equally prominent. We use Google Consent Mode v2; your choice is kept for 12 months and can be changed through "Cookie settings" in the footer. Details are in the Cookie Policy: https://vidlunnya.com/legal/en/cookies.html.

13. Children

13.1. Only people aged 18 or over may order. We do not offer the service to children and do not knowingly collect data from anyone under 13. We accept children's photos only from their parents or guardians, or with their consent (6.2). If we learn that a child placed an Order or that a child's photo was uploaded without the right to do so, we stop processing, delete the data and refund what has not been performed. Tell us: hello@vidlunnya.com.

14. Automated decisions

14.1. We make no decisions about you by solely automated means that have legal or similarly significant effects. Our pipeline is automated (restoration, scenes, animation, editing) and the Similarity Check is an automated quality check; but quality control of the Deliverables is the Studio's responsibility, and any refusal under the Content Rules is always decided by a person. If an automated safety filter — ours or an AI provider's — stops a generation, a person reviews the case and contacts you. You may ask for human review of any step.

15. Security and incidents

15.1. We use HTTPS/TLS, encrypted storage, role-based access, token access to the Delivery Page (random key, no indexing) and an action log; we hold no card data. We choose providers for their DPAs and technical safeguards.

15.2. If a breach threatens your rights, we will notify the competent regulator within 72 hours where the law requires it (the GDPR, the UK GDPR and the comparable Canadian and Australian regimes where they apply to us) and notify you without undue delay, describing the consequences and what you can do.

16. Regional supplements

16.1. EU/EEA

We are a non-EU controller to which the GDPR applies under Article 3(2); our representative is in 1.4. This Policy is the notice under Articles 13 and 14 GDPR: for Depicted Persons the source of the data is our Customer and the categories are images and Descriptions; we do not obtain data from public sources. Providing data is a contractual requirement (3.2). On the deceased: in Denmark protection continues for 10 years after death, in Estonia for 10 years (20 for minors); in Italy, Spain, Hungary, France, Slovakia and Portugal relatives may make requests about a deceased person's data, and we honour them (6.4).

16.2. United Kingdom

The UK GDPR and the Data Protection Act 2018 apply to us. Representative or contact — 1.5. We accept complaints at hello@vidlunnya.com and acknowledge them within 2 business days (the law allows 30). You may then go to the ICO: ico.org.uk. Transfers — 8.3.

16.3. United States

We fall below the thresholds of the state comprehensive privacy laws, but we voluntarily follow their principles: we do not sell personal data and do not share it for targeted advertising (Google, Meta and TikTok marketing cookies run only with your consent — declining them in the banner is your opt-out); you have the right to know what data we hold and to delete or correct it (section 10); and we do not discriminate against you for exercising your rights. For California residents, the categories we collect are in section 3; we have not sold and do not sell them. Residents of Illinois, Texas, Washington and Colorado — see the Face-Data Notice (https://vidlunnya.com/legal/en/face-data.html). Contact: hello@vidlunnya.com.

16.4. Canada

We comply with PIPEDA. The person in charge of personal information is Kotliar Yana Mykhailivna, hello@vidlunnya.com. We obtain express consent for sensitive data (the Similarity Check) and, for Canadian Orders, may rely on manual review only (5.7). Quebec: under Law 25 the person in charge is the same; before personal information leaves Quebec we assess the privacy impact of the transfer; a French version of this Policy is en préparation; complaints go to the Commission d'accès à l'information. Marketing e-mail is sent only with express consent (CASL).

16.5. Australia

As a small business we may be exempt under the Privacy Act 1988, but we voluntarily apply the Australian Privacy Principles. We obtain consent for sensitive information (the Similarity Check) (APP 3.3). Your data is disclosed overseas to recipients in Germany, the US, Ukraine and the other countries listed in section 7. Complaints: to us first, then the OAIC, oaic.gov.au. Marketing follows the Spam Act 2003, with unsubscribes actioned within 5 business days.

16.6. Telegram bot

The bot sees your Telegram ID, name, username, and the messages and photos you send it. At /start we show links to this Policy and the Terms; we accept photos only after you tap "I agree", which is your consent to our passing the photos to AI providers to perform the Order. The file limit is 20 MB; upload larger scans through the Site. Telegram handles your messages under its own privacy policy; the bot is not affiliated with Telegram.

16.7. Ukraine

We act under the Law of Ukraine "On Personal Data Protection" (2297-VI). Responsible person — 1.3. Your rights under Article 8 — section 10. Consent to the Similarity Check is the "unambiguous consent" under Article 7, given by tick-box (Article 2). If you upload a photo of a living person, the law (Article 12) expects that person to be told about the processing; as we have no way to reach them, you as the Customer inform them and show them this Policy, which serves as that notice. Cross-border transfers — 8.5. Complaints: the Ukrainian Parliament Commissioner for Human Rights, ombudsman.gov.ua.

17. Changes to this Policy

17.1. We announce material changes on the Site and by e-mail 14 days before they take effect. Orders already paid for remain under the version in force at the time of payment.

17.2. The Ukrainian version prevails in case of discrepancy, except for mandatory consumer rights under the law of your country of residence; the English version is a full translation of the same edition.

17.3. Version history: 1.0 — 10 September 2026 — first edition.