← Back

Privacy Policy

1. Introduction

This privacy policy explains how we collect, use, and protect your personal data when you use MultiverseGrid. We are committed to protecting your privacy and handling your data transparently.

The data controller responsible for this website can be found in our Legal Notice (Impressum).

2. Overview of Data Processing

We collect and process personal data only insofar as it is necessary for providing our website and services. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest).

3. Hosting

This website is hosted by Vercel Inc. (340 S Lemon Ave #4133, Walnut, CA 91789, USA). Vercel processes server log data (IP address, timestamp, requested URL, browser type). Data transfer to the USA is based on EU Standard Contractual Clauses.

More information: Vercel Privacy Policy

4. PostHog Analytics

We use PostHog Analytics for privacy-friendly visitor statistics. PostHog is configured to respect user privacy: we use “identified_only” person profiles (anonymous by default), and no personal data is collected without explicit user action. PostHog data is hosted in the EU. Processing is based on our legitimate interest (Art. 6(1)(f) GDPR).

More information: PostHog Privacy Policy

5. Image Processing via Artificial Intelligence

When you upload a photo, it is transmitted to Google Cloud (Vertex AI) operated by Google LLC (Mountain View, USA) to generate artistic style variations using the AI model “Imagen”. The legal basis is Art. 6(1)(a) GDPR (consent) - you provide explicit consent before uploading.

Important information:

  • Your photo is processed solely for the purpose of image generation.
  • Data transfer to the USA is based on EU Standard Contractual Clauses.
  • Google Cloud does not use customer data to train its AI models.

More information: Google Cloud Privacy Notice

Notice pursuant to EU AI Act (Regulation 2024/1689): Generated images are labeled as AI-generated. This is a minimal-risk AI system as defined in Article 50 of the Regulation. Users are informed about the use of AI before generation.

6. Photo Storage

Your uploaded photos and generated images are stored on Cloudflare R2 (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA) for order processing and fulfillment. The legal basis is Art. 6(1)(a) GDPR (consent) and Art. 6(1)(b) GDPR (performance of a contract).

Storage details:

  • Photos are stored temporarily for up to 30 days after generation.
  • For completed orders, print files are retained for 90 days to allow for reprints if needed.
  • Data transfer to the USA is based on EU Standard Contractual Clauses.
  • You can request immediate deletion of your data at any time by contacting us.

More information: Cloudflare Privacy Policy

7. Payment Processing

Orders are processed through Stripe, Inc. (510 Townsend Street, San Francisco, CA 94103, USA). Stripe processes the data necessary for completing purchases (name, address, payment details) as an independent controller. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

More information: Stripe Privacy Policy

8. Print Fulfillment

Production and shipping of your print is handled by Gelato AS (Hedgehog AS, Stenersgata 2, 0184 Oslo, Norway). Gelato receives the data necessary for production and shipping (delivery address, print file). Gelato ships worldwide from local production facilities.

9. Cookies and Storage Technologies

This website uses only technically necessary cookies and localStorage for storing your cookie consent preference. No tracking cookies or third-party advertising cookies are used.

The use of technically necessary cookies is based on § 25(2) TDDDG (German Telecommunications Digital Services Data Protection Act) and does not require consent. PostHog Analytics may set a cookie for session tracking, but is configured to respect user privacy.

10. Your Rights

Under the GDPR, you have the following rights:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)

To exercise your rights, contact us at: hello@multiversegrid.com

You also have the right to lodge a complaint with a data protection supervisory authority.

11. Data Security

Communication with our website is encrypted via TLS (HTTPS). We employ technical and organizational measures to protect your data from unauthorized access.

Last updated: February 2026