Who is responsible
La Porte B.V., Nieuwe Leliestraat 133, 1015 SN Amsterdam, Netherlands, is the controller for account, billing, support and service-security information. KvK 82417865; VAT NL862463178B01. Contact hello@5k.agency or +31 20 681 1545 for privacy questions.
What we use and why
We use your name, email, verification state and protected authentication/recovery records to provide and secure your account. If you choose email-code sign-in, we send a single-use code to your address. If Google sign-in is available and you choose it, Google provides your account identifier, name, email and verification information to sign you in; we do not request access to your Google files or email. We store project names, images, copy, settings, thumbnails and revisions when you save to the cloud. A requested server export also stores the render input, job and output. These activities provide the service you request under our contract.
We use an approximate country lookup of your IP address on our own server to show US-dollar pricing to visitors from the United States and euro pricing elsewhere. The lookup uses a downloaded country database; we do not send your IP address to that database provider. A short-lived signed price quote keeps the displayed currency consistent with checkout. We use session information, IP-related rate-limit records, access/error logs and staff audit records for our legitimate interests in preventing abuse, investigating faults and protecting customers. Support correspondence helps us respond to your request and resolve contractual issues.
We store Stripe customer, subscription, checkout, invoice and event identifiers, billing state, accepted terms, purchase confirmations and withdrawal/refund records to perform our contract, comply with legal and accounting obligations, and establish or defend claims. Stripe processes payment details; we do not store full card numbers.
Service providers and international processing
Hostinger provides hosting and server infrastructure; Titan provides email; Stripe provides payment, tax calculation and billing services. Necessary data is disclosed to the relevant provider for that purpose. Stripe may also process payment data as an independent controller under its own notice. We do not sell project or account data.
Provider processing can involve countries outside the EEA. Their data-processing terms describe applicable transfer safeguards and subprocessors. We do not promise that all processing is confined to the Netherlands. Contact us for information about safeguards applying to your data. See Hostinger’s DPA, Titan’s DPA and Stripe’s privacy notice.
When you provide personal data about clients or other people, make sure you have an appropriate basis and notice for that use. Contact us to arrange any required customer data-processing agreement before uploading such data on behalf of an organisation.
Cookies and local drafts
The studio uses essential account-session and short-lived sign-in cookies and browser storage for projects, preferences and recovery drafts. Guest Save stores images, copy and settings locally before sign-up so your work can return after registration or checkout. Clearing browser data can remove local-only work. Optional analytics is described below. Stripe’s hosted checkout and portal operate under their own notices.
Retention and closure
Active account projects remain available within the disclosed limits. We retain saved projects for at least 90 days after Pro ends, subject to your deletion request or an overriding legal/security reason, and give at least 30 days’ email notice before routine cleanup. Cancelling Pro does not close your account or erase projects.
Completed export links remain available for at least 24 hours; older render inputs and outputs can be moved to a restricted archive. Archiving is not erasure. We review archived files and inactive records according to their continuing service, security and legal need.
Account closure and deletion requests enter a staff review queue. There is no instant automatic erasure on closure. We verify the request, identify records that can be erased, explain any exceptions and arrange the appropriate action, including backups and service providers. Restricted backups are kept for recovery; any applicable erasure must also be accounted for before a backup is restored to active use.
Core financial records generally must be retained for seven years; some tax records require longer under applicable law. We retain relevant legal-claim records for the applicable claim period and restrict their use. Other support and security records are retained only while needed to resolve the issue, operate securely or comply with law; the need is reviewed rather than promising an unimplemented automatic deletion date.
Your rights
Subject to applicable conditions, you may request access, correction, erasure, restriction, portability or object to processing based on legitimate interests. Contact hello@5k.agency from your account email where possible. We use proportionate identity checks and aim to respond within one month; any lawful extension will be explained. Never send passwords, recovery codes or full card details.
You can complain to the Autoriteit Persoonsgegevens or your relevant supervisory authority. If processing is based on consent, you may withdraw that consent without affecting earlier lawful processing. We do not use automated decision-making to make legal or similarly significant decisions about you.
Updates
We publish updates here and notify account holders of material changes where required. A new notice does not retrospectively authorise incompatible use of your work.
Optional Google Analytics
With your permission, we use Google Analytics (Google tag G-RZBEVB17GG) to understand visits to our public website pages and improve 5K. It receives information about your browser/device, the public pages visited and referring website. Account, billing, project and editing pages are excluded from tagging; page URLs sent by this integration omit query parameters and unknown fragments. We do not send names, email addresses, uploaded artwork or project content as analytics fields. Analytics cookies and your consent preference are configured for up to 180 days. Advertising storage, Google signals and advertising personalisation are disabled.
Google Analytics loads only after you choose Accept analytics. No thanks keeps it off. You can withdraw or change this consent through Cookie settings in the footer; withdrawal stops future measurement and removes Analytics cookies in this browser. Essential account cookies are unaffected. Google may process data outside the EEA; see Google’s privacy policy for its processing and safeguards. The reports already collected are not erased automatically when consent is withdrawn.